Press n or j to go to the next uncovered block, b, p or k for the previous block.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 | 2x 2x 2x | /*! Copyright [Amazon.com](http://amazon.com/), Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: Apache-2.0 */ import { NagMessageLevel, rules } from "cdk-nag"; /** * Pack name * */ export let PackName = "AwsPrototyping"; /** * Rule metadata * */ export let RuleMetadata = [ { info: "The REST API stage is not associated with AWS WAFv2 web ACL.", explanation: "AWS WAFv2 is a web application firewall that helps protect web applications and APIs from attacks by allowing configured rules to allow, block, or monitor (count) web requests based on customizable rules and conditions that are defined.", level: NagMessageLevel.WARN, rule: rules.apigw.APIGWAssociatedWithWAF, }, { info: "The API does not implement authorization.", explanation: "In most cases an API needs to have an authentication and authorization implementation strategy. This includes using such approaches as IAM, Cognito User Pools, Custom authorizer, etc.\n\nExample threat: An actor with a network path to an API gateway stage end-point can interact with the API method in question without authorization, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.WARN, rule: rules.apigw.APIGWAuthorization, }, { info: "The REST API does not have request validation enabled.", explanation: "The API should have basic request validation enabled. If the API is integrated with a custom source (Lambda, ECS, etc..) in the backend, deeper input validation should be considered for implementation.", level: NagMessageLevel.WARN, rule: rules.apigw.APIGWRequestValidation, }, { info: "The Athena workgroup does not encrypt query results.", explanation: "Encrypting query results stored in S3 helps secure data to meet compliance requirements for data-at-rest encryption.", level: NagMessageLevel.WARN, rule: rules.athena.AthenaWorkgroupEncryptedQueryResults, }, { info: "The Auto Scaling launch configuration does not have public IP addresses disabled.", explanation: "If you configure your Network Interfaces with a public IP address, then the associated resources to those Network Interfaces are reachable from the internet. EC2 resources should not be publicly accessible, as this may allow unintended access to your applications or servers.\n\nExample threat: A global internet-based actor can discover EC2 instances that have public IP addresses, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.autoscaling.AutoScalingLaunchConfigPublicIpDisabled, }, { info: "The Cloud9 instance does not use a no-ingress EC2 instance with AWS Systems Manager.", explanation: "SSM adds an additional layer of protection as it allows operators to control access through IAM permissions and does not require opening inbound ports.\n\nExample threat: A global internet-based actor can discover Cloud9 EC2 instances that have public IP addresses and that are exposing SSH, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.cloud9.Cloud9InstanceNoIngressSystemsManager, }, { info: "The prototypes CloudFront distribution has not been configured with geographic restrictions (GeoRestriction)", explanation: "Geo restriction should be enabled for the distribution in order to limit the surface area exposed to expected geographies\n\nExample threat: A global internet-based actor can discover prototype web assets that are exposed via CloudFront distributions, which may lead to recon and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.cloudfront.CloudFrontDistributionGeoRestrictions, }, { info: "The CloudFront distribution allows for SSLv3 or TLSv1 for HTTPS viewer connections.", explanation: "Vulnerabilities have been and continue to be discovered in the deprecated SSL and TLS protocols. Help protect viewer connections by specifying a viewer certificate that enforces a minimum of TLSv1.1 or TLSv1.2 in the security policy. Distributions that use that use the default CloudFront viewer certificate or use 'vip' for the SslSupportMethod are non-compliant with this rule, as the minimum security policy is set to TLSv1 regardless of the specified MinimumProtocolVersion", level: NagMessageLevel.WARN, rule: rules.cloudfront.CloudFrontDistributionHttpsViewerNoOutdatedSSL, }, { info: "The CloudFront distributions uses SSLv3 or TLSv1 for communication to the origin.", explanation: "Vulnerabilities have been and continue to be discovered in the deprecated SSL and TLS protocols. Using a security policy with minimum TLSv1.1 or TLSv1.2 and appropriate security ciphers for HTTPS helps protect viewer connections.", level: NagMessageLevel.WARN, rule: rules.cloudfront.CloudFrontDistributionNoOutdatedSSL, }, { info: "The CloudFront distribution does not use an origin access identity an S3 origin.", explanation: "Origin access identities help with security by restricting any direct access to objects through S3 URLs.\n\nExample threat: A global internet-based actor can bypass the CloudFront distribution and associated controls (e.g. geo blocking), which may lead to direct access to static assets hosted on the S3 origin possibly impacting the confidentiality, integrity and availability of the data assets hosted on the S3 origin for the prototype", level: NagMessageLevel.ERROR, rule: rules.cloudfront.CloudFrontDistributionS3OriginAccessIdentity, }, { info: "The CloudFront distribution may require integration with AWS WAF.", explanation: "The Web Application Firewall can help protect against application-layer attacks that can compromise the security of the system or place unnecessary load on them.", level: NagMessageLevel.WARN, rule: rules.cloudfront.CloudFrontDistributionWAFIntegration, }, { info: "The CodeBuild environment stores sensitive credentials (such as AWS_ACCESS_KEY_ID and/or AWS_SECRET_ACCESS_KEY) as plaintext environment variables.", explanation: "Do not store these variables in clear text. Storing these variables in clear text leads to unintended data exposure and unauthorized access.