【提示/解决方法】如何抓取Security Hub控件的引用并将其转换为数据

📅 发布日: 2024/02/12, 更新日: 2024/02/12 ⏱️ 预计阅读时间约149分钟 (59,647字)

在安全中心中，您可以通过启用一项名为“标准”的功能来启用名为“控件”的安全检查规则，
并根据AWS最佳实践检查安全设置。
通过启用控件，将创建AWS配置规则，并根据为每个控件定义的重要性显示检查结果。如果已启用标准，则可以从AWS Config管理控制台确认这些创建的AWS Config规则，
但无法确认使用AWS API创建了哪些规则。
本文介绍如何抓取Security Hub控件的引用并将其转换为数据。

用于抓取 Security Hub 控制引用的 Python 脚本

用于抓取 Security Hub 控制引用的 Python 脚本

以下 Python 脚本抓取 AWS Security Hub 控件的引用并将其输出到 JSON 文件。
URLS 变量列出了要抓取的页面。截至 2/4，日文页面不包含 12/18 添加的 15 个控件的详细信息，因此英文页面正在被删除。
参考： AWS Security Hub 推出 15 项新安全控制
SEARCH_STRINGS 变量指定要抓取的信息的关键字。
FIND_ELEMENT_NAME 变量指定包含要抓取的信息的父 HTML 标记。
FIND_NEXT_SIBLINGS 变量指定包含要抓取的信息的父 HTML 标记的下一个同级元素。在这些同级元素中搜索“SEARCH_STRINGS”中指定的关键字。
生成的 JSON 文件保存在 .output 目录中。

从日期时间导入日期时间导入 json 导入请求导入操作系统导入系统导入日志记录从 bs4 导入 BeautifulSoup

LOG_LEVEL = 日志记录.INFO
网址 = [
“https://docs.aws.amazon.com/securityhub/latest/userguide/account-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/acm-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/apigateway-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/appsync-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/athena-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/backup-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/cloudformation-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/cloudfront-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/cloudtrail-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/cloudwatch-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/codebuild-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/config-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/dms-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/dynamodb-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/ecr-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/autoscaling-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/ssm-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/efs-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/eks-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/elasticache-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/elasticbeanstalk-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/emr-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/es-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/eventbridge-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/fsx-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/guardduty-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/kinesis-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/lambda-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/macie-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/msk-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/mq-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/neptune-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/opensearch-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/pca-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/redshift-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/route53-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/sagemaker-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/secretsmanager-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/sns-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/sqs-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/stepfunctions-controls.html”，
“https://docs.aws.amazon.com/securityhub/latest/userguide/waf-controls.html”]
搜索字符串 = {
“AWS Config 规则”: “代码”,
“资源类型”: “代码”,
“时间表类型”：“文本”，
“严重性”：“文本”
}
FIND_ELEMENT_NAME =“h2”
FIND_NEXT_SIBLINGS = “p”

类 TimeFormatter(logging.Formatter):
转换器 = datetime.fromtimestamp

def formatTime(self, record, datefmt=None):
dt = self.converter(记录.创建)
如果日期：
s = dt.strftime(datefmt)
别的：
t = dt.strftime(self.default_time_format)
s = self.default_msec_format % (t, 记录.msecs)
返回

def init_logger():
记录器=logging.getLogger(name)

log_format_string = json.dumps({
‘logLevel’: ‘%(levelname)s’,
‘时间’: ‘%(asctime)s’,
‘line’: “%(文件名)s: %(lineno)d”,
‘消息’: ‘%(消息)s’,
}，缩进=无）
处理程序=logging.StreamHandler(sys.stdout)
handler.setFormatter((TimeFormatter(log_format_string)))
logger.addHandler(处理程序)
logger.propagate = False
logger.setLevel(LOG_LEVEL)

返回记录器

def main():
记录器 = init_logger()

结果=[]

对于 URLS 中的 url：
响应 = requests.get(url)
响应.编码 = 响应.表观编码

汤 = BeautifulSoup(response.text, ‘html.parser’)
find_elements = soup.find_all(FIND_ELEMENT_NAME)

对于 find_elements 中的 find_element：
next_siblings = find_element.find_next_siblings(FIND_NEXT_SIBLINGS)
条目 = {“find_element.text”：find_element.text}

logger.debug(f”find_element: {find_element}“)

对于 search_string，SEARCH_STRINGS.items() 中的方法：
对于 next_siblings 中的兄弟姐妹：
如果 search_string 在sibling.text中：
如果方法==“文本”：
值=sibling.b.next_sibling.strip()
条目[搜索字符串] = 值
logger.debug(f”search_string: {search_string}, value: {value}“)
休息
别的：
value_element =sibling.find(method, {‘class’: ‘code’})
如果值元素：
条目[搜索字符串] = value_element.text
logger.debug(f”search_string: {search_string}, value: {value_element.text}“)
休息
如果 search_string 不在条目中：
条目[search_string] =“未找到”
logger.debug(f”search_string: {search_string}, 值: None”)

结果.追加（条目）

如果不是 os.path.exists(‘.output’):
os.makedirs(‘.output’)

now = datetime.now().strftime(‘%Y%m%d%H%M%S’)

将 open(f’.output/result_{now}.json’, ‘w’,encoding=‘utf-8’) 作为 f：
json.dump(结果，f，ensure_ascii=False)

logger.info(f”成功将结果保存到.output/result_{now}.json”)

如果 name == “main”:
主要的（）

## JSON File of Retrieved AWS Security Hub Control References

- The actual contents of the retrieved JSON file are as follows.
  - Some items are marked as `Not Found`, which means that the keywords specified in the `SEARCH_STRINGS` variable were not found.

