【提示/解決方法】如何抓取Security Hub控制元件的引用並將其轉換為資料

📅 發布日: 2024/02/12, 更新日: 2024/02/12 ⏱️ 預計閱讀時間約149分鐘 (59,701字)

在安全中心中，您可以透過啟用一項名為“標準”的功能來啟用名為“控制元件”的安全檢查規則，
並根據AWS最佳實踐檢查安全設定。
透過啟用控制元件，將建立AWS配置規則，並根據為每個控制元件定義的重要性顯示檢查結果。如果已啟用標準，則可以從AWS Config管理控制檯確認這些建立的AWS Config規則，
但無法確認使用AWS API建立了哪些規則。
本文介紹如何抓取Security Hub控制元件的引用並將其轉換為資料。

用於抓取 Security Hub 控制引用的 Python 指令碼

用於抓取 Security Hub 控制引用的 Python 指令碼

以下 Python 指令碼抓取 AWS Security Hub 控制元件的引用並將其輸出到 JSON 檔案。
URLS 變數列出了要抓取的頁面。截至 2/4，日文頁面不包含 12/18 新增的 15 個控制元件的詳細資訊，因此英文頁面正在被刪除。
參考： AWS Security Hub 推出 15 項新安全控制
SEARCH_STRINGS 變數指定要抓取的資訊的關鍵字。
FIND_ELEMENT_NAME 變數指定包含要抓取的資訊的父 HTML 標記。
FIND_NEXT_SIBLINGS 變數指定包含要抓取的資訊的父 HTML 標記的下一個同級元素。在這些同級元素中搜尋“SEARCH_STRINGS”中指定的關鍵字。
生成的 JSON 檔案儲存在 .output 目錄中。

從日期時間匯入日期時間匯入 json 匯入請求匯入作業系統匯入系統匯入日誌記錄從 bs4 匯入 BeautifulSoup

LOG_LEVEL = 日誌記錄.INFO
網址 = [
“https://docs.aws.amazon.com/securityhub/latest/userguide/account-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/acm-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/appsync-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/athena-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/backup-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/cloudformation-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/cloudwatch-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/config-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/ecr-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/autoscaling-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/ssm-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/efs-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/eks-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/elasticache-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/elasticbeanstalk-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/emr-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/es-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/eventbridge-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/fsx-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/guardduty-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/kinesis-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/lambda-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/macie-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/msk-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/mq-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/pca-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/route53-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/sagemaker-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/secretsmanager-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/sns-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/sqs-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/stepfunctions-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/waf-controls.html”]
搜尋字串 = {
“AWS Config 規則”: “程式碼”,
“資源型別”: “程式碼”,
“時間表型別”：“文字”，
“嚴重性”：“文字”
}
FIND_ELEMENT_NAME =“h2”
FIND_NEXT_SIBLINGS = “p”

類 TimeFormatter(logging.Formatter):
轉換器 = datetime.fromtimestamp

def formatTime(self, record, datefmt=None):
dt = self.converter(記錄.建立)
如果日期：
s = dt.strftime(datefmt)
別的：
t = dt.strftime(self.default_time_format)
s = self.default_msec_format % (t, 記錄.msecs)
返回

def init_logger():
記錄器=logging.getLogger(name)

log_format_string = json.dumps({
‘logLevel’: ‘%(levelname)s’,
‘時間’: ‘%(asctime)s’,
‘line’: “%(檔名)s: %(lineno)d”,
‘訊息’: ‘%(訊息)s’,
}，縮排=無）
處理程式=logging.StreamHandler(sys.stdout)
handler.setFormatter((TimeFormatter(log_format_string)))
logger.addHandler(處理程式)
logger.propagate = False
logger.setLevel(LOG_LEVEL)

返回記錄器

def main():
記錄器 = init_logger()

結果=[]

對於 URLS 中的 url：
響應 = requests.get(url)
響應.編碼 = 響應.表觀編碼

湯 = BeautifulSoup(response.text, ‘html.parser’)
find_elements = soup.find_all(FIND_ELEMENT_NAME)

對於 find_elements 中的 find_element：
next_siblings = find_element.find_next_siblings(FIND_NEXT_SIBLINGS)
條目 = {“find_element.text”：find_element.text}

logger.debug(f”find_element: {find_element}“)

對於 search_string，SEARCH_STRINGS.items() 中的方法：
對於 next_siblings 中的兄弟姐妹：
如果 search_string 在sibling.text中：
如果方法==“文字”：
值=sibling.b.next_sibling.strip()
條目[搜尋字串] = 值
logger.debug(f”search_string: {search_string}, value: {value}“)
休息
別的：
value_element =sibling.find(method, {‘class’: ‘code’})
如果值元素：
條目[搜尋字串] = value_element.text
logger.debug(f”search_string: {search_string}, value: {value_element.text}“)
休息
如果 search_string 不在條目中：
條目[search_string] =“未找到”
logger.debug(f”search_string: {search_string}, 值: None”)

結果.追加（條目）

如果不是 os.path.exists(‘.output’):
os.makedirs(‘.output’)

now = datetime.now().strftime(‘%Y%m%d%H%M%S’)

將 open(f’.output/result_{now}.json’, ‘w’,encoding=‘utf-8’) 作為 f：
json.dump(結果，f，ensure_ascii=False)

logger.info(f”成功將結果儲存到.output/result_{now}.json”)

如果 name == “main”:
主要的（）

## JSON File of Retrieved AWS Security Hub Control References

- The actual contents of the retrieved JSON file are as follows.
  - Some items are marked as `Not Found`, which means that the keywords specified in the `SEARCH_STRINGS` variable were not found.