\n\nExample threat: An actor who can view the CodeBuild environment variables can obtain the AWS Access Key and Secret Access Key, which may lead to the actor being able to do anything the AWS keys are authorised to do possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.codebuild.CodeBuildProjectEnvVarAwsCred, }, { info: "The CodeBuild project does not use an AWS KMS key for encryption.", explanation: "Using an AWS KMS key helps follow the standard security advice of granting least privilege to objects generated by the project.", level: NagMessageLevel.WARN, rule: rules.codebuild.CodeBuildProjectKMSEncryptedArtifacts, }, { info: "The CodeBuild project does not use images provided by the CodeBuild service or have a cdk-nag suppression rule explaining the need for a custom image.", explanation: "Explaining differences/edits to Docker images helps operators better understand system dependencies.", level: NagMessageLevel.WARN, rule: rules.codebuild.CodeBuildProjectManagedImages, }, { info: "The CodeBuild project has privileged mode enabled.", explanation: "Privileged grants elevated rights to the system, which introduces additional risk. Privileged mode should only be set to true only if the build project is used to build Docker images. Otherwise, a build that attempts to interact with the Docker daemon fails.", level: NagMessageLevel.WARN, rule: rules.codebuild.CodeBuildProjectPrivilegedModeDisabled, }, { info: "The Cognito user pool does not have AdvancedSecurityMode set to ENFORCED.", explanation: "Advanced security features enable the system to detect and act upon malicious sign-in attempts.", level: NagMessageLevel.WARN, rule: rules.cognito.CognitoUserPoolAdvancedSecurityModeEnforced, }, { info: "The API Gateway method does not use a Cognito user pool authorizer.", explanation: "API Gateway validates the tokens from a successful user pool authentication, and uses them to grant your users access to resources including Lambda functions, or your own API.", level: NagMessageLevel.WARN, rule: rules.cognito.CognitoUserPoolAPIGWAuthorizer, }, { info: "The Cognito user pool is not configured to require MFA.", explanation: "Multi-factor authentication (MFA) increases security for the application by adding another authentication method, and not relying solely on user name and password.", level: NagMessageLevel.WARN, rule: rules.cognito.CognitoUserPoolMFA, }, { info: "The Cognito identity pool allows for unauthenticated logins and does not have a cdk-nag rule suppression with a reason.", explanation: "Applications do not warrant unauthenticated guest access in many cases. Metadata explaining the use case allows for transparency to operators.\n\nExample threat: A global internet-based actor who has discovered a prototype endpoint with Cognito unauthenticated logins can does not need to provide credentials to interact with the endpoint, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.cognito.CognitoUserPoolNoUnauthenticatedLogins, }, { info: "The Cognito user pool does not have a password policy that minimally specify a password length of at least 8 characters, as well as requiring uppercase, numeric, and special characters.", explanation: "Strong password policies increase system security by encouraging users to create reliable and secure passwords.\n\nExample threat: An actor who has discovered a prototype endpoint with Cognito authenticated logins can perform a dictionary or brute force attack to authenticate as an authorized Cognito user, which may lead to the actor being able to do anything the associated Cognito user is authorised to do possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.cognito.CognitoUserPoolStrongPasswordPolicy, }, { info: "The DMS replication instance is public.", explanation: "DMS replication instances can contain sensitive information and access control is required for such accounts.\n\nExample threat: A global internet-based actor can discover DMS instances that have public IP addresses, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.dms.DMSReplicationNotPublic, }, { info: "The Document DB cluster does not have encryption at rest enabled.", explanation: "Encrypting data-at-rest protects data confidentiality and prevents unauthorized users from accessing sensitive information.", level: NagMessageLevel.WARN, rule: rules.documentdb.DocumentDBClusterEncryptionAtRest, }, { info: "The Document DB cluster uses the default endpoint port.", explanation: "Port obfuscation (using a non default endpoint port) adds an additional layer of defense against non-targeted attacks (i.e. MongoDB port 27017).", level: NagMessageLevel.WARN, rule: rules.documentdb.DocumentDBClusterNonDefaultPort, }, { info: "The Document DB cluster does not have the username and password stored in Secrets Manager.", explanation: "Secrets Manager enables operators to replace hardcoded credentials in your code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically. This helps ensure the secret can't be compromised by someone examining system code, because the secret no longer exists in the code. Also, operators can configure Secrets Manager to automatically rotate the secret for you according to a specified schedule. This enables you to replace long-term secrets with short-term ones, significantly reducing the risk of compromise.\n\nExample threat: An actor who can view the DocumentDB configuration can obtain the username and password for the DocumentDB cluster, which may lead to the actor being able to access anything the associated DocumentDB user is authorised to do possibly impacting the confidentiality, integrity and availability of the data assets hosted on the DocumentDB cluster for the prototype", level: NagMessageLevel.ERROR, rule: rules.documentdb.DocumentDBCredentialsInSecretsManager, }, { info: "The DAX cluster does not have server-side encryption enabled.", explanation: "Data in cache, configuration data and log files should be encrypted using Server-Side Encryption in order to protect from unauthorized access to the underlying storage.", level: NagMessageLevel.WARN, rule: rules.dynamodb.DAXEncrypted, }, { info: "The EBS volume has encryption disabled.", explanation: "With EBS encryption, you aren't required to build, maintain, and secure your own key management infrastructure. EBS encryption uses KMS keys when creating encrypted volumes and snapshots. This helps protect data at rest.", level: NagMessageLevel.WARN, rule: rules.ec2.EC2EBSVolumeEncrypted, }, { info: "The EC2 instance is associated with a public IP address.", explanation: "Amazon EC2 instances can contain sensitive information and access control is required for such resources.", level: NagMessageLevel.WARN, rule: rules.ec2.EC2InstanceNoPublicIp, }, { info: "The EC2 instance does not have an instance profile attached.", explanation: "EC2 instance profiles pass an IAM role to an EC2 instance. Attaching an instance profile to your instances can assist with least privilege and permissions management.", level: NagMessageLevel.WARN, rule: rules.ec2.EC2InstanceProfileAttached, }, { info: "The EC2 instance is not within a VPC.", explanation: "Because of their logical isolation, domains that reside within an Amazon VPC have an extra layer of security when compared to domains that use public endpoints.