Kanji
・Cloud engineer / freelance ・Born in 1993 ・From Ehime / Living in Shibuya, Tokyo ・5 years AWS experience Profile details
Table of Contents
[Account.1]
[IAM.28]
[EC2.8]
[S3.22]
CloudWatch.1
14
1.16
IAM.1
When I first wrote this article in April 2024, AWS Security Hub only supported CIS AWS Foundations Benchmark v1.2.0 and v1.4.0. Back then, running open-source Prowler was the only viable way to audit an AWS environment against CIS v3.0.0.
Since then, AWS Security Hub CSPM has officially added support for CIS AWS Foundations Benchmark v3.0.0 (May 2024) and v5.0.0 (2025) , allowing teams to continuously evaluate most CIS v3.0.0 and v5.0.0 controls natively.
However, when I migrated our AWS Organizations multi-account environment from CIS v1.4.0 to CIS v3.0.0 in Security Hub—and disabled the legacy v1.4.0 standard assuming v3.0.0 was a complete superset—I hit a major blind spot.
During a control inventory review the following week, I realized that all 14 log metric filter and alarm checks in Section 4 ( 4.1 – 4.15 : monitoring root usage, IAM policy changes, console authentication failures, VPC/SG changes, etc.) as well as 1.16 (prohibiting *:* full administrative privileges, formerly [IAM.1] ) had completely vanished from our Security Hub compliance evaluations.
4.1
4.15
*:*
[IAM.1]
Digging into the official Security Hub control mapping revealed why: because CIS reclassified the Section 4 metric filter requirements from Automated to Manual starting in v3.0.0, AWS Security Hub CSPM marks [CloudWatch.1] through [CloudWatch.14] as Not supported – manual check in both CIS v3.0.0 and v5.0.0. Similarly, [IAM.1] is no longer mapped to CIS v3.0.0 / v5.0.0 in Security Hub and is only evaluated if you keep AWS Foundational Security Best Practices (FSBP) or CIS v1.4.0 enabled.
Automated
Manual
[CloudWatch.1]
[CloudWatch.14]
Not supported – manual check
That experience led me to our current production standard: instead of relying on a single tool, divide CIS compliance across three complementary layers—pre-deploy CI/CD static blocking ( CFn Guard ), AWS Config-backed continuous CSPM ( Security Hub ), and scheduled deep API auditing that covers Manual and Section 4 controls ( Prowler v4/v5 ) .
CFn Guard
Security Hub
Prowler v4/v5
▲ 3-Layer CIS Benchmark Audit Architecture combining CFn Guard (Shift-Left), Security Hub CSPM (Continuous Runtime), and Prowler v4/v5 (Deep API Audit)
The table below compares CIS AWS Foundations Benchmark version support and architectural characteristics across AWS Security Hub CSPM, AWS CloudFormation Guard ( cfn-guard ), and Prowler.
cfn-guard
cis_1.4_aws
cis_1.5_aws
cis_2.0_aws
cis_3.0_aws
cis_4.0_aws
cis_5.0_aws
Security Hub CSPM excels at organization-wide governance through AWS Organizations delegated administration and Central Configuration. By enabling Consolidated Control Findings, overlapping controls shared between CIS v3.0.0/v5.0.0 and FSBP (such as [S3.8] or [EC2.8] ) are evaluated only once by AWS Config, preventing duplicate Config rule billing.
[S3.8]
However, two operational limitations require careful attention:
1.13
1.18
1.2
us-east-1
cfn-guard is an open-source policy-as-code CLI from AWS that validates CloudFormation templates (YAML/JSON) before deployment. While aws-guard-rules-registry provides CIS Level 1 and Level 2 rule sets, it can only inspect resource properties explicitly declared in templates (18 items such as S3 public access blocks, RDS encryption, and security group ingress rules). It cannot inspect account-level state like root MFA or access key rotation age, making it strictly a CI/CD pre-deploy gatekeeper.
aws-guard-rules-registry
Because Prowler calls AWS APIs directly via Boto3, it can audit all 62 CIS v3.0.0 items immediately—even in sandbox accounts or regions where AWS Config is disabled. Most importantly, Prowler automatically verifies all Section 4 CloudWatch metric filters and alarms ( 4.1 – 4.15 ) via API , filling the exact gap left by Security Hub’s CIS v3.0.0 and v5.0.0 standards.
The flowchart below outlines how to combine these tools when adopting CIS v3.0.0 / v5.0.0 or migrating from CIS v1.4.0.