<details>
<summary>JSON of AWS Security Hub Control References</summary>

json
[
{
“find_element.text”: “[Account.1] 应为 AWS 账户提供安全联系信息”,
“AWS Config 规则”: “安全帐户信息提供”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[Account.2] AWS 账户应属于 AWS Organizations 组织”,
“AWS Config 规则”: “组织的账户部分”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[ACM.1] 导入的和 ACM 颁发的证书应在指定时间段后续订”,
“AWS Config 规则”: “acm-certificate-expiration-check”,
“资源类型”: “AWS::ACM::证书”,
“Schedule type”: “更改触发且定期”,
“严重程度”：“中”
},
{
“find_element.text”: “[ACM.2] ACM 管理的 RSA 证书应使用至少 2,048 位的密钥长度”,
“AWS Config 规则”: “acm-certificate-rsa-check”,
“资源类型”: “AWS::ACM::证书”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[APIGateway.1] API 网关 REST 和 WebSocket API 执行日志应启用”,
“AWS Config 规则”: “api-gw-execution-logging-enabled”,
“资源类型”: “AWS::ApiGateway::Stage”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[APIGateway.2] API Gateway REST API 阶段应配置为使用SSL 证书进行后端身份验证”,
“AWS Config 规则”: “api-gw-ssl-enabled”,
“资源类型”: “AWS::ApiGateway::Stage”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[APIGateway.3] API Gateway REST API 阶段应启用 AWS X-Ray跟踪”,
“AWS Config 规则”: “api-gw-xray-enabled”,
“资源类型”: “AWS::ApiGateway::Stage”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[APIGateway.4] API 网关应与 WAF WebACL 关联”,
“AWS Config 规则”: “api-gw-cache-加密”,
“资源类型”: “AWS::ApiGateway::Stage”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[APIGateway.5] API Gateway REST API 缓存数据应在静态时加密”,
“AWS Config 规则”: “api-gw-cache-加密”,
“资源类型”: “AWS::ApiGateway::Stage”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[APIGateway.8] API 网关路由应指定授权类型”,
“AWS Config 规则”: “api-gwv2-authorization-type-configured”,
“资源类型”: “AWS::ApiGatewayV2::Route”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[APIGateway.9] 应为 API Gateway V2阶段配置访问日志记录”,
“AWS Config 规则”: “api-gwv2-access-logs-enabled”,
“资源类型”: “AWS::ApiGatewayV2::Stage”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[AppSync.2] AWS AppSync 应启用字段级日志记录”,
“AWS Config 规则”: “appsync-logging-enabled”,
“资源类型”: “AWS::AppSync::GraphQLApi”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[AppSync.5] AWS AppSync GraphQL API 不应使用 API 密钥进行身份验证”,
“AWS Config 规则”: “appsync-authorization-check”,
“资源类型”: “AWS::AppSync::GraphQLApi”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[Athena.1] Athena 工作组应在休息时加密”,
“AWS Config 规则”: “athena-workgroup-encrypted-at-rest”,
“资源类型”: “AWS::Athena::WorkGroup”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Backup.1] AWS Backup 恢复点应静态加密”,
“AWS Config 规则”: “备份恢复点加密”,
“资源类型”: “AWS::Backup::RecoveryPoint”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[CloudFormation.1] CloudFormation 堆栈应与简单通知服务 (SNS) 集成”,
“AWS Config 规则”: “cloudformation-stack-notification-check”,
“资源类型”: “AWS::CloudFormation::Stack”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[CloudFront.1] CloudFront 发行版应配置默认根对象”,
“AWS Config 规则”: “cloudfront-default-root-object-configured”,
“资源类型”: “AWS::CloudFront::Distribution”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[CloudFront.3] CloudFront 发行版应要求传输过程中加密”,
“AWS Config 规则”: “cloudfront-viewer-policy-https”,
“资源类型”: “AWS::CloudFront::Distribution”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[CloudFront.4] CloudFront 发行版应配置源故障转移”,
“AWS Config 规则”: “cloudfront-origin-failover-enabled”,
“资源类型”: “AWS::CloudFront::Distribution”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[CloudFront.5] CloudFront 发行版应启用日志记录”,
“AWS Config 规则”: “cloudfront-accesslogs-enabled”,
“资源类型”: “AWS::CloudFront::Distribution”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[CloudFront.6] CloudFront 发行版应启用 WAF”,
“AWS Config 规则”: “cloudfront-linked-with-waf”,
“资源类型”: “AWS::CloudFront::Distribution”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[CloudFront.7] CloudFront 发行版应使用自定义 SSL/TLS 证书”,
“AWS Config 规则”: “cloudfront-custom-ssl-certificate”,
“资源类型”: “AWS::CloudFront::Distribution”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[CloudFront.8] CloudFront 发行版应使用 SNI 来处理 HTTPS 请求”,
“AWS Config 规则”: “cloudfront-sni-enabled”,
“资源类型”: “AWS::CloudFront::Distribution”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[CloudFront.9] CloudFront 发行版应加密到自定义源的流量”,
“AWS Config 规则”: “cloudfront-traffic-to-origin-encrypted”,
“资源类型”: “AWS::CloudFront::Distribution”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[CloudFront.10] CloudFront 发行版不应在边缘站点和自定义源之间使用已弃用的 SSL 协议”,
“AWS Config 规则”: “cloudfront-no-deprecated-ssl-protocols”,
“资源类型”: “AWS::CloudFront::Distribution”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[CloudFront.12] CloudFront 发行版不应指向不存在的 S3 源”,
“AWS Config 规则”: “cloudfront-s3-origin-non-existent-bucket”,
“资源类型”: “AWS::CloudFront::Distribution”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[CloudFront.13] CloudFront 发行版应使用源访问控制”,
“AWS Config 规则”: “cloudfront-s3-origin-access-control-enabled”,
“资源类型”: “AWS::CloudFront::Distribution”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[CloudTrail.1] CloudTrail 应启用并配置至少一个包含读写管理事件的多区域跟踪”,
“AWS Config 规则”: “multi-region-cloudtrail-enabled”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[CloudTrail.2] CloudTrail 应启用静态加密”,
“AWS Config 规则”: “cloud-trail-加密启用”,
“资源类型”: “AWS::CloudTrail::Trail”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[CloudTrail.3] 应启用 CloudTrail”,
“AWS Config 规则”: “cloudtrail-enabled”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[CloudTrail.4] 应启用 CloudTrail 日志文件验证”,
“AWS Config 规则”: “cloud-trail-log-file-validation-enabled”,