\n\nExample threat: A global internet-based actor can discover EC2 instances that have public IP addresses, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.ec2.EC2InstancesInVPC, }, { info: "The EC2 instance allows unrestricted inbound IPv4 TCP traffic on one or more common ports (by default these ports include 20, 21, 3389, 3309, 3306, 4333).", explanation: "Not restricting access to ports to trusted sources can lead to attacks against the availability, integrity and confidentiality of systems. By default, common ports which should be restricted include port numbers 20, 21, 3389, 3306, and 4333.\n\nExample threat: A global internet-based actor can discover exposed services (e.g. Telnet, SSH, RDS, MySQL) using their common port numbers, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.ec2.EC2RestrictedCommonPorts, }, { info: "The Security Group allows for 0.0.0.0/0 or ::/0 inbound access.", explanation: "Large port ranges, when open, expose instances to unwanted attacks. More than that, they make traceability of vulnerabilities very difficult. For instance, your web servers may only require 80 and 443 ports to be open, but not all. One of the most common mistakes observed is when all ports for 0.0.0.0/0 range are open in a rush to access the instance. EC2 instances must expose only to those ports enabled on the corresponding security group level.\n\nExample threat: A global internet-based actor can discover EC2 instances that have public IP addresses and allow ingress to all internet address or move laterally to non-public EC2 instances, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.ec2.EC2RestrictedInbound, }, { info: "The Security Group allows unrestricted SSH access.", explanation: "Not allowing ingress (or remote) traffic from 0.0.0.0/0 or ::/0 to port 22 on your resources helps to restrict remote access.\n\nExample threat: A global internet-based actor can discover EC2 instances that have public IP addresses and allow ingress to all internet address to SSH or move laterally to non-public EC2 instances via SSH, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.ec2.EC2RestrictedSSH, }, { info: "The Security Group does not have a description.", explanation: "Descriptions help simplify operations and remove any opportunities for operator errors.", level: NagMessageLevel.WARN, rule: rules.ec2.EC2SecurityGroupDescription, }, { info: "The ECR Repository allows open access.", explanation: "Removing * principals in an ECR Repository helps protect against unauthorized access.\n\nExample threat: A global internet-based actor who has discovered a ECR repository can access the container images hosted within the repository, which may lead to information disclosure that aids in the intrusion activities being successful against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.ecr.ECROpenAccess, }, { info: "One or more containers in the ECS Task Definition do not have container logging enabled.", explanation: "Container logging allows operators to view and aggregate the logs from the container. Containers should use the 'awslogs' driver at a minimum.", level: NagMessageLevel.WARN, rule: rules.ecs.ECSTaskDefinitionContainerLogging, }, { info: "The ECS Task Definition includes a container definition that directly specifies environment variables.", explanation: "Use secrets to inject environment variables during container startup from AWS Systems Manager Parameter Store or Secrets Manager instead of directly specifying plaintext environment variables. Updates to direct environment variables require operators to change task definitions and perform new deployments.", level: NagMessageLevel.WARN, rule: rules.ecs.ECSTaskDefinitionNoEnvironmentVariables, }, { info: "The EFS does not have encryption at rest enabled.", explanation: "Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon Elastic File System (EFS).", level: NagMessageLevel.WARN, rule: rules.efs.EFSEncrypted, }, { info: "The EKS Cluster does not publish 'api', 'audit', 'authenticator, 'controllerManager', and 'scheduler' control plane logs.", explanation: "EKS control plane logging provides audit and diagnostic logs directly from the Amazon EKS control plane to CloudWatch Logs in your account. These logs make it easy for you to secure and run your clusters. This is a granular rule that returns individual findings that can be suppressed with appliesTo. The findings are in the format LogExport::<log> for exported logs. Example: appliesTo: ['LogExport::authenticate'].", level: NagMessageLevel.WARN, rule: rules.eks.EKSClusterControlPlaneLogs, }, { info: "The EKS cluster's Kubernetes API server endpoint has public access enabled.", explanation: "A cluster's Kubernetes API server endpoint should not be publicly accessible from the Internet in order to avoid exposing private data and minimizing security risks. The API server endpoints should only be accessible from within a AWS Virtual Private Cloud (VPC).\n\nExample threat: A global internet-based actor who has discovered a EKS cluster Kubernetes API server endpoint can perform reconnaissance and intrusion activities against the exposed attack surface, which may lead to possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.eks.EKSClusterNoEndpointPublicAccess, }, { info: "The ElastiCache cluster is not provisioned in a VPC.", explanation: "Provisioning the cluster within a VPC allows for better flexibility and control over the cache clusters security, availability, traffic routing and more.