# 1. Enable CIS v3.0.0 / v5.0.0 standards in AWS Security Hub CSPM aws securityhub batch-enable-standards \ --standards-subscription-requests \ StandardsArn="arn:aws:securityhub:ap-northeast-1::standards/cis-aws-foundations-benchmark/v/3.0.0" \ StandardsArn="arn:aws:securityhub:ap-northeast-1::standards/cis-aws-foundations-benchmark/v/5.0.0" # 2. Run Prowler v4 / v5 for CIS v3.0.0 and push findings to Security Hub (ASFF) prowler aws --compliance cis_3.0_aws --security-hub --region ap-northeast-1 # 3. Validate CloudFormation templates pre-deploy using cfn-guard cfn-guard validate \ --data ./template.yaml \ --rules ./aws-guard-rules-registry/rules/aws/amazon_s3/ \ --show-summary fail
The tables below map all 62 requirements in CIS AWS Foundations Benchmark v3.0.0 across AWS Security Hub CSPM (including official [Control.ID] and v5.0.0 section numbers), CFn Guard, and Prowler v4/v5.
[Control.ID]
In CIS v3.0.0, Security Hub added support for 1.15 ( [IAM.2] ), 1.19 ( [IAM.26] ), 1.20 ( [IAM.28] ), and 1.22 ( [IAM.27] ), while dropping 1.16 ( [IAM.1] full *:* admin policy check) from the CIS v3.0.0/v5.0.0 standard mapping.
1.15
[IAM.2]
1.19
[IAM.26]
1.20
1.22
[IAM.27]
Security Hub v3.0.0 significantly expanded Storage coverage by adding RDS automatic minor version upgrades ( 2.3.2 : [RDS.13] ), RDS public access prohibition ( 2.3.3 : [RDS.2] ), and EFS encryption ( 2.4.1 : [EFS.1] ). In CIS v5.0.0, EBS encryption moves to 5.1.1 and RDS Multi-AZ ( 2.2.4 : [RDS.5] / [RDS.15] ) is added.
2.3.2
[RDS.13]
2.3.3
[RDS.2]
2.4.1
[EFS.1]
5.1.1
2.2.4
[RDS.5]
[RDS.15]
With the addition of S3 object-level write and read event logging ( 3.8 : [S3.22] and 3.9 : [S3.23] ) in v3.0.0, 100% of Section 3 (all 9 items) is fully automated in both Security Hub CSPM and Prowler .
3.8
3.9
[S3.23]
As noted earlier, zero items in Section 4 are supported in Security Hub’s CIS v3.0.0 or v5.0.0 standards because CIS reclassified 4.1 – 4.15 as Manual . To maintain automated checks for CloudWatch metric filters and alarms, either retain [CloudWatch.1] and [CloudWatch.4] – [CloudWatch.14] from CIS v1.4.0 or run Prowler.
[CloudWatch.4]
In Section 5, Security Hub v3.0.0 added support for IPv4/IPv6 remote administration port restrictions ( 5.2 : [EC2.53] and 5.3 : [EC2.54] ) and mandatory EC2 IMDSv2 ( 5.6 : [EC2.8] ). Only 5.5 (VPC peering least-access routing: Manual) remains unsupported in Security Hub.
5.2
[EC2.53]
5.3
[EC2.54]
5.6
5.5
Across all 62 requirements in CIS AWS Foundations Benchmark v3.0.0, effective coverage breaks down as follows:
[CloudWatch.1, 4--14]
In practice, as organizations transition toward CIS v5.0.0, I still debate how long we should maintain legacy CloudWatch Logs metric filters and SNS alarms for Section 4 when direct EventBridge rules on CloudTrail events are faster and simpler. Still, external auditors and compliance questionnaires continue to ask for strict CIS Benchmark evidence. Pairing continuous Security Hub CSPM monitoring with scheduled Prowler scans remains the most pragmatic way to satisfy both real-world security operations and formal audit requirements.
Step-by-step guide to writing custom security checks in Prowler for AWS, GCP, and Azure. Includes th ... [Read more]
Learn how to automatically scrape and export AWS Security Hub control references (severity, Config r ... [Read more]
Expert architectural design for AWS Organizations, Control Tower, IAM Identity Center, Prowler custom compliance checks, and Terraform / Cloud Run CI/CD.
See our serverless cloud and AI engineering in action with Alpha Radar (AI market intelligence) and CandidLens (AI visual analytics).
Get the complete configuration pack featured in this article: universal AGENTS.md, deterministic hooks.json, Git safety guardrails, and validation scripts tested across Antigravity, Kiro, Claude Code, and Codex.