“资源类型”: “AWS::CloudTrail::Trail”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudTrail.5] CloudTrail 跟踪应与 Amazon CloudWatch Logs 集成”,
“AWS Config 规则”: “cloud-trail-cloud-watch-logs-enabled”,
“资源类型”: “AWS::CloudTrail::Trail”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudTrail.6] 确保用于存储 CloudTrail 日志的 S3 存储桶不可公开访问”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::CloudTrail::Trail”,
“Schedule type”: “定期且更改”,
“严重性”：“严重”
},
{
“find_element.text”: “[CloudTrail.7] 确保在 CloudTrail S3 存储桶上启用 S3 存储桶访问日志记录”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::CloudTrail::Trail”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.1] 应存在日志指标过滤器和警报以供 "root" 用户使用”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.2] 确保针对未经授权的 API 调用存在日志指标过滤器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.3] 确保在没有 MFA 的情况下登录管理控制台时存在日志指标筛选器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.4] 确保 IAM 策略更改存在日志指标过滤器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.5] 确保 CloudTrail AWS 配置更改存在日志指标筛选器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.6] 确保针对 AWS 管理控制台身份验证失败存在日志指标筛选器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.7] 确保存在日志指标过滤器和警报以禁用或计划删除客户管理的密钥”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.8] 确保 S3 存储桶策略更改存在日志指标过滤器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.9] 确保针对 AWS Config 配置更改存在日志指标筛选器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.10] 确保安全组更改存在日志指标过滤器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.11] 确保存在针对网络访问控制列表 (NACL) 更改的日志指标筛选器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.12] 确保存在针对网络网关更改的日志指标筛选器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.13] 确保路由表更改存在日志指标过滤器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.14] 确保 VPC 更改存在日志指标过滤器和警报”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::Logs::MetricFilter”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[CloudWatch.15] CloudWatch 警报应配置指定的操作”,
“AWS Config 规则”: “cloudwatch-alarm-action-check”,
“资源类型”: “AWS::CloudWatch::Alarm”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[CloudWatch.16] CloudWatch 日志组应保留指定时间段”,
“AWS Config 规则”: “cw-loggroup-retention-period-check”,
“资源类型”: “AWS::Logs::LogGroup”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[CloudWatch.17] 应激活 CloudWatch 警报操作”,
“AWS Config 规则”: “cloudwatch-alarm-action-enabled-check”,
“资源类型”: “AWS::CloudWatch::Alarm”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[CodeBuild.1] CodeBuild Bitbucket 源存储库 URL 不应包含敏感凭据”,
“AWS Config 规则”: “codebuild-project-source-repo-url-check”,
“资源类型”: “AWS::CodeBuild::Project”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[CodeBuild.2] CodeBuild 项目环境变量不应包含明文凭据”,
“AWS Config 规则”: “codebuild-project-envvar-awscred-check”,
“资源类型”: “AWS::CodeBuild::Project”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[CodeBuild.3] CodeBuild S3 日志应加密”,
“AWS Config 规则”: “codebuild-project-s3-logs-encrypted”,
“资源类型”: “AWS::CodeBuild::Project”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[CodeBuild.4] CodeBuild 项目环境应具有日志记录 AWS 配置”,
“AWS Config 规则”: “codebuild-project-logging-enabled”,
“资源类型”: “AWS::CodeBuild::Project”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[CodeBuild.5] CodeBuild 项目环境不应启用特权模式”,
“AWS Config 规则”: “codebuild-project-environment-privileged-check”,
“资源类型”: “AWS::CodeBuild::Project”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[Config.1] 应启用 AWS Config”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[DMS.1] 数据库迁移服务复制实例不应公开”,
“AWS Config 规则”: “dms-replication-not-public”,
“资源类型”: “AWS::DMS::ReplicationInstance”,
“时间表类型”：“定期”，
“严重性”：“严重”
},
{
“find_element.text”: “[DMS.6] DMS 复制实例应启用自动次要版本升级”,
“AWS Config 规则”: “dms-auto-minor-version-upgrade-enabled”,
“资源类型”: “AWS::DMS::ReplicationInstance”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[DMS.7] 目标数据库的 DMS 复制任务应启用日志记录”,
“AWS Config 规则”: “dms-replication-task-targetdb-logging”,
“资源类型”: “AWS::DMS::ReplicationTask”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[DMS.8] 源数据库的 DMS 复制任务应启用日志记录”,
“AWS Config 规则”: “dms-replication-task-sourcedb-logging”,
“资源类型”: “AWS::DMS::ReplicationTask”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[DMS.9] DMS 端点应使用 SSL”,
“AWS Config 规则”: “dms-endpoint-ssl-configured”,
“资源类型”: “AWS::DMS::Endpoint”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[DocumentDB.1] Amazon DocumentDB 集群应在静态时加密”,
“AWS Config 规则”: “docdb-cluster-加密”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[DocumentDB.2] Amazon DocumentDB 集群应有足够的备份保留期”,
“AWS Config 规则”: “docdb-cluster-backup-retention-check”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[DocumentDB.3] Amazon DocumentDB 手动集群快照不应公开”,
“AWS Config 规则”: “docdb-cluster-snapshot-public-prohibited”,
“资源类型”: “AWS::RDS::DBClusterSnapshot”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[DocumentDB.4] Amazon DocumentDB 集群应将审核日志发布到 CloudWatch Logs”,
“AWS Config 规则”: “docdb-cluster-audit-logging-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[DocumentDB.5] Amazon DocumentDB 集群应启用删除保护”,
“AWS Config 规则”: “docdb-cluster-deletion-protection-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[DynamoDB.1] DynamoDB 表应根据需求自动扩展容量”,
“AWS Config 规则”: “dynamodb-autoscaling-enabled”,
“资源类型”: “AWS::DynamoDB::Table”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[DynamoDB.2] DynamoDB 表应启用时间点恢复”,
“AWS Config 规则”: “dynamodb-pitr-enabled”,
“资源类型”: “AWS::DynamoDB::Table”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[DynamoDB.3] DynamoDB Accelerator (DAX) 集群应静态加密”,
“AWS Config 规则”: “dax-加密启用”,