\n\nExample threat: A global internet-based actor can discover the ElastiCache cluster that have public IP addresses, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data with the cluster used within the prototype", level: NagMessageLevel.ERROR, rule: rules.elasticache.ElastiCacheClusterInVPC, }, { info: "The ElastiCache cluster uses the default endpoint port.", explanation: "Port obfuscation (using a non default endpoint port) adds an additional layer of defense against non-targeted attacks (i.e. Redis port 6379 and Memcached port 11211).", level: NagMessageLevel.WARN, rule: rules.elasticache.ElastiCacheClusterNonDefaultPort, }, { info: "The ElastiCache Redis cluster does not have both encryption in transit and at rest enabled.", explanation: "Encryption in transit helps secure communications to the cluster. Encryption at rest helps protect data at rest from unauthorized access.", level: NagMessageLevel.WARN, rule: rules.elasticache.ElastiCacheRedisClusterEncryption, }, { info: "The ElastiCache Redis cluster does not use Redis AUTH for user authentication.", explanation: "Redis authentication tokens enable Redis to require a token (password) before allowing clients to execute commands, thereby improving data security.", level: NagMessageLevel.WARN, rule: rules.elasticache.ElastiCacheRedisClusterRedisAuth, }, { info: "The Elastic Beanstalk environment does not upload EC2 Instance logs to S3.", explanation: "Beanstalk environment logs should be retained and uploaded to Amazon S3 in order to keep the logging data for future audits, historical purposes or to track and analyze the EB application environment behavior for a long period of time.", level: NagMessageLevel.WARN, rule: rules.elasticbeanstalk.ElasticBeanstalkEC2InstanceLogsToS3, }, { info: "The Elastic Beanstalk environment does not have managed updates enabled.", explanation: "Enable managed platform updates for beanstalk environments in order to receive bug fixes, software updates and new features. Managed platform updates perform immutable environment updates.\n\nExample threat: An actor with a network path to the Elastic Beanstalk environment can attempt to take advantage of a known vulnerability in a platform component used by Elastic Beanstalk, which may lead to unknown impacts possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.elasticbeanstalk.ElasticBeanstalkManagedUpdatesEnabled, }, { info: "The Elastic Beanstalk environment is not configured to use a specific VPC.", explanation: "Use a non-default VPC in order to separate your environment from default resources.", level: NagMessageLevel.WARN, rule: rules.elasticbeanstalk.ElasticBeanstalkVPCSpecified, }, { info: "The ALB's HTTP listeners are not configured to redirect to HTTPS.", explanation: "To help protect data in transit, ensure that your Application Load Balancer automatically redirects unencrypted HTTP requests to HTTPS. Because sensitive data can exist, enable encryption in transit to help protect that data.", level: NagMessageLevel.WARN, rule: rules.elb.ALBHttpToHttpsRedirection, }, { info: "The CLB does not restrict its listeners to only the SSL and HTTPS protocols.", explanation: "Ensure that your Classic Load Balancers (CLBs) are configured with SSL or HTTPS listeners. Because sensitive data can exist, enable encryption in transit to help protect that data.", level: NagMessageLevel.WARN, rule: rules.elb.ELBTlsHttpsListenersOnly, }, { info: "The EMR cluster does not implement authentication via an EC2 Key Pair or Kerberos.", explanation: "SSH clients can use an EC2 key pair to authenticate to cluster instances. Alternatively, with EMR release version 5.10.0 or later, solutions can configure Kerberos to authenticate users and SSH connections to the master node.", level: NagMessageLevel.WARN, rule: rules.emr.EMRAuthEC2KeyPairOrKerberos, }, { info: "The EMR cluster does not use a security configuration with encryption in transit enabled and configured.", explanation: "EMR Clusters should have a method for encrypting data in transit using Transport Layer Security (TLS).", level: NagMessageLevel.WARN, rule: rules.emr.EMREncryptionInTransit, }, { info: "The EMR cluster does not use a security configuration with local disk encryption enabled.", explanation: "Local disk encryption uses a combination of open-source HDFS encryption and LUKS encryption to secure data at rest.", level: NagMessageLevel.WARN, rule: rules.emr.EMRLocalDiskEncryption, }, { info: "The event bus policy allows for open access.", explanation: 'An open policy ("*" principal without a condition) grants anonymous access to an event bus. Use a condition to limit the permission to accounts that fulfill a certain requirement, such as being a member of a certain AWS organization.\n\nExample threat: A global internet-based actor who has discovered the Event Bridge event bus (e.g. Endpoint ID) can put arbitrary events onto the bus, which may lead to which could be processed by the prototype possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype', level: NagMessageLevel.ERROR, rule: rules.eventbridge.EventBusOpenAccess, }, { info: "The Glue crawler or job does not use a security configuration with CloudWatch Log encryption enabled.", explanation: "Enabling encryption at rest helps prevent unauthorized users from getting access to the logging data published to CloudWatch Logs.", level: NagMessageLevel.WARN, rule: rules.glue.GlueEncryptedCloudWatchLogs, }, { info: "The Glue job does not have use a security configuration with job bookmark encryption enabled.", explanation: "Job bookmark encryption encrypts bookmark data before it is sent to Amazon S3 for storage.", level: NagMessageLevel.WARN, rule: rules.glue.GlueJobBookmarkEncrypted, }, { info: "The IAM user, role, or group uses AWS managed policies.", explanation: "An AWS managed policy is a standalone policy that is created and administered by AWS. Currently, many AWS managed policies do not restrict resource scope. Replace AWS managed policies with system specific (customer) managed policies. This is a granular rule that returns individual findings that can be suppressed