<details>
<summary>JSON of AWS Security Hub Control References</summary>

json
[
{
“find_element.text”: “[Account.1] 應為 AWS 賬戶提供安全聯絡資訊”,
“AWS Config 規則”: “安全帳戶資訊提供”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[Account.2] AWS 賬戶應屬於 AWS Organizations 組織”,
“AWS Config 規則”: “組織的賬戶部分”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[ACM.1] 匯入的和 ACM 頒發的證書應在指定時間段後續訂”,
“AWS Config 規則”: “acm-certificate-expiration-check”,
“資源型別”: “AWS::ACM::證書”,
“Schedule type”: “更改觸發且定期”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ACM.2] ACM 管理的 RSA 證書應使用至少 2,048 位的金鑰長度”,
“AWS Config 規則”: “acm-certificate-rsa-check”,
“資源型別”: “AWS::ACM::證書”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[APIGateway.1] API 閘道器 REST 和 WebSocket API 執行日誌應啟用”,
“AWS Config 規則”: “api-gw-execution-logging-enabled”,
“資源型別”: “AWS::ApiGateway::Stage”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[APIGateway.2] API Gateway REST API 階段應配置為使用SSL 證書進行後端身份驗證”,
“AWS Config 規則”: “api-gw-ssl-enabled”,
“資源型別”: “AWS::ApiGateway::Stage”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[APIGateway.3] API Gateway REST API 階段應啟用 AWS X-Ray跟蹤”,
“AWS Config 規則”: “api-gw-xray-enabled”,
“資源型別”: “AWS::ApiGateway::Stage”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[APIGateway.4] API 閘道器應與 WAF WebACL 關聯”,
“AWS Config 規則”: “api-gw-cache-加密”,
“資源型別”: “AWS::ApiGateway::Stage”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[APIGateway.5] API Gateway REST API 快取資料應在靜態時加密”,
“AWS Config 規則”: “api-gw-cache-加密”,
“資源型別”: “AWS::ApiGateway::Stage”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[APIGateway.8] API 閘道器路由應指定授權型別”,
“AWS Config 規則”: “api-gwv2-authorization-type-configured”,
“資源型別”: “AWS::ApiGatewayV2::Route”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[APIGateway.9] 應為 API Gateway V2階段配置訪問日誌記錄”,
“AWS Config 規則”: “api-gwv2-access-logs-enabled”,
“資源型別”: “AWS::ApiGatewayV2::Stage”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[AppSync.2] AWS AppSync 應啟用欄位級日誌記錄”,
“AWS Config 規則”: “appsync-logging-enabled”,
“資源型別”: “AWS::AppSync::GraphQLApi”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[AppSync.5] AWS AppSync GraphQL API 不應使用 API 金鑰進行身份驗證”,
“AWS Config 規則”: “appsync-authorization-check”,
“資源型別”: “AWS::AppSync::GraphQLApi”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[Athena.1] Athena 工作組應在休息時加密”,
“AWS Config 規則”: “athena-workgroup-encrypted-at-rest”,
“資源型別”: “AWS::Athena::WorkGroup”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Backup.1] AWS Backup 恢復點應靜態加密”,
“AWS Config 規則”: “備份恢復點加密”,
“資源型別”: “AWS::Backup::RecoveryPoint”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[CloudFormation.1] CloudFormation 堆疊應與簡單通知服務 (SNS) 整合”,
“AWS Config 規則”: “cloudformation-stack-notification-check”,
“資源型別”: “AWS::CloudFormation::Stack”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudFront.1] CloudFront 發行版應配置預設根物件”,
“AWS Config 規則”: “cloudfront-default-root-object-configured”,
“資源型別”: “AWS::CloudFront::Distribution”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[CloudFront.3] CloudFront 發行版應要求傳輸過程中加密”,
“AWS Config 規則”: “cloudfront-viewer-policy-https”,
“資源型別”: “AWS::CloudFront::Distribution”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[CloudFront.4] CloudFront 發行版應配置源故障轉移”,
“AWS Config 規則”: “cloudfront-origin-failover-enabled”,
“資源型別”: “AWS::CloudFront::Distribution”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudFront.5] CloudFront 發行版應啟用日誌記錄”,
“AWS Config 規則”: “cloudfront-accesslogs-enabled”,
“資源型別”: “AWS::CloudFront::Distribution”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[CloudFront.6] CloudFront 發行版應啟用 WAF”,
“AWS Config 規則”: “cloudfront-linked-with-waf”,
“資源型別”: “AWS::CloudFront::Distribution”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[CloudFront.7] CloudFront 發行版應使用自定義 SSL/TLS 證書”,
“AWS Config 規則”: “cloudfront-custom-ssl-certificate”,
“資源型別”: “AWS::CloudFront::Distribution”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[CloudFront.8] CloudFront 發行版應使用 SNI 來處理 HTTPS 請求”,
“AWS Config 規則”: “cloudfront-sni-enabled”,
“資源型別”: “AWS::CloudFront::Distribution”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudFront.9] CloudFront 發行版應加密到自定義源的流量”,
“AWS Config 規則”: “cloudfront-traffic-to-origin-encrypted”,
“資源型別”: “AWS::CloudFront::Distribution”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[CloudFront.10] CloudFront 發行版不應在邊緣站點和自定義源之間使用已棄用的 SSL 協議”,
“AWS Config 規則”: “cloudfront-no-deprecated-ssl-protocols”,
“資源型別”: “AWS::CloudFront::Distribution”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[CloudFront.12] CloudFront 發行版不應指向不存在的 S3 源”,
“AWS Config 規則”: “cloudfront-s3-origin-non-existent-bucket”,
“資源型別”: “AWS::CloudFront::Distribution”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[CloudFront.13] CloudFront 發行版應使用源訪問控制”,
“AWS Config 規則”: “cloudfront-s3-origin-access-control-enabled”,
“資源型別”: “AWS::CloudFront::Distribution”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[CloudTrail.1] CloudTrail 應啟用並配置至少一個包含讀寫管理事件的多區域跟蹤”,
“AWS Config 規則”: “multi-region-cloudtrail-enabled”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[CloudTrail.2] CloudTrail 應啟用靜態加密”,
“AWS Config 規則”: “cloud-trail-加密啟用”,
“資源型別”: “AWS::CloudTrail::Trail”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[CloudTrail.3] 應啟用 CloudTrail”,
“AWS Config 規則”: “cloudtrail-enabled”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[CloudTrail.4] 應啟用 CloudTrail 日誌檔案驗證”,
“AWS Config 規則”: “cloud-trail-log-file-validation-enabled”,
“資源型別”: “AWS::CloudTrail::Trail”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudTrail.5] CloudTrail 跟蹤應與 Amazon CloudWatch Logs 整合”,
“AWS Config 規則”: “cloud-trail-cloud-watch-logs-enabled”,
“資源型別”: “AWS::CloudTrail::Trail”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudTrail.6] 確保用於儲存 CloudTrail 日誌的 S3 儲存桶不可公開訪問”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::CloudTrail::Trail”,
“Schedule type”: “定期且更改”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[CloudTrail.7] 確保在 CloudTrail S3 儲存桶上啟用 S3 儲存桶訪問日誌記錄”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::CloudTrail::Trail”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.1] 應存在日誌指標過濾器和警報以供 "root" 使用者使用”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.2] 確保針對未經授權的 API 呼叫存在日誌指標過濾器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.3] 確保在沒有 MFA 的情況下登入管理控制檯時存在日誌指標篩選器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.4] 確保 IAM 策略更改存在日誌指標過濾器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.5] 確保 CloudTrail AWS 配置更改存在日誌指標篩選器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.6] 確保針對 AWS 管理控制檯身份驗證失敗存在日誌指標篩選器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.7] 確儲存在日誌指標過濾器和警報以禁用或計劃刪除客戶管理的金鑰”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.8] 確保 S3 儲存桶策略更改存在日誌指標過濾器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.9] 確保針對 AWS Config 配置更改存在日誌指標篩選器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.10] 確保安全組更改存在日誌指標過濾器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.11] 確儲存在針對網路訪問控制列表 (NACL) 更改的日誌指標篩選器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.12] 確儲存在針對網路閘道器更改的日誌指標篩選器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.13] 確保路由表更改存在日誌指標過濾器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.14] 確保 VPC 更改存在日誌指標過濾器和警報”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::Logs::MetricFilter”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[CloudWatch.15] CloudWatch 警報應配置指定的操作”,
“AWS Config 規則”: “cloudwatch-alarm-action-check”,
“資源型別”: “AWS::CloudWatch::Alarm”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[CloudWatch.16] CloudWatch 日誌組應保留指定時間段”,
“AWS Config 規則”: “cw-loggroup-retention-period-check”,
“資源型別”: “AWS::Logs::LogGroup”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[CloudWatch.17] 應啟用 CloudWatch 警報操作”,
“AWS Config 規則”: “cloudwatch-alarm-action-enabled-check”,
“資源型別”: “AWS::CloudWatch::Alarm”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[CodeBuild.1] CodeBuild Bitbucket 源儲存庫 URL 不應包含敏感憑據”,
“AWS Config 規則”: “codebuild-project-source-repo-url-check”,
“資源型別”: “AWS::CodeBuild::Project”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[CodeBuild.2] CodeBuild 專案環境變數不應包含明文憑據”,
“AWS Config 規則”: “codebuild-project-envvar-awscred-check”,
“資源型別”: “AWS::CodeBuild::Project”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[CodeBuild.3] CodeBuild S3 日誌應加密”,
“AWS Config 規則”: “codebuild-project-s3-logs-encrypted”,
“資源型別”: “AWS::CodeBuild::Project”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[CodeBuild.4] CodeBuild 專案環境應具有日誌記錄 AWS 配置”,
“AWS Config 規則”: “codebuild-project-logging-enabled”,
“資源型別”: “AWS::CodeBuild::Project”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[CodeBuild.5] CodeBuild 專案環境不應啟用特權模式”,
“AWS Config 規則”: “codebuild-project-environment-privileged-check”,
“資源型別”: “AWS::CodeBuild::Project”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[Config.1] 應啟用 AWS Config”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[DMS.1] 資料庫遷移服務複製例項不應公開”,
“AWS Config 規則”: “dms-replication-not-public”,
“資源型別”: “AWS::DMS::ReplicationInstance”,
“時間表型別”：“定期”，
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[DMS.6] DMS 複製例項應啟用自動次要版本升級”,
“AWS Config 規則”: “dms-auto-minor-version-upgrade-enabled”,
“資源型別”: “AWS::DMS::ReplicationInstance”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[DMS.7] 目標資料庫的 DMS 複製任務應啟用日誌記錄”,
“AWS Config 規則”: “dms-replication-task-targetdb-logging”,
“資源型別”: “AWS::DMS::ReplicationTask”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[DMS.8] 源資料庫的 DMS 複製任務應啟用日誌記錄”,
“AWS Config 規則”: “dms-replication-task-sourcedb-logging”,
“資源型別”: “AWS::DMS::ReplicationTask”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[DMS.9] DMS 端點應使用 SSL”,
“AWS Config 規則”: “dms-endpoint-ssl-configured”,
“資源型別”: “AWS::DMS::Endpoint”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[DocumentDB.1] Amazon DocumentDB 叢集應在靜態時加密”,