“资源类型”: “AWS::DynamoDB::集群”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[DynamoDB.4] DynamoDB 表应出现在备份计划中”,
“AWS Config 规则”: “dynamodb-resources-protected-by-backup-plan”,
“资源类型”: “AWS::DynamoDB::Table”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[DynamoDB.6] DynamoDB 表应启用删除保护”,
“AWS Config 规则”: “dynamodb-table-deletion-protection-enabled”,
“资源类型”: “AWS::DynamoDB::Table”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ECR.1] ECR 私有存储库应配置图像扫描”,
“AWS Config 规则”: “ecr-private-image-scanning-enabled”,
“资源类型”: “AWS::ECR::Repository”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[ECR.2] ECR 私有存储库应配置标签不变性”,
“AWS Config 规则”: “ecr-private-tag-immutability-enabled”,
“资源类型”: “AWS::ECR::Repository”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ECR.3] ECR 存储库应至少配置一个生命周期策略”,
“AWS Config 规则”: “ecr-private-lifecycle-policy-configured”,
“资源类型”: “AWS::ECR::Repository”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ECS.1] Amazon ECS 任务定义应具有安全网络模式和用户定义。”,
“AWS Config 规则”: “ecs-task-definition-user-for-host-mode-check”,
“资源类型”: “AWS::ECS::TaskDefinition”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[ECS.2] ECS 服务不应自动分配公共 IP 地址”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::ECS::Service”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[ECS.3] ECS 任务定义不应共享主机的进程命名空间”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::ECS::TaskDefinition”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[ECS.4] ECS 容器应以非特权方式运行”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::ECS::TaskDefinition”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[ECS.5] ECS 容器应仅限于对根文件系统的只读访问”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::ECS::TaskDefinition”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[ECS.8] 秘密不应作为容器环境变量传递”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::ECS::TaskDefinition”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[ECS.9] ECS 任务定义应具有日志记录配置”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::ECS::TaskDefinition”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[ECS.10] ECS Fargate 服务应在最新的 Fargate 平台版本上运行”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::ECS::Service”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ECS.12] ECS 集群应使用 Container Insights”,
“AWS Config 规则”：“未找到”，
“资源类型”: “AWS::ECS::集群”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.1] Amazon EBS 快照不应公开恢复”,
“AWS Config 规则”: “ebs-snapshot-public-restorable-check”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“严重”
},
{
“find_element.text”: “[EC2.2] VPC 默认安全组不应允许入站或出站流量”,
“AWS Config 规则”: “vpc-default-security-group-close”,
“资源类型”: “AWS::EC2::SecurityGroup”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[EC2.3] 附加的 Amazon EBS 卷应静态加密”,
“AWS Config 规则”: “加密卷”,
“资源类型”: “AWS::EC2::卷”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.4] 停止的 EC2 实例应在指定时间段后删除”,
“AWS Config 规则”: “ec2-stopped-instance”,
“资源类型”: “AWS::EC2::实例”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.6] 应在所有 VPC 中启用 VPC 流日志记录”,
“AWS Config 规则”: “vpc-flow-logs-enabled”,
“资源类型”: “AWS::EC2::VPC”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.7] EBS 默认加密应启用”,
“AWS Config 规则”: “ec2-ebs-encryption-by-default”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.8] EC2 实例应使用实例元数据服务版本 2 (IMDSv2)”,
“AWS Config 规则”: “ec2-imdsv2-check”,
“资源类型”: “AWS::EC2::实例”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[EC2.9] Amazon EC2 实例不应具有公共 IPv4 地址”,
“AWS Config 规则”: “ec2-instance-no-public-ip”,
“资源类型”: “AWS::EC2::实例”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[EC2.10] Amazon EC2 应配置为使用为 Amazon EC2 服务创建的 VPC 终端节点”,
“AWS Config 规则”: “service-vpc-endpoint-enabled”,
“资源类型”: “AWS::EC2::VPC”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.12] 应删除未使用的 Amazon EC2 EIP”,
“AWS Config 规则”: “eip-attached”,
“资源类型”: “AWS::EC2::EIP”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[EC2.13] 安全组不应允许从.0.0/0 或 ::/0 进入端口 22”,
“AWS Config 规则”: “restricted-ssh”,
“资源类型”: “AWS::EC2::SecurityGroup”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[EC2.14] 安全组不应允许从 0.0.0.0/0 或 ::/0 进入端口 3389”,
“AWS Config 规则”: “restricted-common-ports”,
“资源类型”: “AWS::EC2::SecurityGroup”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[EC2.15] Amazon EC2 子网不应自动分配公共 IP 地址”,
“AWS Config 规则”: “subnet-auto-assign-public-ip-disabled”,
“资源类型”: “AWS::EC2::子网”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.16] 应删除未使用的网络访问控制列表”,
“AWS Config 规则”: “vpc-network-acl-unused-check”,
“资源类型”: “AWS::EC2::NetworkAcl”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[EC2.17] Amazon EC2 实例不应使用多个ENI”,
“AWS Config 规则”: “ec2-instance-multiple-eni-check”,
“资源类型”: “AWS::EC2::实例”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[EC2.18] 安全组应仅允许授权端口不受限制传入流量”,
“AWS Config 规则”: “vpc-sg-open-only-to-authorized-ports”,
“资源类型”: “AWS::EC2::SecurityGroup”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[EC2.19] 安全组不应允许无限制访问高风险端口”,
“AWS Config 规则”: “vpc-sg-restricted-common-ports”,
“资源类型”: “AWS::EC2::SecurityGroup”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[EC2.20] AWS Site-to-Site VPN连接的两个 VPN 隧道都应该启动”,
“AWS Config 规则”: “vpc-vpn-2-tunnels-up”,
“资源类型”: “AWS::EC2::卷”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.21] 网络 ACL 不应允许从 0.0.0.0/0 进入端口 22 或端口 3389”,
“AWS Config 规则”: “nacl-no-unrestricted-ssh-rdp”,
“资源类型”: “AWS::EC2::卷”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.22] 应删除未使用的 Amazon EC2 安全组”,
“AWS Config 规则”: “ec2-security-group-attached-to-eni-periodic”,
“资源类型”: “AWS::EC2::卷”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.23] Amazon EC2 Transit Gateway 不应自动接受 VPC 附件请求”,