with appliesTo. The findings are in the format Policy::<policy> for AWS managed policies. Example: appliesTo: ['Policy::arn:<AWS::Partition>:iam::aws:policy/foo'].", level: NagMessageLevel.WARN, rule: rules.iam.IAMNoManagedPolicies, }, { info: "The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission.", explanation: "Metadata explaining the evidence (e.g. via supporting links) for wildcard permissions allows for transparency to operators. This is a granular rule that returns individual findings that can be suppressed with appliesTo. The findings are in the format Action::<action> for policy actions and Resource::<resource> for resources. Example: appliesTo: ['Action::s3:*'].", level: NagMessageLevel.WARN, rule: rules.iam.IAMNoWildcardPermissions, }, { info: "The IAM policy grants admin access - meaning the policy allows a principal to perform unlimited actions on any service", explanation: "AWS Identity and Access Management (IAM) can help you incorporate the principles of least privilege and separation of duties with access permissions and authorizations, by ensuring that IAM groups have at least one IAM user. Placing IAM users in groups based on their associated permissions or job function is one way to incorporate least privilege.\n\nExample threat: A global internet-based actor who has successfully obtained valid keys or a session associated of the IAM Principal associated with the IAM policy can perform unlimited AWS actions on any AWS service which are exposed via the AWS API/Management Console/CLI, which may lead to broad and unknown impacts possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.iam.IAMPolicyNoStatementsWithAdminAccess, }, { info: "The IAM policy grants full access - meaning the policy allows unlimited actions for a given AWS service", explanation: "Ensure IAM Actions are restricted to only those actions that are needed. Allowing users to have more privileges than needed to complete a task may violate the principle of least privilege and separation of duties.", level: NagMessageLevel.WARN, rule: rules.iam.IAMPolicyNoStatementsWithFullAccess, }, { info: "The Kinesis Data Firehose delivery stream does not have server-side encryption enabled.", explanation: "Enabling encryption allows the system to meet strict regulatory requirements and enhance the security of system data.", level: NagMessageLevel.WARN, rule: rules.kinesis.KinesisDataFirehoseSSE, }, { info: 'The Kinesis Data Stream specifies server-side encryption and does not use the "aws/kinesis" key.', explanation: "Customer Managed Keys can incur additional costs that scale with the amount of consumers and producers. Ensure that Customer Managed Keys are required for compliance before using them (https://docs.aws.amazon.com/streams/latest/dev/costs-performance.html).", level: NagMessageLevel.WARN, rule: rules.kinesis.KinesisDataStreamDefaultKeyWhenSSE, }, { info: "The Kinesis Data Stream does not have server-side encryption enabled.", explanation: "Data is encrypted before it's written to the Kinesis stream storage layer, and decrypted after it’s retrieved from storage. This allows the system to meet strict regulatory requirements and enhance the security of system data.", level: NagMessageLevel.WARN, rule: rules.kinesis.KinesisDataStreamSSE, }, { info: "The KMS Symmetric key does not have automatic key rotation enabled.", explanation: "KMS key rotation allow a system to set a rotation schedule for a KMS key so when a AWS KMS key is required to encrypt new data, the KMS service can automatically use the latest version of the HSA backing key to perform the encryption.", level: NagMessageLevel.WARN, rule: rules.kms.KMSBackingKeyRotationEnabled, }, { info: "The Lambda function permission grants public access", explanation: "Public access allows anyone on the internet to perform unauthenticated actions on your function and can potentially lead to degraded availability.\n\nExample threat: A global internet-based actor who has discovered the Lambda function name or ARN can invoke/delete/modify the Lambda function without any authentication, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.lambda.LambdaFunctionPublicAccessProhibited, }, { info: "The Lambda Function URL allows for public, unauthenticated access.", explanation: "AWS Lambda Function URLs allow you to invoke your function via a HTTPS end-point, setting the authentication to NONE allows anyone on the internet to invoke your function.\n\nExample threat: A global internet-based actor who has discovered the Lambda Function URL can invoke the Lambda function without any authentication, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.lambda.LambdaFunctionUrlAuth, }, { info: "The non-container Lambda function is not configured to use the latest runtime version.", explanation: "Use the latest available runtime for the targeted language to avoid technical debt. Runtimes specific to a language or framework version are deprecated when the version reaches end of life. This rule only applies to non-container Lambda functions.", level: NagMessageLevel.WARN, rule: rules.lambda.LambdaLatestVersion, }, { info: "The MediaStore container does not define a CORS policy.", explanation: "Using a CORS policy helps follow the standard security advice of granting least privilege, or granting only the permissions required to allow needed access to the container.", level: NagMessageLevel.WARN, rule: rules.mediastore.MediaStoreContainerCORSPolicy, }, { info: "The MediaStore container does not define a container policy.", explanation: "Using a container policy helps follow the standard security advice of granting least privilege, or granting only the permissions required to allow needed access to the container.", level: NagMessageLevel.WARN, rule: rules.mediastore.MediaStoreContainerHasContainerPolicy, }, { info: "The MediaStore container does not require requests to use SSL.", explanation: "You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on MediaStore container policies.", level: NagMessageLevel.WARN, rule: rules.mediastore.MediaStoreContainerSSLRequestsOnly, }, { info: "The MSK cluster uses plaintext communication between brokers.", explanation: "TLS communication secures data-in-transit by encrypting the connection between brokers.", level: NagMessageLevel.WARN, rule: rules.msk.MSKBrokerToBrokerTLS, }, { info: "The MSK cluster uses plaintext communication between clients and brokers.", explanation: "TLS only communication secures data-in-transit by encrypting the connection between the clients and brokers.", level: NagMessageLevel.WARN, rule: rules.msk.MSKClientToBrokerTLS, }, { info: "The Neptune DB instance does have Auto Minor Version Upgrade enabled.", explanation: "The Neptune service regularly releases engine updates. Enabling Auto Minor Version Upgrade will allow the service to automatically apply these upgrades to DB Instances.