“AWS Config 規則”: “docdb-cluster-加密”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[DocumentDB.2] Amazon DocumentDB 叢集應有足夠的備份保留期”,
“AWS Config 規則”: “docdb-cluster-backup-retention-check”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[DocumentDB.3] Amazon DocumentDB 手動叢集快照不應公開”,
“AWS Config 規則”: “docdb-cluster-snapshot-public-prohibited”,
“資源型別”: “AWS::RDS::DBClusterSnapshot”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[DocumentDB.4] Amazon DocumentDB 叢集應將稽核日誌釋出到 CloudWatch Logs”,
“AWS Config 規則”: “docdb-cluster-audit-logging-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[DocumentDB.5] Amazon DocumentDB 叢集應啟用刪除保護”,
“AWS Config 規則”: “docdb-cluster-deletion-protection-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[DynamoDB.1] DynamoDB 表應根據需求自動擴充套件容量”,
“AWS Config 規則”: “dynamodb-autoscaling-enabled”,
“資源型別”: “AWS::DynamoDB::Table”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[DynamoDB.2] DynamoDB 表應啟用時間點恢復”,
“AWS Config 規則”: “dynamodb-pitr-enabled”,
“資源型別”: “AWS::DynamoDB::Table”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[DynamoDB.3] DynamoDB Accelerator (DAX) 叢集應靜態加密”,
“AWS Config 規則”: “dax-加密啟用”,
“資源型別”: “AWS::DynamoDB::叢集”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[DynamoDB.4] DynamoDB 表應出現在備份計劃中”,
“AWS Config 規則”: “dynamodb-resources-protected-by-backup-plan”,
“資源型別”: “AWS::DynamoDB::Table”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[DynamoDB.6] DynamoDB 表應啟用刪除保護”,
“AWS Config 規則”: “dynamodb-table-deletion-protection-enabled”,
“資源型別”: “AWS::DynamoDB::Table”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ECR.1] ECR 私有儲存庫應配置影象掃描”,
“AWS Config 規則”: “ecr-private-image-scanning-enabled”,
“資源型別”: “AWS::ECR::Repository”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[ECR.2] ECR 私有儲存庫應配置標籤不變性”,
“AWS Config 規則”: “ecr-private-tag-immutability-enabled”,
“資源型別”: “AWS::ECR::Repository”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ECR.3] ECR 儲存庫應至少配置一個生命週期策略”,
“AWS Config 規則”: “ecr-private-lifecycle-policy-configured”,
“資源型別”: “AWS::ECR::Repository”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ECS.1] Amazon ECS 任務定義應具有安全網路模式和使用者定義。”,
“AWS Config 規則”: “ecs-task-definition-user-for-host-mode-check”,
“資源型別”: “AWS::ECS::TaskDefinition”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[ECS.2] ECS 服務不應自動分配公共 IP 地址”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::ECS::Service”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[ECS.3] ECS 任務定義不應共享主機的程序名稱空間”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::ECS::TaskDefinition”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[ECS.4] ECS 容器應以非特權方式執行”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::ECS::TaskDefinition”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[ECS.5] ECS 容器應僅限於對根檔案系統的只讀訪問”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::ECS::TaskDefinition”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[ECS.8] 秘密不應作為容器環境變數傳遞”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::ECS::TaskDefinition”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[ECS.9] ECS 任務定義應具有日誌記錄配置”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::ECS::TaskDefinition”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[ECS.10] ECS Fargate 服務應在最新的 Fargate 平臺版本上執行”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::ECS::Service”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ECS.12] ECS 叢集應使用 Container Insights”,
“AWS Config 規則”：“未找到”，
“資源型別”: “AWS::ECS::叢集”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.1] Amazon EBS 快照不應公開恢復”,
“AWS Config 規則”: “ebs-snapshot-public-restorable-check”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[EC2.2] VPC 預設安全組不應允許入站或出站流量”,
“AWS Config 規則”: “vpc-default-security-group-close”,
“資源型別”: “AWS::EC2::SecurityGroup”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[EC2.3] 附加的 Amazon EBS 卷應靜態加密”,
“AWS Config 規則”: “加密卷”,
“資源型別”: “AWS::EC2::卷”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.4] 停止的 EC2 例項應在指定時間段後刪除”,
“AWS Config 規則”: “ec2-stopped-instance”,
“資源型別”: “AWS::EC2::例項”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.6] 應在所有 VPC 中啟用 VPC 流日誌記錄”,
“AWS Config 規則”: “vpc-flow-logs-enabled”,
“資源型別”: “AWS::EC2::VPC”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.7] EBS 預設加密應啟用”,
“AWS Config 規則”: “ec2-ebs-encryption-by-default”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.8] EC2 例項應使用例項後設資料服務版本 2 (IMDSv2)”,
“AWS Config 規則”: “ec2-imdsv2-check”,
“資源型別”: “AWS::EC2::例項”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[EC2.9] Amazon EC2 例項不應具有公共 IPv4 地址”,
“AWS Config 規則”: “ec2-instance-no-public-ip”,
“資源型別”: “AWS::EC2::例項”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[EC2.10] Amazon EC2 應配置為使用為 Amazon EC2 服務建立的 VPC 終端節點”,
“AWS Config 規則”: “service-vpc-endpoint-enabled”,
“資源型別”: “AWS::EC2::VPC”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.12] 應刪除未使用的 Amazon EC2 EIP”,
“AWS Config 規則”: “eip-attached”,
“資源型別”: “AWS::EC2::EIP”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[EC2.13] 安全組不應允許從.0.0/0 或 ::/0 進入埠 22”,
“AWS Config 規則”: “restricted-ssh”,
“資源型別”: “AWS::EC2::SecurityGroup”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[EC2.14] 安全組不應允許從 0.0.0.0/0 或 ::/0 進入埠 3389”,
“AWS Config 規則”: “restricted-common-ports”,
“資源型別”: “AWS::EC2::SecurityGroup”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[EC2.15] Amazon EC2 子網不應自動分配公共 IP 地址”,
“AWS Config 規則”: “subnet-auto-assign-public-ip-disabled”,
“資源型別”: “AWS::EC2::子網”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.16] 應刪除未使用的網路訪問控制列表”,
“AWS Config 規則”: “vpc-network-acl-unused-check”,
“資源型別”: “AWS::EC2::NetworkAcl”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[EC2.17] Amazon EC2 例項不應使用多個ENI”,
“AWS Config 規則”: “ec2-instance-multiple-eni-check”,
“資源型別”: “AWS::EC2::例項”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[EC2.18] 安全組應僅允許授權埠不受限制傳入流量”,
“AWS Config 規則”: “vpc-sg-open-only-to-authorized-ports”,
“資源型別”: “AWS::EC2::SecurityGroup”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[EC2.19] 安全組不應允許無限制訪問高風險埠”,
“AWS Config 規則”: “vpc-sg-restricted-common-ports”,
“資源型別”: “AWS::EC2::SecurityGroup”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[EC2.20] AWS Site-to-Site VPN連線的兩個 VPN 隧道都應該啟動”,
“AWS Config 規則”: “vpc-vpn-2-tunnels-up”,
“資源型別”: “AWS::EC2::卷”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.21] 網路 ACL 不應允許從 0.0.0.0/0 進入埠 22 或埠 3389”,
“AWS Config 規則”: “nacl-no-unrestricted-ssh-rdp”,
“資源型別”: “AWS::EC2::卷”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.22] 應刪除未使用的 Amazon EC2 安全組”,
“AWS Config 規則”: “ec2-security-group-attached-to-eni-periodic”,
“資源型別”: “AWS::EC2::卷”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.23] Amazon EC2 Transit Gateway 不應自動接受 VPC 附件請求”,
“AWS Config 規則”: “ec2-transit-gateway-auto-vpc-attach-disabled”,
“資源型別”: “AWS::EC2::卷”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[EC2.24] 不應使用Amazon EC2 半虛擬例項型別”,
“AWS Config 規則”: “ec2-paravirtual-instance-check”,
“資源型別”: “AWS::EC2::卷”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[EC2.25] Amazon EC2 啟動模板不應將公共IP 分配給網路介面”,
“AWS Config 規則”: “ec2-launch-template-public-ip-disabled”,
“資源型別”: “AWS::EC2::卷”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[EC2.28] EBS 卷應包含在備份計劃中”,
“AWS Config 規則”: “ebs-resources-protected-by-backup-plan”,
“資源型別”: “AWS::EC2::卷”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[EC2.51] EC2 客戶端 VPN 端點應啟用客戶端連線日誌記錄”,
“AWS Config 規則”: “ec2-client-vpn-connection-log-enabled”,
“資源型別”: “AWS::EC2::ClientVpnEndpoint”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[AutoScaling.1] 與 Classic Load Balancer 關聯的 Auto Scaling 組應使用負載均衡器執行狀況檢查”,
“AWS Config 規則”: “autoscaling-group-elb-healthcheck-required”,
“資源型別”: “AWS::AutoScaling::AutoScalingGroup”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[AutoScaling.2] Amazon EC2 Auto Scaling 組應覆蓋多個可用區”,
“AWS Config 規則”: “autoscaling-multiple-az”,
“資源型別”: “AWS::AutoScaling::AutoScalingGroup”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[AutoScaling.3] Auto Scaling 組啟動配置應將 EC2 例項配置為需要例項後設資料服務版本 2 (IMDSv2)”,
“AWS Config 規則”: “autoscaling-launchconfig-requires-imdsv2”,
“資源型別”: “AWS::AutoScaling::LaunchConfiguration”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[AutoScaling.4] Auto Scaling 組啟動配置的後設資料響應躍點限制不應大於 1”,
“AWS Config 規則”: “autoscaling-launch-config-hop-limit”,
“資源型別”: “AWS::AutoScaling::LaunchConfiguration”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[Autoscaling.5] 使用 Auto Scaling 組啟動配置啟動的 Amazon EC2 例項不應具有公共 IP 地址”,
“AWS Config 規則”: “autoscaling-launch-config-public-ip-disabled”,
“資源型別”: “AWS::AutoScaling::LaunchConfiguration”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[AutoScaling.6] Auto Scaling 組應在多個可用區中使用多種例項型別”,
“AWS Config 規則”: “autoscaling-multiple-instance-types”,
“資源型別”: “AWS::AutoScaling::AutoScalingGroup”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[AutoScaling.9] Amazon EC2 Auto Scaling 組應使用 Amazon EC2 啟動模板”,
“AWS Config 規則”: “autoscaling-launch-template”,
“資源型別”: “AWS::AutoScaling::AutoScalingGroup”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[SSM.1] Amazon EC2 例項應由 AWS Systems Manager 管理”,
“AWS Config 規則”: “ec2-instance-management-by-systems-manager”,
“資源型別”: “AWS::SSM::PatchCompliance”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[SSM.2] Systems Manager 管理的 Amazon EC2 例項在安裝補丁後應具有 COMPLIANT 的補丁合規性狀態”,
“AWS Config 規則”: “ec2-managementinstance-patch-compliance-status-check”,
“資源型別”: “AWS::SSM::PatchCompliance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[SSM.3] Systems Manager 管理的 Amazon EC2 例項的關聯合規性狀態應為 COMPLIANT”,
“AWS Config 規則”: “ec2-managementinstance-association-compliance-status-check”,
“資源型別”: “AWS::SSM::AssociationCompliance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[SSM.4] SSM 檔案不應公開”,
“AWS Config 規則”: “ssm-document-not-public”,
“資源型別”: “AWS::SSM::文件”,
“時間表型別”：“定期”，