“AWS Config 规则”: “ec2-transit-gateway-auto-vpc-attach-disabled”,
“资源类型”: “AWS::EC2::卷”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[EC2.24] 不应使用Amazon EC2 半虚拟实例类型”,
“AWS Config 规则”: “ec2-paravirtual-instance-check”,
“资源类型”: “AWS::EC2::卷”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[EC2.25] Amazon EC2 启动模板不应将公共IP 分配给网络接口”,
“AWS Config 规则”: “ec2-launch-template-public-ip-disabled”,
“资源类型”: “AWS::EC2::卷”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[EC2.28] EBS 卷应包含在备份计划中”,
“AWS Config 规则”: “ebs-resources-protected-by-backup-plan”,
“资源类型”: “AWS::EC2::卷”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[EC2.51] EC2 客户端 VPN 端点应启用客户端连接日志记录”,
“AWS Config 规则”: “ec2-client-vpn-connection-log-enabled”,
“资源类型”: “AWS::EC2::ClientVpnEndpoint”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[AutoScaling.1] 与 Classic Load Balancer 关联的 Auto Scaling 组应使用负载均衡器运行状况检查”,
“AWS Config 规则”: “autoscaling-group-elb-healthcheck-required”,
“资源类型”: “AWS::AutoScaling::AutoScalingGroup”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[AutoScaling.2] Amazon EC2 Auto Scaling 组应覆盖多个可用区”,
“AWS Config 规则”: “autoscaling-multiple-az”,
“资源类型”: “AWS::AutoScaling::AutoScalingGroup”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[AutoScaling.3] Auto Scaling 组启动配置应将 EC2 实例配置为需要实例元数据服务版本 2 (IMDSv2)”,
“AWS Config 规则”: “autoscaling-launchconfig-requires-imdsv2”,
“资源类型”: “AWS::AutoScaling::LaunchConfiguration”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[AutoScaling.4] Auto Scaling 组启动配置的元数据响应跃点限制不应大于 1”,
“AWS Config 规则”: “autoscaling-launch-config-hop-limit”,
“资源类型”: “AWS::AutoScaling::LaunchConfiguration”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[Autoscaling.5] 使用 Auto Scaling 组启动配置启动的 Amazon EC2 实例不应具有公共 IP 地址”,
“AWS Config 规则”: “autoscaling-launch-config-public-ip-disabled”,
“资源类型”: “AWS::AutoScaling::LaunchConfiguration”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[AutoScaling.6] Auto Scaling 组应在多个可用区中使用多种实例类型”,
“AWS Config 规则”: “autoscaling-multiple-instance-types”,
“资源类型”: “AWS::AutoScaling::AutoScalingGroup”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[AutoScaling.9] Amazon EC2 Auto Scaling 组应使用 Amazon EC2 启动模板”,
“AWS Config 规则”: “autoscaling-launch-template”,
“资源类型”: “AWS::AutoScaling::AutoScalingGroup”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[SSM.1] Amazon EC2 实例应由 AWS Systems Manager 管理”,
“AWS Config 规则”: “ec2-instance-management-by-systems-manager”,
“资源类型”: “AWS::SSM::PatchCompliance”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[SSM.2] Systems Manager 管理的 Amazon EC2 实例在安装补丁后应具有 COMPLIANT 的补丁合规性状态”,
“AWS Config 规则”: “ec2-managementinstance-patch-compliance-status-check”,
“资源类型”: “AWS::SSM::PatchCompliance”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[SSM.3] Systems Manager 管理的 Amazon EC2 实例的关联合规性状态应为 COMPLIANT”,
“AWS Config 规则”: “ec2-managementinstance-association-compliance-status-check”,
“资源类型”: “AWS::SSM::AssociationCompliance”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[SSM.4] SSM 文件不应公开”,
“AWS Config 规则”: “ssm-document-not-public”,
“资源类型”: “AWS::SSM::文档”,
“时间表类型”：“定期”，
“严重性”：“严重”
},
{
“find_element.text”: “[EFS.1] 弹性文件系统应配置为使用 AWS KMS 加密静态文件数据”,
“AWS Config 规则”: “efs-加密-检查”,
“资源类型”: “AWS::EFS::FileSystem”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[EFS.2] Amazon EFS 卷应位于备份计划中”,
“AWS Config 规则”: “efs-in-backup-plan”,
“资源类型”: “AWS::EFS::FileSystem”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[EFS.3] EFS 接入点应强制执行根目录”,
“AWS Config 规则”: “efs-access-point-enforce-root-directory”,
“资源类型”: “AWS::EFS::AccessPoint”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[EFS.4] EFS 接入点应强制执行用户身份”,
“AWS Config 规则”: “efs-access-point-enforce-user-identity”,
“资源类型”: “AWS::EFS::AccessPoint”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[EKS.1] EKS 集群端点不应公开访问”,
“AWS Config 规则”: “eks-endpoint-no-public-access”,
“资源类型”: “AWS::EKS::集群”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[EKS.2] EKS 集群应在受支持的 Kubernetes 版本上运行”,
“AWS Config 规则”: “eks-cluster-supported-version”,
“资源类型”: “AWS::EKS::集群”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[EKS.8] EKS 集群应启用审核日志记录”,
“AWS Config 规则”: “eks-cluster-logging-enabled”,
“资源类型”: “AWS::EKS::集群”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[ElastiCache.1] ElastiCache Redis 集群应启用自动备份”,
“AWS Config 规则”: “elasticache-redis-cluster-automatic-backup-check”,
“资源类型”: “AWS::ElastiCache::CacheCluster”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[ElastiCache.2] ElastiCache for Redis 缓存集群应启用自动次要版本升级”,
“AWS Config 规则”: “elasticache-auto-minor-version-upgrade-check”,
“资源类型”: “AWS::ElastiCache::CacheCluster”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[ElastiCache.3] ElastiCache for Redis 复制组应启用自动故障转移”,
“AWS Config 规则”: “elasticache-repl-grp-auto-failover-enabled”,
“资源类型”: “AWS::ElastiCache::ReplicationGroup”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[ElastiCache.4] ElastiCache for Redis 复制组应静态加密”,
“AWS Config 规则”: “elasticache-repl-grp-encrypted-at-rest”,
“资源类型”: “AWS::ElastiCache::ReplicationGroup”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[ElastiCache.5] ElastiCache for Redis 复制组应在传输过程中加密”,
“AWS Config 规则”: “elasticache-repl-grp-加密传输中”,
“资源类型”: “AWS::ElastiCache::ReplicationGroup”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[ElastiCache.6] 6.0 版本之前的 ElastiCache for Redis 复制组应使用 Redis AUTH”,
“AWS Config 规则”: “elasticache-repl-grp-redis-auth-enabled”,