\n\nExample threat: An actor with a network path to the Neptune cluster or instance can attempt to take advantage of a known vulnerability in a component exposed by Neptune, which may lead to unknown impacts possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.neptune.NeptuneClusterAutomaticMinorVersionUpgrade, }, { info: "The Neptune DB cluster does not have encryption at rest enabled.", explanation: "Encrypting data-at-rest protects data confidentiality and prevents unauthorized users from accessing sensitive information.", level: NagMessageLevel.WARN, rule: rules.neptune.NeptuneClusterEncryptionAtRest, }, { info: "The Neptune DB cluster does not have IAM Database Authentication enabled.", explanation: "With IAM Database Authentication enabled, the system doesn't have to use a password when connecting to the cluster.", level: NagMessageLevel.WARN, rule: rules.neptune.NeptuneClusterIAMAuth, }, { info: "The OpenSearch Service domain does not only grant access via allowlisted IP addresses.", explanation: "Using allowlisted IP addresses helps protect the domain against unauthorized access.", level: NagMessageLevel.WARN, rule: rules.opensearch.OpenSearchAllowlistedIPs, }, { info: "The OpenSearch Service domain does not have encryption at rest enabled.", explanation: "Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your Amazon OpenSearch Service (OpenSearch Service) domains.", level: NagMessageLevel.WARN, rule: rules.opensearch.OpenSearchEncryptedAtRest, }, { info: "The OpenSearch Service domain is not provisioned inside a VPC.", explanation: "Provisioning the domain within a VPC enables better flexibility and control over the clusters access and security as this feature keeps all traffic between the VPC and OpenSearch domains within the AWS network instead of going over the public Internet.\n\nExample threat: A global internet-based actor can discover the OpenSearch Service domain that have public IP addresses, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data with the cluster used within the prototype", level: NagMessageLevel.ERROR, rule: rules.opensearch.OpenSearchInVPCOnly, }, { info: "The OpenSearch Service domain does not have node-to-node encryption enabled.", explanation: "Because sensitive data can exist, enable encryption in transit to help protect that data within your Amazon OpenSearch Service (OpenSearch Service) domains.", level: NagMessageLevel.WARN, rule: rules.opensearch.OpenSearchNodeToNodeEncryption, }, { info: "The OpenSearch Service domain does not allow for unsigned requests or anonymous access.", explanation: "Restricting public access helps prevent unauthorized access and prevents any unsigned requests to be made to the resources.\n\nExample threat: An actor with a network path to the OpenSearch Service domain can directly access the domain without authentication, which may lead to allowing access to data hosted within the domain possibly impacting the confidentiality, integrity and availability of the data assets hosted on the OpenSearch Service domain for the prototype", level: NagMessageLevel.ERROR, rule: rules.opensearch.OpenSearchNoUnsignedOrAnonymousAccess, }, { info: "The Quicksight data sources connection is not configured to use SSL.", explanation: "SSL secures communications to data sources, especially when using public networks. Using SSL with QuickSight requires the use of certificates signed by a publicly-recognized certificate authority.", level: NagMessageLevel.WARN, rule: rules.quicksight.QuicksightSSLConnections, }, { info: "The RDS Aurora MySQL/PostgresSQL cluster does not have IAM Database Authentication enabled.", explanation: "With IAM Database Authentication enabled, the system doesn't have to use a password when connecting to the MySQL/PostgreSQL database instances, instead it uses an authentication token.", level: NagMessageLevel.WARN, rule: rules.rds.AuroraMySQLPostgresIAMAuth, }, { info: "The RDS DB instance does not have automatic minor version upgrades enabled.", explanation: "Enable automatic minor version upgrades on your Amazon Relational Database Service (RDS) instances to ensure the latest minor version updates to the Relational Database Management System (RDBMS) are installed, which may include security patches and bug fixes.\n\nExample threat: An actor with a network path to the RDS cluster or instance can attempt to take advantage of a known vulnerability in a component exposed by RDS, which may lead to unknown impacts possibly impacting the confidentiality, integrity and availability of the data assets hosted on the RDS Cluster or instance for the prototype", level: NagMessageLevel.ERROR, rule: rules.rds.RDSAutomaticMinorVersionUpgradeEnabled, }, { info: "The RDS DB instance allows public access.", explanation: "Amazon RDS database instances can contain sensitive information, hence appropriate access control and principles of least privilege should be applied.\n\nExample threat: A global internet-based actor who has discovered the RDS DB instance endpoint can perform reconnaissance and intrusion activities (e.g. brute force/dictionary attack to authenticate as a valid user) against the exposed attack surface, which may lead to possibly impacting the confidentiality, integrity and availability of the data assets hosted on the RDS Cluster or instance for the prototype", level: NagMessageLevel.ERROR, rule: rules.rds.RDSInstancePublicAccess, }, { info: "The RDS instance or Aurora DB cluster uses the default endpoint port.", explanation: "Port obfuscation (using a non default endpoint port) adds an additional layer of defense against non-targeted attacks (i.e. MySQL/Aurora port 3306, SQL Server port 1433, PostgreSQL port 5432, etc).", level: NagMessageLevel.WARN, rule: rules.rds.RDSNonDefaultPort, }, { info: "The RDS DB Security Group allows for 0.0.0.0/0 inbound access.", explanation: "RDS DB security groups should not allow access from 0.0.0.0/0 (i.e. anywhere, every machine that has the ability to establish a connection) in order to reduce the risk of unauthorized access.