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[EFS.1] 彈性檔案系統應配置為使用 AWS KMS 加密靜態檔案資料”,
“AWS Config 規則”: “efs-加密-檢查”,
“資源型別”: “AWS::EFS::FileSystem”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[EFS.2] Amazon EFS 卷應位於備份計劃中”,
“AWS Config 規則”: “efs-in-backup-plan”,
“資源型別”: “AWS::EFS::FileSystem”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[EFS.3] EFS 接入點應強制執行根目錄”,
“AWS Config 規則”: “efs-access-point-enforce-root-directory”,
“資源型別”: “AWS::EFS::AccessPoint”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[EFS.4] EFS 接入點應強制執行使用者身份”,
“AWS Config 規則”: “efs-access-point-enforce-user-identity”,
“資源型別”: “AWS::EFS::AccessPoint”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[EKS.1] EKS 叢集端點不應公開訪問”,
“AWS Config 規則”: “eks-endpoint-no-public-access”,
“資源型別”: “AWS::EKS::叢集”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[EKS.2] EKS 叢集應在受支援的 Kubernetes 版本上執行”,
“AWS Config 規則”: “eks-cluster-supported-version”,
“資源型別”: “AWS::EKS::叢集”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[EKS.8] EKS 叢集應啟用稽核日誌記錄”,
“AWS Config 規則”: “eks-cluster-logging-enabled”,
“資源型別”: “AWS::EKS::叢集”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[ElastiCache.1] ElastiCache Redis 叢集應啟用自動備份”,
“AWS Config 規則”: “elasticache-redis-cluster-automatic-backup-check”,
“資源型別”: “AWS::ElastiCache::CacheCluster”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[ElastiCache.2] ElastiCache for Redis 快取叢集應啟用自動次要版本升級”,
“AWS Config 規則”: “elasticache-auto-minor-version-upgrade-check”,
“資源型別”: “AWS::ElastiCache::CacheCluster”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[ElastiCache.3] ElastiCache for Redis 複製組應啟用自動故障轉移”,
“AWS Config 規則”: “elasticache-repl-grp-auto-failover-enabled”,
“資源型別”: “AWS::ElastiCache::ReplicationGroup”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[ElastiCache.4] ElastiCache for Redis 複製組應靜態加密”,
“AWS Config 規則”: “elasticache-repl-grp-encrypted-at-rest”,
“資源型別”: “AWS::ElastiCache::ReplicationGroup”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[ElastiCache.5] ElastiCache for Redis 複製組應在傳輸過程中加密”,
“AWS Config 規則”: “elasticache-repl-grp-加密傳輸中”,
“資源型別”: “AWS::ElastiCache::ReplicationGroup”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[ElastiCache.6] 6.0 版本之前的 ElastiCache for Redis 複製組應使用 Redis AUTH”,
“AWS Config 規則”: “elasticache-repl-grp-redis-auth-enabled”,
“資源型別”: “AWS::ElastiCache::ReplicationGroup”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[ElastiCache.7] ElastiCache 叢集不應使用預設子網組”,
“AWS Config 規則”: “elasticache-subnet-group-check”,
“資源型別”: “AWS::ElastiCache::CacheCluster”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[ElasticBeanstalk.1] Elastic Beanstalk 環境應啟用增強的執行狀況報告”,
“AWS Config 規則”: “beanstalk-enhanced-health-reporting-enabled”,
“資源型別”: “AWS::ElasticBeanstalk::環境”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[ElasticBeanstalk.2] 應啟用 Elastic Beanstalk 託管平臺更新”,
“AWS Config 規則”: “elastic-beanstalk-management-updates-enabled”,
“資源型別”: “AWS::ElasticBeanstalk::環境”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[ElasticBeanstalk.3] Elastic Beanstalk 應將日誌流式傳輸到 CloudWatch”,
“AWS Config 規則”: “elastic-beanstalk-logs-to-cloudwatch”,
“資源型別”: “AWS::ElasticBeanstalk::環境”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[ELB.1] 應用程式負載均衡器應配置為將所有 HTTP 請求重定向到 HTTPS”,
“AWS Config 規則”: “alb-http-to-https-redirection-check”,
“資源型別”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.2] 具有 SSL/HTTPS 偵聽器的 Classic Load Balancer 應使用 AWS Certificate Manager 提供的證書”,
“AWS Config 規則”: “elb-acm-certificate-required”,
“資源型別”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.3] Classic Load Balancer 偵聽器應配置 HTTPS 或 TLS 終止”,
“AWS Config 規則”: “elb-tls-https-listeners-only”,
“資源型別”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.4] 應用程式負載均衡器應配置為刪除 http 標頭”,
“AWS Config 規則”: “alb-http-drop-invalid-header-enabled”,
“資源型別”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.5] 應啟用應用程式和經典負載均衡器日誌記錄”,
“AWS Config 規則”: “elb-logging-enabled”,
“資源型別”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.6] 應啟用 Application Load Balancer 刪除保護”,
“AWS Config 規則”: “elb-deletion-protection-enabled”,
“資源型別”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.7] Classic Load Balancer 應啟用連線耗盡”,
“AWS Config 規則”: “elb-predefined-security-policy-ssl-check”,
“資源型別”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.8] 具有 SSL 偵聽器的經典負載均衡器應使用具有強大 AWS 配置的預定義安全策略”,
“AWS Config 規則”: “elb-predefined-security-policy-ssl-check”,
“資源型別”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.9] 經典負載均衡器應啟用跨區域負載均衡”,
“AWS Config 規則”: “elb-cross-zone-load-balancing-enabled”,
“資源型別”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.10] 經典負載均衡器應跨越多個可用區”,
“AWS Config 規則”: “clb-multiple-az”,
“資源型別”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.12] 應用程式負載均衡器應配置為防禦性或最嚴格的非同步緩解模式”,
“AWS Config 規則”: “alb-desync-mode-check”,
“資源型別”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.13] 應用程式、網路和閘道器負載均衡器應跨越多個可用區”,
“AWS Config 規則”: “elbv2-multiple-az”,
“資源型別”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.14] 經典負載均衡器應配置為防禦性或最嚴格的非同步緩解模式”,
“AWS Config 規則”: “clb-desync-mode-check”,
“資源型別”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ELB.16] Application Load Balancer 應與 AWS WAF Web ACL 關聯”,
“AWS Config 規則”: “alb-waf-enabled”,
“資源型別”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[EMR.1] Amazon EMR 叢集主節點不應具有公共 IP 地址”,
“AWS Config 規則”: “emr-master-no-public-ip”,
“資源型別”: “AWS::EMR::叢集”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[EMR.2] 應啟用 Amazon EMR 塊公共訪問設定”,
“AWS Config 規則”: “emr-block-public-access”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[ES.1] Elasticsearch 域應啟用靜態加密”,
“AWS Config 規則”: “elasticsearch-encrypted-at-rest”,
“資源型別”: “AWS::Elasticsearch::Domain”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[ES.2] Elasticsearch 域不應公開訪問”,
“AWS Config 規則”: “elasticsearch-in-vpc-only”,
“資源型別”: “AWS::Elasticsearch::Domain”,
“時間表型別”：“定期”，
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[ES.3] Elasticsearch 域應該加密節點之間傳送的資料”,
“AWS Config 規則”: “elasticsearch-node-to-node-encryption-check”,
“資源型別”: “AWS::Elasticsearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ES.4] 應啟用將 Elasticsearch 域錯誤記錄到 CloudWatch Logs”,
“AWS Config 規則”: “elasticsearch-logs-to-cloudwatch”,
“資源型別”: “AWS::Elasticsearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ES.5] Elasticsearch 域應啟用稽核日誌記錄”,
“AWS Config 規則”: “elasticsearch-audit-logging-enabled”,
“資源型別”: “AWS::Elasticsearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ES.6] Elasticsearch 域應至少具有三個資料節點”,
“AWS Config 規則”: “elasticsearch-data-node-fault-tolerance”,
“資源型別”: “AWS::Elasticsearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ES.7] Elasticsearch 域應配置至少三個專用主節點”,
“AWS Config 規則”: “elasticsearch-https-required”,
“資源型別”: “AWS::Elasticsearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[ES.8] 與 Elasticsearch 域的連線應使用 TLS 1.2 加密”,
“AWS Config 規則”: “elasticsearch-https-required”,
“資源型別”: “AWS::Elasticsearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[EventBridge.3] EventBridge 自定義事件匯流排應附加基於資源的策略”,
“AWS Config 規則”: “custom-schema-registry-policy-attached”,
“資源型別”: “AWS::Events::EventBus”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[EventBridge.4] EventBridge 全域性端點應啟用事件複製”,
“AWS Config 規則”: “global-endpoint-event-replication-enabled”,
“資源型別”: “AWS::Events::Endpoint”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[FSx.1] FSx for OpenZFS 檔案系統應配置為將標籤複製到備份和卷”,
“AWS Config 規則”: “fsx-openzfs-copy-tags-enabled”,
“資源型別”: “AWS::FSx::FileSystem”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[GuardDuty.1] 應啟用 GuardDuty”,
“AWS Config 規則”: “guardduty-enabled-centralized”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[IAM.1] IAM 策略不應允許完整的"*" 管理許可權”,
“AWS Config 規則”: “iam-policy-no-statements-with-admin-access”,
“資源型別”: “AWS::IAM::策略”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[IAM.2] IAM 使用者不應附加 IAM 策略”,
“AWS Config 規則”: “iam-user-no-policies-check”,
“資源型別”: “AWS::IAM::使用者”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[IAM.3] IAM 使用者的訪問金鑰應每 90 天或更短時間輪換一次”,
“AWS Config 規則”: “access-keys-rotated”,
“資源型別”: “AWS::IAM::使用者”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.4] IAM 根使用者訪問金鑰不應存在”,
“AWS Config 規則”: “iam-root-access-key-check”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“嚴重”
},
{
“find_element.text”: “應為所有擁有控制檯密碼的 IAM 使用者啟用[IAM.5] MFA”,
“AWS Config 規則”: “mfa-enabled-for-iam-console-access”,
“資源型別”: “AWS::IAM::使用者”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.6] 應為 root 使用者啟用硬體 MFA”,
“AWS Config 規則”: “root-account-hardware-mfa-enabled”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[IAM.7] IAM 使用者的密碼策略應具有強大的配置”,
“AWS Config 規則”: “iam-password-policy”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.8] 應刪除未使用的 IAM 使用者憑證”,
“AWS Config 規則”: “iam-user-unused-credentials-check”,
“資源型別”: “AWS::IAM::使用者”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.9] 應為 root 使用者啟用 MFA”,
“AWS Config 規則”: “root-account-mfa-enabled”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[IAM.10] IAM 使用者的密碼策略應具有強大的 AWS 配置”,
“AWS Config 規則”: “iam-password-policy”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.11] 確保 IAM 密碼策略至少需要一個大寫字母”,
“AWS Config 規則”: “iam-password-policy”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.12] 確保 IAM 密碼策略至少需要一個小寫字母”,
“AWS Config 規則”: “iam-password-policy”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.13] 確保 IAM 密碼策略至少需要一個符號”,
“AWS Config 規則”: “iam-password-policy”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.14] 確保 IAM 密碼策略至少需要一個數字”,
“AWS Config 規則”: “iam-password-policy”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.15] 確保 IAM 密碼策略要求最小密碼長度為 14 或更長”,
“AWS Config 規則”: “iam-password-policy”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.16] 確保 IAM 密碼策略防止密碼重複使用”,
“AWS Config 規則”: “iam-password-policy”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[IAM.17] 確保 IAM 密碼策略使密碼在 90 天或更短的時間內過期”,