“资源类型”: “AWS::ElastiCache::ReplicationGroup”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[ElastiCache.7] ElastiCache 集群不应使用默认子网组”,
“AWS Config 规则”: “elasticache-subnet-group-check”,
“资源类型”: “AWS::ElastiCache::CacheCluster”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[ElasticBeanstalk.1] Elastic Beanstalk 环境应启用增强的运行状况报告”,
“AWS Config 规则”: “beanstalk-enhanced-health-reporting-enabled”,
“资源类型”: “AWS::ElasticBeanstalk::环境”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[ElasticBeanstalk.2] 应启用 Elastic Beanstalk 托管平台更新”,
“AWS Config 规则”: “elastic-beanstalk-management-updates-enabled”,
“资源类型”: “AWS::ElasticBeanstalk::环境”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[ElasticBeanstalk.3] Elastic Beanstalk 应将日志流式传输到 CloudWatch”,
“AWS Config 规则”: “elastic-beanstalk-logs-to-cloudwatch”,
“资源类型”: “AWS::ElasticBeanstalk::环境”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[ELB.1] 应用程序负载均衡器应配置为将所有 HTTP 请求重定向到 HTTPS”,
“AWS Config 规则”: “alb-http-to-https-redirection-check”,
“资源类型”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.2] 具有 SSL/HTTPS 侦听器的 Classic Load Balancer 应使用 AWS Certificate Manager 提供的证书”,
“AWS Config 规则”: “elb-acm-certificate-required”,
“资源类型”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.3] Classic Load Balancer 侦听器应配置 HTTPS 或 TLS 终止”,
“AWS Config 规则”: “elb-tls-https-listeners-only”,
“资源类型”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.4] 应用程序负载均衡器应配置为删除 http 标头”,
“AWS Config 规则”: “alb-http-drop-invalid-header-enabled”,
“资源类型”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.5] 应启用应用程序和经典负载均衡器日志记录”,
“AWS Config 规则”: “elb-logging-enabled”,
“资源类型”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.6] 应启用 Application Load Balancer 删除保护”,
“AWS Config 规则”: “elb-deletion-protection-enabled”,
“资源类型”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.7] Classic Load Balancer 应启用连接耗尽”,
“AWS Config 规则”: “elb-predefined-security-policy-ssl-check”,
“资源类型”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.8] 具有 SSL 侦听器的经典负载均衡器应使用具有强大 AWS 配置的预定义安全策略”,
“AWS Config 规则”: “elb-predefined-security-policy-ssl-check”,
“资源类型”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.9] 经典负载均衡器应启用跨区域负载均衡”,
“AWS Config 规则”: “elb-cross-zone-load-balancing-enabled”,
“资源类型”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.10] 经典负载均衡器应跨越多个可用区”,
“AWS Config 规则”: “clb-multiple-az”,
“资源类型”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.12] 应用程序负载均衡器应配置为防御性或最严格的异步缓解模式”,
“AWS Config 规则”: “alb-desync-mode-check”,
“资源类型”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.13] 应用程序、网络和网关负载均衡器应跨越多个可用区”,
“AWS Config 规则”: “elbv2-multiple-az”,
“资源类型”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.14] 经典负载均衡器应配置为防御性或最严格的异步缓解模式”,
“AWS Config 规则”: “clb-desync-mode-check”,
“资源类型”: “AWS::ElasticLoadBalancing::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ELB.16] Application Load Balancer 应与 AWS WAF Web ACL 关联”,
“AWS Config 规则”: “alb-waf-enabled”,
“资源类型”: “AWS::ElasticLoadBalancingV2::LoadBalancer”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[EMR.1] Amazon EMR 集群主节点不应具有公共 IP 地址”,
“AWS Config 规则”: “emr-master-no-public-ip”,
“资源类型”: “AWS::EMR::集群”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[EMR.2] 应启用 Amazon EMR 块公共访问设置”,
“AWS Config 规则”: “emr-block-public-access”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“严重”
},
{
“find_element.text”: “[ES.1] Elasticsearch 域应启用静态加密”,
“AWS Config 规则”: “elasticsearch-encrypted-at-rest”,
“资源类型”: “AWS::Elasticsearch::Domain”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[ES.2] Elasticsearch 域不应公开访问”,
“AWS Config 规则”: “elasticsearch-in-vpc-only”,
“资源类型”: “AWS::Elasticsearch::Domain”,
“时间表类型”：“定期”，
“严重性”：“严重”
},
{
“find_element.text”: “[ES.3] Elasticsearch 域应该加密节点之间发送的数据”,
“AWS Config 规则”: “elasticsearch-node-to-node-encryption-check”,
“资源类型”: “AWS::Elasticsearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ES.4] 应启用将 Elasticsearch 域错误记录到 CloudWatch Logs”,
“AWS Config 规则”: “elasticsearch-logs-to-cloudwatch”,
“资源类型”: “AWS::Elasticsearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ES.5] Elasticsearch 域应启用审核日志记录”,
“AWS Config 规则”: “elasticsearch-audit-logging-enabled”,
“资源类型”: “AWS::Elasticsearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ES.6] Elasticsearch 域应至少具有三个数据节点”,
“AWS Config 规则”: “elasticsearch-data-node-fault-tolerance”,
“资源类型”: “AWS::Elasticsearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ES.7] Elasticsearch 域应配置至少三个专用主节点”,
“AWS Config 规则”: “elasticsearch-https-required”,
“资源类型”: “AWS::Elasticsearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[ES.8] 与 Elasticsearch 域的连接应使用 TLS 1.2 加密”,
“AWS Config 规则”: “elasticsearch-https-required”,
“资源类型”: “AWS::Elasticsearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[EventBridge.3] EventBridge 自定义事件总线应附加基于资源的策略”,
“AWS Config 规则”: “custom-schema-registry-policy-attached”,
“资源类型”: “AWS::Events::EventBus”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[EventBridge.4] EventBridge 全局端点应启用事件复制”,
“AWS Config 规则”: “global-endpoint-event-replication-enabled”,
“资源类型”: “AWS::Events::Endpoint”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[FSx.1] FSx for OpenZFS 文件系统应配置为将标签复制到备份和卷”,
“AWS Config 规则”: “fsx-openzfs-copy-tags-enabled”,
“资源类型”: “AWS::FSx::FileSystem”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[GuardDuty.1] 应启用 GuardDuty”,
“AWS Config 规则”: “guardduty-enabled-centralized”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[IAM.1] IAM 策略不应允许完整的"*" 管理权限”,
“AWS Config 规则”: “iam-policy-no-statements-with-admin-access”,