\n\nExample threat: A global internet-based actor can discover RDS DB instances that have public IP addresses and allow ingress to all internet address or move laterally to non-public RDS DB instances, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data assets hosted on the RDS Cluster or instance for the prototype", level: NagMessageLevel.ERROR, rule: rules.rds.RDSRestrictedInbound, }, { info: "The RDS DB instance or Aurora DB cluster does not have encryption at rest enabled.", explanation: "Because sensitive data can exist at rest in Amazon RDS DB instances, enable encryption at rest to help protect that data.", level: NagMessageLevel.WARN, rule: rules.rds.RDSStorageEncrypted, }, { info: "The Redshift cluster does not have encryption at rest enabled.", explanation: "Encrypting data-at-rest protects data confidentiality.", level: NagMessageLevel.WARN, rule: rules.redshift.RedshiftClusterEncryptionAtRest, }, { info: "The Redshift cluster is not provisioned in a VPC.", explanation: "Provisioning the cluster within a VPC allows for better flexibility and control over the Redshift clusters security, availability, traffic routing and more.\n\nExample threat: A global internet-based actor can discover a RedShift cluster that have public IP addresses, which may lead to reconnaissance and intrusion activities (e.g. brute force/dictionary attack to authenticate as a valid user) being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data with the cluster used within the prototype", level: NagMessageLevel.ERROR, rule: rules.redshift.RedshiftClusterInVPC, }, { info: "The Redshift cluster uses the default endpoint port.", explanation: "Port obfuscation (using a non default endpoint port) adds an additional layer of defense against non-targeted attacks (i.e. Redshift port 5439).", level: NagMessageLevel.WARN, rule: rules.redshift.RedshiftClusterNonDefaultPort, }, { info: 'The Redshift cluster uses the default "awsuser" username.', explanation: 'Using a custom user name instead of the default master user name (i.e. "awsuser") provides an additional layer of defense against non-targeted attacks.', level: NagMessageLevel.WARN, rule: rules.redshift.RedshiftClusterNonDefaultUsername, }, { info: "The Redshift cluster allows public access.", explanation: "Amazon Redshift clusters can contain sensitive information, hence appropriate access control and principles of least privilege should be applied.\n\nExample threat: A global internet-based actor who has discovered the Redshift cluster endpoint can perform reconnaissance and intrusion activities (e.g. brute force/dictionary attack to authenticate as a valid user) against the exposed attack surface, which may lead to possibly impacting the confidentiality, integrity and availability of the data assets hosted on the Redshift cluster for the prototype", level: NagMessageLevel.ERROR, rule: rules.redshift.RedshiftClusterPublicAccess, }, { info: "The Redshift cluster does not have version upgrade enabled.", explanation: "Version Upgrade must enabled on the cluster in order to automatically receive upgrades during the maintenance window.\n\nExample threat: An actor with a network path to the Redshift cluster can attempt to take advantage of a known vulnerability in a component exposed by Redshift, which may lead to unknown impacts possibly impacting the confidentiality, integrity and availability of the data assets hosted on the Redshift cluster for the prototype", level: NagMessageLevel.ERROR, rule: rules.redshift.RedshiftClusterVersionUpgrade, }, { info: "The Redshift cluster does not require TLS/SSL encryption.", explanation: "Ensure that your Amazon Redshift clusters require TLS/SSL encryption to connect to SQL clients. Because sensitive data can exist, enable encryption in transit to help protect that data.", level: NagMessageLevel.WARN, rule: rules.redshift.RedshiftRequireTlsSSL, }, { info: "The S3 bucket does not prohibit public access through bucket level settings.", explanation: "Keep sensitive data safe from unauthorized remote users by preventing public access at the bucket level.\n\nExample threat: A global internet-based actor who has discovered a S3 bucket configured for public read or write can read or write data to or from the S3 bucket, which may lead to possibly impacting the confidentiality, integrity and availability of the data assets hosted on the S3 bucket for the prototype", level: NagMessageLevel.ERROR, rule: rules.s3.S3BucketLevelPublicAccessProhibited, }, { info: "The S3 Bucket does not have server access logs enabled.", explanation: "Amazon Simple Storage Service (Amazon S3) server access logging provides a method to monitor the network for potential cybersecurity events. The events are monitored by capturing detailed records for the requests that are made to an Amazon S3 bucket. Each access log record provides details about a single access request. The details include the requester, bucket name, request time, request action, response status, and an error code, if relevant.", level: NagMessageLevel.WARN, rule: rules.s3.S3BucketLoggingEnabled, }, { info: "The S3 Bucket does not prohibit public read access through its Block Public Access configurations and bucket ACLs.", explanation: "The management of access should be consistent with the classification of the data.\n\nExample threat: A global internet-based actor who has discovered a S3 bucket configured for public read can read data from the S3 bucket, which may lead to possibly impacting the confidentiality of the data assets hosted on the S3 bucket for the prototype", level: NagMessageLevel.ERROR, rule: rules.s3.S3BucketPublicReadProhibited, }, { info: "The S3 Bucket does not prohibit public write access through its Block Public Access configurations and bucket ACLs.", explanation: "The management of access should be consistent with the classification of the data.