“AWS Config 規則”: “iam-password-policy”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[IAM.18] 確保已建立支援角色來透過 AWS Support 管理事件”,
“AWS Config 規則”: “iam-policy-in-use”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[IAM.19] 應為所有 IAM 使用者啟用 MFA”,
“AWS Config 規則”: “iam-user-mfa-enabled”,
“資源型別”: “AWS::IAM::使用者”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[IAM.20]避免使用root使用者”,
“AWS Config 規則”: “use-of-root-account-test”,
“資源型別”: “AWS::IAM::使用者”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[IAM.21] 您建立的 IAM 客戶託管策略不應允許服務萬用字元操作”,
“AWS Config 規則”: “iam-policy-no-statements-with-full-access”,
“資源型別”: “AWS::IAM::策略”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[IAM.22] 45 天未使用的 IAM 使用者憑證應被刪除”,
“AWS Config 規則”: “iam-user-unused-credentials-check”,
“資源型別”: “AWS::IAM::使用者”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[Kinesis.1] Kinesis 流應靜態加密”,
“AWS Config 規則”: “kinesis-stream-encrypted”,
“資源型別”: “AWS::Kinesis::Stream”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[KMS.1] IAM 客戶託管策略不應允許對所有 KMS 金鑰執行解密操作”,
“AWS Config 規則”: “iam-customer-policy-blocked-kms-actions”,
“資源型別”: “AWS::IAM::策略”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[KMS.2] IAM 委託人不應具有允許對所有 KMS 金鑰執行解密操作的 IAM 內聯策略”,
“AWS Config 規則”: “iam-inline-policy-blocked-kms-actions”,
“資源型別”: “AWS::KMS::Key”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[KMS.3] AWS KMS 金鑰不應被無意刪除”,
“AWS Config 規則”: “kms-cmk-not-scheduled-for-deletion-2”,
“資源型別”: “AWS::KMS::Key”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[KMS.4] 應啟用 AWS KMS 金鑰輪換”,
“AWS Config 規則”: “cmk-backing-key-rotation-enabled”,
“資源型別”: “AWS::KMS::Key”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[Lambda.1] Lambda 函式策略應禁止公共訪問”,
“AWS Config 規則”: “lambda-function-public-access-prohibited”,
“資源型別”: “AWS::Lambda::Function”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[Lambda.2] Lambda 函式應使用受支援的執行時”,
“AWS Config 規則”: “lambda-function-settings-check”,
“資源型別”: “AWS::Lambda::Function”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Lambda.3] Lambda 函式應位於 VPC 中”,
“AWS Config 規則”: “lambda-inside-vpc”,
“資源型別”: “AWS::Lambda::Function”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[Lambda.5] VPC Lambda 函式應在多個可用區中執行”,
“AWS Config 規則”: “lambda-vpc-multi-az-check”,
“資源型別”: “AWS::Lambda::Function”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Macie.1] 應啟用 Macie”,
“AWS Config 規則”: “macie-status-check”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[MSK.1] MSK 叢集在代理節點之間傳輸時應進行加密”,
“AWS Config 規則”: “msk-in-cluster-node-require-tls”,
“資源型別”: “AWS::MSK::叢集”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[MSK.2] MSK 叢集應配置增強監控”,
“AWS Config 規則”: “msk-enhanced-monitoring-enabled”,
“資源型別”: “AWS::MSK::叢集”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[MQ.5] ActiveMQ 代理應使用主備部署模式”,
“AWS Config 規則”: “mq-active-deployment-mode”,
“資源型別”: “AWS::AmazonMQ::Broker”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[MQ.6] RabbitMQ 代理應使用叢集部署模式”,
“AWS Config 規則”: “mq-rabbit-deployment-mode”,
“資源型別”: “AWS::AmazonMQ::Broker”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[Neptune.1] Neptune 資料庫叢集應在靜態時加密”,
“AWS Config 規則”: “neptune-cluster-encrypted”,
“資源型別”: “AWS::RDS::DBCluster”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[Neptune.2] Neptune 資料庫叢集應將稽核日誌釋出到 CloudWatch Logs”,
“AWS Config 規則”: “neptune-cluster-cloudwatch-log-export-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[Neptune.3] Neptune 資料庫叢集快照不應公開”,
“AWS Config 規則”: “neptune-cluster-snapshot-public-prohibited”,
“資源型別”: “AWS::RDS::DBClusterSnapshot”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[Neptune.4] Neptune 資料庫叢集應啟用刪除保護”,
“AWS Config 規則”: “neptune-cluster-deletion-protection-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[Neptune.5] Neptune 資料庫叢集應啟用自動備份”,
“AWS Config 規則”: “neptune-cluster-backup-retention-check”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Neptune.6] Neptune 資料庫叢集快照應靜態加密”,
“AWS Config 規則”: “neptune-cluster-snapshot-encrypted”,
“資源型別”: “AWS::RDS::DBClusterSnapshot”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Neptune.7] Neptune 資料庫叢集應啟用 IAM資料庫身份驗證”,
“AWS Config 規則”: “neptune-cluster-iam-database-authentication”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Neptune.8] Neptune 資料庫叢集應配置為將標籤複製到快照”,
“AWS Config 規則”: “neptune-cluster-copy-tags-to-snapshot-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[Neptune.9] Neptune 資料庫叢集應跨多個可用區部署”,
“AWS Config 規則”: “neptune-cluster-multi-az-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.1] 網路防火牆防火牆應跨多個可用區部署”,
“AWS Config 規則”: “netfw-multi-az-enabled”,
“資源型別”: “AWS::NetworkFirewall::Firewall”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.2] 應啟用網路防火牆日誌記錄”,
“AWS Config 規則”: “netfw-logging-enabled”,
“資源型別”: “AWS::NetworkFirewall::LoggingConfiguration”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.3] 網路防火牆策略應至少有一個關聯的規則組”,
“AWS Config 規則”: “netfw-policy-rule-group-linked”,
“資源型別”: “AWS::NetworkFirewall::FirewallPolicy”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.4] 網路防火牆策略的預設無狀態操作應該是丟棄或轉發完整資料包”,
“AWS Config 規則”: “netfw-policy-default-action-full-packets”,
“資源型別”: “AWS::NetworkFirewall::FirewallPolicy”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.5] 網路防火牆策略的預設無狀態操作應該是丟棄或轉發分段資料包”,
“AWS Config 規則”: “netfw-policy-default-action-fragment-packets”,
“資源型別”: “AWS::NetworkFirewall::FirewallPolicy”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.6]無狀態網路防火牆規則組不應為空”,
“AWS Config 規則”: “netfw-stateless-rule-group-not-empty”,
“資源型別”: “AWS::NetworkFirewall::RuleGroup”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.9] 網路防火牆防火牆應啟用刪除保護”,
“AWS Config 規則”: “netfw-deletion-protection-enabled”,
“資源型別”: “AWS::NetworkFirewall::Firewall”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Opensearch.1] OpenSearch 域應啟用靜態加密”,
“AWS Config 規則”: “opensearch-encrypted-at-rest”,
“資源型別”: “AWS::OpenSearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Opensearch.2] OpenSearch 域不應公開訪問”,
“AWS Config 規則”: “opensearch-in-vpc-only”,
“資源型別”: “AWS::OpenSearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[Opensearch.3] OpenSearch 域應該加密節點之間傳送的資料”,
“AWS Config 規則”: “opensearch-node-to-node-encryption-check”,
“資源型別”: “AWS::OpenSearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Opensearch.4] 應啟用將 OpenSearch 域錯誤記錄到 CloudWatch Logs”,
“AWS Config 規則”: “opensearch-logs-to-cloudwatch”,
“資源型別”: “AWS::OpenSearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Opensearch.5] OpenSearch 域應啟用稽核日誌記錄”,
“AWS Config 規則”: “opensearch-audit-logging-enabled”,
“資源型別”: “AWS::OpenSearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Opensearch.6] OpenSearch 域應至少具有三個資料節點”,
“AWS Config 規則”: “opensearch-data-node-fault-tolerance”,
“資源型別”: “AWS::OpenSearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Opensearch.7] OpenSearch 域應啟用細粒度訪問控制”,
“AWS Config 規則”: “opensearch-access-control-enabled”,
“資源型別”: “AWS::OpenSearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[Opensearch.8] 與 OpenSearch 域的連線應使用 TLS 1.2 加密”,
“AWS Config 規則”: “opensearch-https-required”,
“資源型別”: “AWS::OpenSearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Opensearch.10] OpenSearch 域應安裝最新的軟體更新”,
“AWS Config 規則”: “opensearch-update-check”,
“資源型別”: “AWS::OpenSearch::Domain”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[PCA.1] 應禁用 AWS 私有 CA 根證書頒發機構”,
“AWS Config 規則”: “acm-pca-root-ca-disabled”,
“資源型別”: “AWS::ACMPCA::CertificateAuthority”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.1] RDS 快照應該是私有的”,
“AWS Config 規則”: “rds-snapshots-public-prohibited”,
“資源型別”: “AWS::RDS::DBClusterSnapshot”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[RDS.2] RDS 資料庫例項應禁止公共訪問，具體由可公開訪問的 AWS 配置確定”,
“AWS Config 規則”: “rds-instance-public-access-check”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[RDS.3] RDS 資料庫例項應啟用靜態加密”,
“AWS Config 規則”: “rds-storage-encrypted”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.4] RDS 叢集快照和資料庫快照應靜態加密”,
“AWS Config 規則”: “rds-snapshot-encrypted”,
“資源型別”: “AWS::RDS::DBClusterSnapshot”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.5] RDS 資料庫例項應配置多個可用區”,
“AWS Config 規則”: “rds-multi-az-support”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.6] 應為 RDS 資料庫例項配置增強監控”,
“AWS Config 規則”: “rds-enhanced-monitoring-enabled”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.7] RDS 叢集應啟用刪除保護”,
“AWS Config 規則”: “rds-cluster-deletion-protection-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.8] RDS 資料庫例項應啟用刪除保護”,
“AWS Config 規則”: “rds-instance-deletion-protection-enabled”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.9] RDS 資料庫例項應將日誌釋出到 CloudWatch Logs”,
“AWS Config 規則”: “rds-logging-enabled”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.10] 應為 RDS 例項配置 IAM 身份驗證”,
“AWS Config 規則”: “rds-instance-iam-authentication-enabled”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.11] RDS 例項應啟用自動備份”,
“AWS Config 規則”: “db-instance-backup-enabled”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.12] 應為 RDS 叢集配置 IAM 身份驗證”,
“AWS Config 規則”: “rds-cluster-iam-authentication-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.13] 應啟用 RDS 自動次要版本升級”,
“AWS Config 規則”: “rds-automatic-minor-version-upgrade-enabled”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[RDS.14] Amazon Aurora 叢集應啟用回溯”,
“AWS Config 規則”: “aurora-mysql-backtracking-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.15] 應為多個可用區配置 RDS 資料庫叢集”,
“AWS Config 規則”: “rds-cluster-multi-az-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.16] RDS 資料庫叢集應配置為將標籤複製到快照”,
“AWS Config 規則”: “rds-cluster-copy-tags-to-snapshots-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.17] RDS 資料庫例項應配置為將標籤複製到快照”,
“AWS Config 規則”: “rds-instance-copy-tags-to-snapshots-enabled”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.18] RDS例項應部署在VPC中”,
“AWS Config 規則”: “rds-deployed-in-vpc”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[RDS.19] 應為關鍵叢集事件配置現有 RDS 事件通知訂閱”,