“资源类型”: “AWS::IAM::策略”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[IAM.2] IAM 用户不应附加 IAM 策略”,
“AWS Config 规则”: “iam-user-no-policies-check”,
“资源类型”: “AWS::IAM::用户”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[IAM.3] IAM 用户的访问密钥应每 90 天或更短时间轮换一次”,
“AWS Config 规则”: “access-keys-rotated”,
“资源类型”: “AWS::IAM::用户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.4] IAM 根用户访问密钥不应存在”,
“AWS Config 规则”: “iam-root-access-key-check”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“严重”
},
{
“find_element.text”: “应为所有拥有控制台密码的 IAM 用户启用[IAM.5] MFA”,
“AWS Config 规则”: “mfa-enabled-for-iam-console-access”,
“资源类型”: “AWS::IAM::用户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.6] 应为 root 用户启用硬件 MFA”,
“AWS Config 规则”: “root-account-hardware-mfa-enabled”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“严重”
},
{
“find_element.text”: “[IAM.7] IAM 用户的密码策略应具有强大的配置”,
“AWS Config 规则”: “iam-password-policy”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.8] 应删除未使用的 IAM 用户凭证”,
“AWS Config 规则”: “iam-user-unused-credentials-check”,
“资源类型”: “AWS::IAM::用户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.9] 应为 root 用户启用 MFA”,
“AWS Config 规则”: “root-account-mfa-enabled”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“严重”
},
{
“find_element.text”: “[IAM.10] IAM 用户的密码策略应具有强大的 AWS 配置”,
“AWS Config 规则”: “iam-password-policy”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.11] 确保 IAM 密码策略至少需要一个大写字母”,
“AWS Config 规则”: “iam-password-policy”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.12] 确保 IAM 密码策略至少需要一个小写字母”,
“AWS Config 规则”: “iam-password-policy”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.13] 确保 IAM 密码策略至少需要一个符号”,
“AWS Config 规则”: “iam-password-policy”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.14] 确保 IAM 密码策略至少需要一个数字”,
“AWS Config 规则”: “iam-password-policy”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.15] 确保 IAM 密码策略要求最小密码长度为 14 或更长”,
“AWS Config 规则”: “iam-password-policy”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.16] 确保 IAM 密码策略防止密码重复使用”,
“AWS Config 规则”: “iam-password-policy”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[IAM.17] 确保 IAM 密码策略使密码在 90 天或更短的时间内过期”,
“AWS Config 规则”: “iam-password-policy”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[IAM.18] 确保已创建支持角色来通过 AWS Support 管理事件”,
“AWS Config 规则”: “iam-policy-in-use”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[IAM.19] 应为所有 IAM 用户启用 MFA”,
“AWS Config 规则”: “iam-user-mfa-enabled”,
“资源类型”: “AWS::IAM::用户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[IAM.20]避免使用root用户”,
“AWS Config 规则”: “use-of-root-account-test”,
“资源类型”: “AWS::IAM::用户”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[IAM.21] 您创建的 IAM 客户托管策略不应允许服务通配符操作”,
“AWS Config 规则”: “iam-policy-no-statements-with-full-access”,
“资源类型”: “AWS::IAM::策略”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[IAM.22] 45 天未使用的 IAM 用户凭证应被删除”,
“AWS Config 规则”: “iam-user-unused-credentials-check”,
“资源类型”: “AWS::IAM::用户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[Kinesis.1] Kinesis 流应静态加密”,
“AWS Config 规则”: “kinesis-stream-encrypted”,
“资源类型”: “AWS::Kinesis::Stream”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[KMS.1] IAM 客户托管策略不应允许对所有 KMS 密钥执行解密操作”,
“AWS Config 规则”: “iam-customer-policy-blocked-kms-actions”,
“资源类型”: “AWS::IAM::策略”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[KMS.2] IAM 委托人不应具有允许对所有 KMS 密钥执行解密操作的 IAM 内联策略”,
“AWS Config 规则”: “iam-inline-policy-blocked-kms-actions”,
“资源类型”: “AWS::KMS::Key”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[KMS.3] AWS KMS 密钥不应被无意删除”,
“AWS Config 规则”: “kms-cmk-not-scheduled-for-deletion-2”,
“资源类型”: “AWS::KMS::Key”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[KMS.4] 应启用 AWS KMS 密钥轮换”,
“AWS Config 规则”: “cmk-backing-key-rotation-enabled”,
“资源类型”: “AWS::KMS::Key”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[Lambda.1] Lambda 函数策略应禁止公共访问”,
“AWS Config 规则”: “lambda-function-public-access-prohibited”,
“资源类型”: “AWS::Lambda::Function”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[Lambda.2] Lambda 函数应使用受支持的运行时”,
“AWS Config 规则”: “lambda-function-settings-check”,
“资源类型”: “AWS::Lambda::Function”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Lambda.3] Lambda 函数应位于 VPC 中”,
“AWS Config 规则”: “lambda-inside-vpc”,
“资源类型”: “AWS::Lambda::Function”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[Lambda.5] VPC Lambda 函数应在多个可用区中运行”,
“AWS Config 规则”: “lambda-vpc-multi-az-check”,
“资源类型”: “AWS::Lambda::Function”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Macie.1] 应启用 Macie”,
“AWS Config 规则”: “macie-status-check”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[MSK.1] MSK 集群在代理节点之间传输时应进行加密”,
“AWS Config 规则”: “msk-in-cluster-node-require-tls”,
“资源类型”: “AWS::MSK::集群”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[MSK.2] MSK 集群应配置增强监控”,
“AWS Config 规则”: “msk-enhanced-monitoring-enabled”,
“资源类型”: “AWS::MSK::集群”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[MQ.5] ActiveMQ 代理应使用主备部署模式”,
“AWS Config 规则”: “mq-active-deployment-mode”,
“资源类型”: “AWS::AmazonMQ::Broker”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[MQ.6] RabbitMQ 代理应使用集群部署模式”,
“AWS Config 规则”: “mq-rabbit-deployment-mode”,
“资源类型”: “AWS::AmazonMQ::Broker”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[Neptune.1] Neptune 数据库集群应在静态时加密”,
“AWS Config 规则”: “neptune-cluster-encrypted”,
“资源类型”: “AWS::RDS::DBCluster”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[Neptune.2] Neptune 数据库集群应将审核日志发布到 CloudWatch Logs”,
“AWS Config 规则”: “neptune-cluster-cloudwatch-log-export-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[Neptune.3] Neptune 数据库集群快照不应公开”,