\n\nExample threat: A global internet-based actor who has discovered a S3 bucket configured for public write can write data to, or overwrite data within the S3 bucket, which may lead to possibly impacting the integrity and availability of the data assets hosted on the S3 bucket for the prototype", level: NagMessageLevel.ERROR, rule: rules.s3.S3BucketPublicWriteProhibited, }, { info: "The S3 Bucket or bucket policy does not require requests to use SSL/TLS.", explanation: "You can use HTTPS (TLS) to help prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. You should allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition on Amazon S3 bucket policies.", level: NagMessageLevel.WARN, rule: rules.s3.S3BucketSSLRequestsOnly, }, { info: "The S3 static website bucket either has an open world bucket policy or does not use a CloudFront Origin Access Identity (OAI) in the bucket policy for limited getObject and/or putObject permissions.", explanation: "An OAI allows you to provide access to content in your S3 static website bucket through CloudFront URLs without enabling public access through an open bucket policy, disabling S3 Block Public Access settings, and/or through object ACLs.\n\nExample threat: A global internet-based actor who has discovered a S3 hosted website can discover prototype web assets that are hosted on the website, which may lead to recon and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.s3.S3WebBucketOAIAccess, }, { info: "The SageMaker notebook instance does not have an encrypted storage volume.", explanation: "Encrypting storage volumes helps protect SageMaker data-at-rest.", level: NagMessageLevel.WARN, rule: rules.sagemaker.SageMakerNotebookInstanceKMSKeyConfigured, }, { info: "The SageMaker notebook instance is not provisioned inside a VPC.", explanation: "Provisioning the notebook instances inside a VPC enables the notebook to access VPC-only resources such as EFS file systems.", level: NagMessageLevel.WARN, rule: rules.sagemaker.SageMakerNotebookInVPC, }, { info: "The SageMaker notebook does not disable direct internet access.", explanation: "By preventing direct internet access, you can keep sensitive data from being accessed by unauthorized users.", level: NagMessageLevel.WARN, rule: rules.sagemaker.SageMakerNotebookNoDirectInternetAccess, }, { info: "The secret does not have automatic rotation scheduled.", explanation: "Rotating secrets on a regular schedule can shorten the period a secret is active, and potentially reduce the business impact if the secret is compromised.", level: NagMessageLevel.WARN, rule: rules.secretsmanager.SecretsManagerRotationEnabled, }, { info: "The SNS topic does not have KMS encryption enabled.", explanation: "To help protect data at rest, ensure that your Amazon Simple Notification Service (Amazon SNS) topics require encryption using AWS Key Management Service (AWS KMS). Because sensitive data can exist at rest in published messages, enable encryption at rest to help protect that data.", level: NagMessageLevel.WARN, rule: rules.sns.SNSEncryptedKMS, }, { info: "The SNS Topic does not require publishers to use SSL.", explanation: "Without HTTPS (TLS), a network-based attacker can eavesdrop on network traffic or manipulate it, using an attack such as man-in-the-middle. Allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition and the 'sns:Publish' action in the topic policy to force publishers to use SSL. If SSE is already enabled then this control is auto enforced.", level: NagMessageLevel.WARN, rule: rules.sns.SNSTopicSSLPublishOnly, }, { info: "The SQS Queue does not have server-side encryption enabled.", explanation: "Server side encryption adds additional protection of sensitive data delivered as messages to subscribers.", level: NagMessageLevel.WARN, rule: rules.sqs.SQSQueueSSE, }, { info: "The SQS queue does not require requests to use SSL.", explanation: "Without HTTPS (TLS), a network-based attacker can eavesdrop on network traffic or manipulate it, using an attack such as man-in-the-middle. Allow only encrypted connections over HTTPS (TLS) using the aws:SecureTransport condition in the queue policy to force requests to use SSL.", level: NagMessageLevel.WARN, rule: rules.sqs.SQSQueueSSLRequestsOnly, }, { info: "The Timestream database does not use a Customer Managed KMS Key for at rest encryption.", explanation: "All Timestream tables in a database are encrypted at rest by default using an AWS Managed Key. These keys are rotated every three years. Data at rest must be encrypted using CMKs if you require more control over the permissions and lifecycle of your keys, including the ability to have them automatically rotated on an periodic basis.", level: NagMessageLevel.WARN, rule: rules.timestream.TimestreamDatabaseCustomerManagedKey, }, { info: "A Network ACL or Network ACL entry has been implemented.", explanation: "Network ACLs should be used sparingly for the following reasons: they can be complex to manage, they are stateless, every IP address must be explicitly opened in each (inbound/outbound) direction, and they affect a complete subnet. Use security groups when possible as they are stateful and easier to manage.", level: NagMessageLevel.WARN, rule: rules.vpc.VPCNoNACLs, }, { info: "The subnet auto-assigns public IP addresses.", explanation: "Manage access to the AWS Cloud by ensuring Amazon Virtual Private Cloud (VPC) subnets are not automatically assigned a public IP address. Amazon Elastic Compute Cloud (EC2) instances that are launched into subnets that have this attribute enabled have a public IP address assigned to their primary network interface.\n\nExample threat: A global internet-based actor can discover VPC-attached resources (e.g. EC2 instances) within the subnet in question that have public IP addresses, which may lead to reconnaissance and intrusion activities being performed against the exposed attack surface possibly impacting the confidentiality, integrity and availability of the data and resource assets associated with the prototype", level: NagMessageLevel.ERROR, rule: rules.vpc.VPCSubnetAutoAssignPublicIpDisabled, }, ]; |