“AWS Config 規則”: “rds-cluster-event-notifications-configured”,
“資源型別”: “AWS::RDS::EventSubscription”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.20] 應為關鍵資料庫例項事件配置現有 RDS 事件通知訂閱”,
“AWS Config 規則”: “rds-instance-event-notifications-configured”,
“資源型別”: “AWS::RDS::EventSubscription”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.21] 應為關鍵資料庫引數組事件配置 RDS 事件通知訂閱”,
“AWS Config 規則”: “rds-pg-event-notifications-configured”,
“資源型別”: “AWS::RDS::EventSubscription”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.22] 應為關鍵資料庫安全組事件配置 RDS 事件通知訂閱”,
“AWS Config 規則”: “rds-sg-event-notifications-configured”,
“資源型別”: “AWS::RDS::EventSubscription”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.23] RDS 例項不應使用資料庫引擎預設埠”,
“AWS Config 規則”: “rds-no-default-ports”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[RDS.24] RDS 資料庫叢集應使用自定義管理員使用者名稱”,
“AWS Config 規則”: “rds-cluster-default-admin-check”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.25] RDS 資料庫例項應使用自定義管理員使用者名稱”,
“AWS Config 規則”: “rds-instance-default-admin-check”,
“資源型別”: “AWS::RDS::DBInstance”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.26] RDS 資料庫例項應受備份計劃保護”,
“AWS Config 規則”: “rds-resources-protected-by-backup-plan”,
“資源型別”: “AWS::RDS::DBInstance”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.27] RDS 資料庫叢集應靜態加密”,
“AWS Config 規則”: “rds-cluster-encrypted-at-rest”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.34] Aurora MySQL 資料庫叢集應將稽核日誌釋出到 CloudWatch Logs”,
“AWS Config 規則”: “rds-aurora-mysql-audit-logging-enabled”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[RDS.35] RDS 資料庫叢集應啟用自動次要版本升級”,
“AWS Config 規則”: “rds-cluster-auto-minor-version-upgrade-enable”,
“資源型別”: “AWS::RDS::DBCluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Redshift.1] Amazon Redshift 叢集應禁止公共訪問”,
“AWS Config 規則”: “redshift-cluster-public-access-check”,
“資源型別”: “AWS::Redshift::Cluster”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[Redshift.2] 與 Amazon Redshift 叢集的連線應在傳輸過程中加密”,
“AWS Config 規則”：“redshift-require-tls-ssl”，
“資源型別”: “AWS::Redshift::Cluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Redshift.3] Amazon Redshift 叢集應啟用自動快照”,
“AWS Config 規則”: “redshift-backup-enabled”,
“資源型別”: “AWS::Redshift::Cluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Redshift.4] Amazon Redshift 叢集應啟用稽核日誌記錄”,
“AWS Config 規則”: “redshift-cluster-audit-logging-enabled”,
“資源型別”: “AWS::Redshift::Cluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Redshift.6] Amazon Redshift 應該啟用到主要版本的自動升級”,
“AWS Config 規則”: “redshift-cluster-maintenancesettings-check”,
“資源型別”: “AWS::Redshift::Cluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Redshift.7] Redshift 叢集應使用增強型 VPC 路由”,
“AWS Config 規則”: “redshift-enhanced-vpc-routing-enabled”,
“資源型別”: “AWS::Redshift::Cluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Redshift.8] Amazon Redshift 叢集不應使用預設管理員使用者名稱”,
“AWS Config 規則”: “redshift-default-admin-check”,
“資源型別”: “AWS::Redshift::Cluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Redshift.9] Redshift 叢集不應使用預設資料庫名稱”,
“AWS Config 規則”: “redshift-default-db-name-check”,
“資源型別”: “AWS::Redshift::Cluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Redshift.10] Redshift 叢集應靜態加密”,
“AWS Config 規則”: “redshift-cluster-kms-enabled”,
“資源型別”: “AWS::Redshift::Cluster”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[Route53.2] Route 53 公共託管區域應記錄 DNS 查詢”,
“AWS Config 規則”: “route53-query-logging-enabled”,
“資源型別”: “AWS::Route53::HostedZone”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[S3.1] 應啟用 S3 塊公共訪問設定”,
“AWS Config 規則”: “s3-account-level-public-access-blocks-periodic”,
“資源型別”: “AWS::::賬戶”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[S3.2] S3 儲存桶應禁止公共讀取訪問”,
“AWS Config 規則”: “s3-bucket-public-read-prohibited”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “定期和更改觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[S3.3] S3 儲存桶應禁止公共寫入訪問”,
“AWS Config 規則”: “s3-bucket-public-write-prohibited”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “定期和更改觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[S3.5] S3 儲存桶應要求請求使用安全套接字層”,
“AWS Config 規則”: “s3-bucket-ssl-requests-only”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[S3.6] 授予儲存桶策略中其他 AWS 賬戶的 S3 許可權應受到限制”,
“AWS Config 規則”: “s3-bucket-blacklisted-actions-prohibited”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[S3.7] S3 儲存桶應啟用跨區域複製”,
“AWS Config 規則”: “s3-bucket-replication-enabled”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[S3.8] S3 塊公共訪問設定應在儲存桶級別啟用”,
“AWS Config 規則”: “s3-bucket-level-public-access-prohibited”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[S3.9] 應啟用 S3 儲存桶伺服器訪問日誌記錄”,
“AWS Config 規則”: “s3-bucket-logging-enabled”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[S3.10] 啟用版本控制的 S3 儲存桶應配置生命週期策略”,
“AWS Config 規則”: “s3-version-lifecycle-policy-check”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[S3.11] S3 儲存桶應啟用事件通知”,
“AWS Config 規則”: “s3-event-notifications-enabled”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[S3.12] S3 訪問控制列表 (ACL) 不應用於管理使用者對儲存桶的訪問”,
“AWS Config 規則”: “s3-bucket-acl-prohibited”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[S3.13] S3 儲存桶應配置生命週期策略”,
“AWS Config 規則”: “s3-lifecycle-policy-check”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[S3.14] S3 儲存桶應使用版本控制”,
“AWS Config 規則”: “s3-bucket-versioning-enabled”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[S3.15] S3 儲存桶應配置為使用物件鎖”,
“AWS Config 規則”: “s3-bucket-default-lock-enabled”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[S3.17] S3 儲存桶應使用 AWS KMS 金鑰進行靜態加密”,
“AWS Config 規則”: “s3-default-加密-kms”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[S3.19] S3 接入點應啟用阻止公共訪問設定”,
“AWS Config 規則”: “s3-access-point-public-access-blocks”,
“資源型別”: “AWS::S3::AccessPoint”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“嚴重”
},
{
“find_element.text”: “[S3.20] S3 通用儲存桶應啟用 MFA 刪除”,
“AWS Config 規則”: “s3-bucket-mfa-delete-enabled”,
“資源型別”: “AWS::S3::Bucket”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“低”
},
{
“find_element.text”: “[SageMaker.1] Amazon SageMaker 筆記本例項不應直接訪問網際網路”,
“AWS Config 規則”: “sagemaker-notebook-no-direct-internet-access”,
“資源型別”: “AWS::SageMaker::NotebookInstance”,
“時間表型別”：“定期”，
“嚴重性”：“高”
},
{
“find_element.text”: “[SageMaker.2] SageMaker 筆記本例項應在自定義 VPC 中啟動”,
“AWS Config 規則”: “sagemaker-notebook-instance-inside-vpc”,
“資源型別”: “AWS::SageMaker::NotebookInstance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[SageMaker.3] 使用者不應擁有 SageMaker 筆記本例項的 root 訪問許可權”,
“AWS Config 規則”: “sagemaker-notebook-instance-root-access-check”,
“資源型別”: “AWS::SageMaker::NotebookInstance”,
“計劃型別”: “更改已觸發”,
“嚴重性”：“高”
},
{
“find_element.text”: “[SecretsManager.1] Secrets Manager 機密應啟用自動輪換”,
“AWS Config 規則”: “secretsmanager-rotation-enabled-check”,
“資源型別”: “AWS::SecretsManager::Secret”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[SecretsManager.2] 配置自動輪換的 Secrets Manager 機密應成功輪換”,
“AWS Config 規則”: “secretsmanager-scheduled-rotation-success-check”,
“資源型別”: “AWS::SecretsManager::Secret”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[SecretsManager.3] 刪除未使用的 Secrets Manager 金鑰”,
“AWS Config 規則”: “secretsmanager-secret-unused”,
“資源型別”: “AWS::SecretsManager::Secret”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[SecretsManager.4] Secrets Manager 機密應在指定天數內輪換”,
“AWS Config 規則”: “secretsmanager-secret-periodic-rotation”,
“資源型別”: “AWS::SecretsManager::Secret”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[SNS.1] SNS 主題應使用 AWS KMS 進行靜態加密”,
“AWS Config 規則”: “sns-加密-kms”,
“資源型別”: “AWS::SNS::主題”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[SNS.2] 應為傳送到主題的通知訊息啟用傳送狀態記錄”,
“AWS Config 規則”: “sns-topic-message-delivery-notification-enabled”,
“資源型別”: “AWS::SNS::主題”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[SQS.1] Amazon SQS 佇列應靜態加密”,
“AWS Config 規則”: “sqs-queue-encrypted”,
“資源型別”: “AWS::SQS::Queue”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[StepFunctions.1] Step Functions 狀態機應該開啟日誌記錄”,
“AWS Config 規則”: “step-functions-state-machine-logging-enabled”,
“資源型別”: “AWS::StepFunctions::StateMachine”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[WAF.1] 應啟用 AWS WAF Classic Global Web ACL 日誌記錄”,
“AWS Config 規則”: “waf-classic-logging-enabled”,
“資源型別”: “AWS::WAF::WebACL”,
“時間表型別”：“定期”，
“嚴重程度”：“中”
},
{
“find_element.text”: “[WAF.2] AWS WAF Classic 區域規則應至少有一個條件”,
“AWS Config 規則”: “waf-regional-rule-not-empty”,
“資源型別”: “AWS::WAFRegional::Rule”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[WAF.3] AWS WAF Classic 區域規則組應至少有一個規則”,
“AWS Config 規則”: “waf-regional-rulegroup-not-empty”,
“資源型別”: “AWS::WAFRegional::RuleGroup”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[WAF.4] AWS WAF Classic 區域 Web ACL 應至少有一個規則或規則組”,
“AWS Config 規則”: “waf-regional-webacl-not-empty”,
“資源型別”: “AWS::WAFRegional::WebACL”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[WAF.6] AWS WAF Classic 全域性規則應至少有一個條件”,
“AWS Config 規則”: “waf-global-rule-not-empty”,
“資源型別”: “AWS::WAF::規則”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[WAF.7] AWS WAF Classic 全域性規則組應至少有一個規則”,
“AWS Config 規則”: “waf-global-rulegroup-not-empty”,
“資源型別”: “AWS::WAF::RuleGroup”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[WAF.8] AWS WAF Classic 全域性 Web ACL 應至少有一個規則或規則組”,
“AWS Config 規則”: “waf-global-webacl-not-empty”,
“資源型別”: “AWS::WAF::WebACL”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[WAF.10] AWS WAF Web ACL 應至少有一個規則或規則組”,
“AWS Config 規則”: “wafv2-webacl-not-empty”,
“資源型別”: “AWS::WAFv2::WebACL”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
},
{
“find_element.text”: “[WAF.11] 應啟用 AWS WAF Web ACL 日誌記錄”,
“AWS Config 規則”: “wafv2-logging-enabled”,
“資源型別”: “AWS::WAFv2::WebACL”,
“時間表型別”：“定期”，
“嚴重性”：“低”
},
{
“find_element.text”: “[WAF.12] AWS WAF 規則應啟用 CloudWatch 指標”,
“AWS Config 規則”: “wafv2-rulegroup-logging-enabled”,
“資源型別”: “AWS::WAFv2::RuleGroup”,
“計劃型別”: “更改已觸發”,
“嚴重程度”：“中”
}]

</details>

## Filtering with Jq Command (Severity = Critical or High)

- I filtered the retrieved JSON file with the jq command to extract the AWS Config rules according to their respective severity.

- First, let's extract the AWS Config rules with Critical severity.
  - AWS Config rules that are considered to have high security risks, such as public exposure of AWS resources, security groups allowing access to common ports, and potential credential leaks, were extracted.
  - The items marked as `Not Found` are custom Security Hub rules.

<pre class="line-numbers" data-line="4"><code class="language-bash">
% cat result_20240204153052.json| jq '.[] | select(.Severity == "Critical") | {title: ."find_element.text" ,config_rule: ."AWS Config rule"}'
{
  "title": "[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible",
  "config_rule": "Not Found"
}
{
  "title": "[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials",
  "config_rule": "codebuild-project-source-repo-url-check"
}
{
  "title": "[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials",
  "config_rule": "codebuild-project-envvar-awscred-check"
}
{
  "title": "[DMS.1] Database Migration Service replication instances should not be public",
  "config_rule": "dms-replication-not-public"
}
{
  "title": "[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public",
  "config_rule": "docdb-cluster-snapshot-public-prohibited"
}
{
  "title": "[EC2.1] Amazon EBS snapshots should not be publicly restorable",
  "config_rule": "ebs-snapshot-public-restorable-check"
}
{
  "title": "[EC2.19] Security groups should not allow unrestricted\n                access to ports with high risk",
  "config_rule": "vpc-sg-restricted-common-ports"
}
{
  "title": "[SSM.4] SSM documents should not be public",
  "config_rule": "ssm-document-not-public"
}
{
  "title": "[EMR.2] Amazon EMR block public access setting should be enabled",
  "config_rule": "emr-block-public-access"
}
{
  "title": "[ES.2] Elasticsearch domains should not be publicly accessible",
  "config_rule": "elasticsearch-in-vpc-only"
}
{
  "title": "[IAM.4] IAM root user access key should not exist",
  "config_rule": "iam-root-access-key-check"
}
{
  "title": "[IAM.6] Hardware MFA should be enabled for the root user",
  "config_rule": "root-account-hardware-mfa-enabled"
}
{
  "title": "[IAM.9] MFA should be enabled for the root user",
  "config_rule": "root-account-mfa-enabled"
}
{
  "title": "[KMS.3] AWS KMS keys should not be deleted unintentionally",
  "config_rule": "kms-cmk-not-scheduled-for-deletion-2"
}
{
  "title": "[Lambda.1] Lambda function policies should prohibit public access",
  "config_rule": "lambda-function-public-access-prohibited"
}
{
  "title": "[Neptune.3] Neptune DB cluster snapshots should not be\n                public",
  "config_rule": "neptune-cluster-snapshot-public-prohibited"
}
{
  "title": "[Opensearch.2] OpenSearch domains should not be publicly accessible",
  "config_rule": "opensearch-in-vpc-only"
}
{
  "title": "[RDS.1] RDS snapshot should be private",
  "config_rule": "rds-snapshots-public-prohibited"
}
{
  "title": "[RDS.2] RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible AWS Configuration",
  "config_rule": "rds-instance-public-access-check"
}
{
  "title": "[Redshift.1] Amazon Redshift clusters should prohibit public access",
  "config_rule": "redshift-cluster-public-access-check"
}
{
  "title": "[S3.2] S3 buckets should prohibit public read access",
  "config_rule": "s3-bucket-public-read-prohibited"
}
{
  "title": "[S3.3] S3 buckets should prohibit public write access",
  "config_rule": "s3-bucket-public-write-prohibited"
}
{
  "title": "[S3.19] S3 access points should have block public access settings enabled",
  "config_rule": "s3-access-point-public-access-blocks"
}

接下來，我們提取高嚴重性的 AWS Config 規則。
提取了被認為具有高安全風險但低於“嚴重”風險的 AWS Config 規則。
標記為“未找到”的專案不會被提取，因為它們在文件中被列為“AWS Configrule”而不是“AWS Config 規則”。

                    
% cat result_20240204153052.json|jq ‘.[] |select(.Severity == “高”) |{title: .”find_element.text” ,config_rule: .”AWS Config 規則”}’
{
“title”: “[Account.2] AWS 賬戶應屬於 AWS Organizations 組織”,
“config_rule”: “組織的帳戶部分”
}
{
“title”: “[ACM.2] ACM 管理的 RSA 證書應使用至少 2,048 位的金鑰長度”,
“config_rule”：“acm-證書-rsa-檢查”
}
{
“title”: “[AppSync.5] AWS AppSync GraphQL API 不應使用 API 金鑰進行身份驗證”,
“config_rule”: “appsync-授權-檢查”
}
{
“title”: “[CloudFront.1] CloudFront 發行版應配置預設根物件”,
“config_rule”：“cloudfront-default-root-object-configured”
}
{
“title”: “[CloudFront.12] CloudFront 發行版不應指向不存在的 S3 源”,
“config_rule”：“cloudfront-s3-origin-non-existent-bucket”
}
{
“title”: “[CloudTrail.1] CloudTrail 應啟用並配置至少一個包含讀寫管理事件的多區域跟蹤”,
“config_rule”: “啟用多區域cloudtrail”
}
{
“title”: “[CloudTrail.3] 應啟用 CloudTrail”,
“config_rule”: “啟用cloudtrail”
}
{
“title”: “[CloudWatch.15] CloudWatch 警報應配置指定的操作”,
“config_rule”: “cloudwatch-警報-操作-檢查”
}
{
“title”: “[CloudWatch.17] 應啟用 CloudWatch 警報操作”,
“config_rule”：“cloudwatch-警報-操作-啟用-檢查”
}
{
“title”: “[CodeBuild.5] CodeBuild 專案環境不應啟用特權模式”,
“config_rule”：“codebuild-專案-環境-特權-檢查”
}
{
“title”: “[ECR.1] ECR 私有儲存庫應配置影象掃描”,
“config_rule”: “ecr-private-image-scanning-enabled”
}
{
“title”: “[ECS.1] Amazon ECS 任務定義應具有安全網路模式和使用者定義。”,
“config_rule”: “ecs-任務定義-使用者-主機模式-檢查”
}
{
“title”: “[ECS.2] ECS 服務不應自動分配公共 IP 地址”,
“config_rule”: “未找到”
}
{
“title”: “[ECS.3] ECS 任務定義不應共享主機的程序名稱空間”,
“config_rule”: “未找到”
}
{
“title”: “[ECS.4] ECS 容器應以非特權方式執行”,
“config_rule”: “未找到”
}
{
“title”: “[ECS.5] ECS 容器應限制為對根檔案系統的只讀訪問”,
“config_rule”: “未找到”
}
{
“title”: “[ECS.8] 機密不應作為容器環境變數傳遞”,
“config_rule”: “未找到”
}
{
“title”: “[ECS.9] ECS 任務定義應具有日誌記錄配置”,
“config_rule”: “未找到”
}
{
“title”: “[EC2.2] VPC 預設安全組不應允許入站或出站流量”,
“config_rule”：“vpc-預設安全組-關閉”
}
{
“title”: “[EC2.8] EC2 例項應使用例項後設資料服務版本 2 (IMDSv2)”,
“config_rule”: “ec2-imdsv2-check”
}
{
“title”: “[EC2.9] Amazon EC2 例項不應具有公共 IPv4 地址”,
“config_rule”：“ec2-instance-no-public-ip”
}
{
“title”: “[EC2.13] 安全組不應允許從.0.0/0 或 ::/0 進入埠 22”,
“config_rule”：“限制 ssh”
}
{
“title”: “[EC2.14] 安全組不應允許從 0.0.0.0/0 或 ::/0 進入埠 3389”,
“config_rule”: “限制公共埠”
}
{
“title”: “[EC2.18] 安全組應僅允許授權埠不受限制的傳入流量”,
“config_rule”: “vpc-sg-僅開放至授權埠”
}
{
“title”: “[EC2.23] Amazon EC2 Transit Gateway 不應自動接受 VPC 附件請求”,
“config_rule”：“ec2-transit-gateway-auto-vpc-attach-disabled”
}
{
“title”: “[EC2.25] Amazon EC2 啟動模板不應將公共IP 分配給網路介面”,
“config_rule”：“ec2-launch-template-public-ip-disabled”
}
{
“title”: “[AutoScaling.3] Auto Scaling 組啟動配置應將 EC2 例項配置為需要例項後設資料服務版本 2 (IMDSv2)”,
“config_rule”：“自動縮放-launchconfig-requires-imdsv2”
}
{
“title”: “[AutoScaling.4] Auto Scaling 組啟動配置的後設資料響應躍點限制不應大於 1”,
“config_rule”：“自動縮放啟動配置跳數限制”
}
{
“title”: “[Autoscaling.5] 使用 Auto Scaling 組啟動配置啟動的 Amazon EC2 例項不應具有公共 IP 地址”,
“config_rule”：“自動縮放啟動配置-公共IP-禁用”
}
{
“title”: “[SSM.2] 由 Systems Manager 管理的 Amazon EC2 例項在安裝補丁後應具有“COMPLIANT”的補丁合規性狀態”,
“config_rule”：“ec2-託管例項-補丁-合規性-狀態-檢查”
}
{
“title”: “[EKS.1] EKS 叢集端點不應公開訪問”,
“config_rule”：“eks-端點-無公共訪問”
}
{
“title”: “[EKS.2] EKS 叢集應在受支援的 Kubernetes 版本上執行”,
“config_rule”：“eks-cluster-supported-version”
}
{
“title”: “[ElastiCache.1] ElastiCache Redis 叢集應啟用自動備份”,
“config_rule”：“elasticache-redis-叢集-自動備份-檢查”
}
{
“title”: “[ElastiCache.2] ElastiCache for Redis 快取叢集應啟用自動次要版本升級”,
“config_rule”：“elasticache-自動次要版本-升級檢查”
}
{
“title”: “[ElastiCache.7] ElastiCache 叢集不應使用預設子網組”,
“config_rule”: “elasticache-子網組-檢查”
}
{
“title”: “[ElasticBeanstalk.2] 應啟用 Elastic Beanstalk 託管平臺更新”,
“config_rule”：“啟用彈性beanstalk管理更新”
}
{
“title”: “[ElasticBeanstalk.3] Elastic Beanstalk 應將日誌流式傳輸到 CloudWatch”,
“config_rule”: “elastic-beanstalk-logs-to-cloudwatch”
}
{
“title”: “[EMR.1] Amazon EMR 叢集主節點不應具有公共 IP 地址”,
“config_rule”：“emr-master-no-public-ip”
}
{
“title”: “[GuardDuty.1] 應啟用 GuardDuty”,
“config_rule”: “guardduty-enabled-centralized”
}
{
“title”: “[IAM.1] IAM 策略不應允許完全"*" 管理許可權”,
“config_rule”: “iam-policy-no-statements-with-admin-access”
}
{
“title”: “[Opensearch.7] OpenSearch 域應啟用細粒度訪問控制”,
“config_rule”：“啟用開放搜尋訪問控制”
}
{
“title”: “[RDS.13] 應啟用 RDS 自動次要版本升級”,
“config_rule”：“rds-自動次要版本升級啟用”
}
{
“title”: “[RDS.18] RDS例項應部署在VPC中”,
“config_rule”：“rds-部署在-vpc”
}
{
“title”: “[S3.6] 應限制在儲存桶策略中授予其他 AWS 賬戶的 S3 許可權”,
“config_rule”: “s3-bucket-blacklisted-actions-prohibited”
}
{
“title”: “[S3.8] S3 塊公共訪問設定應在儲存桶級別啟用”,
“config_rule”: “s3-bucket-level-public-access-prohibited”
}
{
“title”: “[SageMaker.1] Amazon SageMaker 筆記本例項不應直接訪問網際網路”,
“config_rule”: “sagemaker-notebook-no-direct-internet-access”
}
{
“title”: “[SageMaker.2] SageMaker 筆記本例項應在自定義 VPC 中啟動”,
“config_rule”：“sagemaker-notebook-instance-inside-vpc”
}
{
“title”: “[SageMaker.3] 使用者不應擁有 SageMaker 筆記本例項的 root 訪問許可權”,
“config_rule”：“sagemaker-notebook-instance-root-access-check”
}
                    ````

          
          
          
            
              📢 分享本文
            
            
              
              
                
                在 X 上分享