“AWS Config 规则”: “neptune-cluster-snapshot-public-prohibited”,
“资源类型”: “AWS::RDS::DBClusterSnapshot”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[Neptune.4] Neptune 数据库集群应启用删除保护”,
“AWS Config 规则”: “neptune-cluster-deletion-protection-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[Neptune.5] Neptune 数据库集群应启用自动备份”,
“AWS Config 规则”: “neptune-cluster-backup-retention-check”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Neptune.6] Neptune 数据库集群快照应静态加密”,
“AWS Config 规则”: “neptune-cluster-snapshot-encrypted”,
“资源类型”: “AWS::RDS::DBClusterSnapshot”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Neptune.7] Neptune 数据库集群应启用 IAM数据库身份验证”,
“AWS Config 规则”: “neptune-cluster-iam-database-authentication”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Neptune.8] Neptune 数据库集群应配置为将标签复制到快照”,
“AWS Config 规则”: “neptune-cluster-copy-tags-to-snapshot-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[Neptune.9] Neptune 数据库集群应跨多个可用区部署”,
“AWS Config 规则”: “neptune-cluster-multi-az-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.1] 网络防火墙防火墙应跨多个可用区部署”,
“AWS Config 规则”: “netfw-multi-az-enabled”,
“资源类型”: “AWS::NetworkFirewall::Firewall”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.2] 应启用网络防火墙日志记录”,
“AWS Config 规则”: “netfw-logging-enabled”,
“资源类型”: “AWS::NetworkFirewall::LoggingConfiguration”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.3] 网络防火墙策略应至少有一个关联的规则组”,
“AWS Config 规则”: “netfw-policy-rule-group-linked”,
“资源类型”: “AWS::NetworkFirewall::FirewallPolicy”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.4] 网络防火墙策略的默认无状态操作应该是丢弃或转发完整数据包”,
“AWS Config 规则”: “netfw-policy-default-action-full-packets”,
“资源类型”: “AWS::NetworkFirewall::FirewallPolicy”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.5] 网络防火墙策略的默认无状态操作应该是丢弃或转发分段数据包”,
“AWS Config 规则”: “netfw-policy-default-action-fragment-packets”,
“资源类型”: “AWS::NetworkFirewall::FirewallPolicy”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.6]无状态网络防火墙规则组不应为空”,
“AWS Config 规则”: “netfw-stateless-rule-group-not-empty”,
“资源类型”: “AWS::NetworkFirewall::RuleGroup”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[NetworkFirewall.9] 网络防火墙防火墙应启用删除保护”,
“AWS Config 规则”: “netfw-deletion-protection-enabled”,
“资源类型”: “AWS::NetworkFirewall::Firewall”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Opensearch.1] OpenSearch 域应启用静态加密”,
“AWS Config 规则”: “opensearch-encrypted-at-rest”,
“资源类型”: “AWS::OpenSearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Opensearch.2] OpenSearch 域不应公开访问”,
“AWS Config 规则”: “opensearch-in-vpc-only”,
“资源类型”: “AWS::OpenSearch::Domain”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[Opensearch.3] OpenSearch 域应该加密节点之间发送的数据”,
“AWS Config 规则”: “opensearch-node-to-node-encryption-check”,
“资源类型”: “AWS::OpenSearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Opensearch.4] 应启用将 OpenSearch 域错误记录到 CloudWatch Logs”,
“AWS Config 规则”: “opensearch-logs-to-cloudwatch”,
“资源类型”: “AWS::OpenSearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Opensearch.5] OpenSearch 域应启用审核日志记录”,
“AWS Config 规则”: “opensearch-audit-logging-enabled”,
“资源类型”: “AWS::OpenSearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Opensearch.6] OpenSearch 域应至少具有三个数据节点”,
“AWS Config 规则”: “opensearch-data-node-fault-tolerance”,
“资源类型”: “AWS::OpenSearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Opensearch.7] OpenSearch 域应启用细粒度访问控制”,
“AWS Config 规则”: “opensearch-access-control-enabled”,
“资源类型”: “AWS::OpenSearch::Domain”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[Opensearch.8] 与 OpenSearch 域的连接应使用 TLS 1.2 加密”,
“AWS Config 规则”: “opensearch-https-required”,
“资源类型”: “AWS::OpenSearch::Domain”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Opensearch.10] OpenSearch 域应安装最新的软件更新”,
“AWS Config 规则”: “opensearch-update-check”,
“资源类型”: “AWS::OpenSearch::Domain”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[PCA.1] 应禁用 AWS 私有 CA 根证书颁发机构”,
“AWS Config 规则”: “acm-pca-root-ca-disabled”,
“资源类型”: “AWS::ACMPCA::CertificateAuthority”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[RDS.1] RDS 快照应该是私有的”,
“AWS Config 规则”: “rds-snapshots-public-prohibited”,
“资源类型”: “AWS::RDS::DBClusterSnapshot”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[RDS.2] RDS 数据库实例应禁止公共访问，具体由可公开访问的 AWS 配置确定”,
“AWS Config 规则”: “rds-instance-public-access-check”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[RDS.3] RDS 数据库实例应启用静态加密”,
“AWS Config 规则”: “rds-storage-encrypted”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.4] RDS 集群快照和数据库快照应静态加密”,
“AWS Config 规则”: “rds-snapshot-encrypted”,
“资源类型”: “AWS::RDS::DBClusterSnapshot”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.5] RDS 数据库实例应配置多个可用区”,
“AWS Config 规则”: “rds-multi-az-support”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.6] 应为 RDS 数据库实例配置增强监控”,
“AWS Config 规则”: “rds-enhanced-monitoring-enabled”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[RDS.7] RDS 集群应启用删除保护”,
“AWS Config 规则”: “rds-cluster-deletion-protection-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[RDS.8] RDS 数据库实例应启用删除保护”,
“AWS Config 规则”: “rds-instance-deletion-protection-enabled”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[RDS.9] RDS 数据库实例应将日志发布到 CloudWatch Logs”,
“AWS Config 规则”: “rds-logging-enabled”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.10] 应为 RDS 实例配置 IAM 身份验证”,
“AWS Config 规则”: “rds-instance-iam-authentication-enabled”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.11] RDS 实例应启用自动备份”,
“AWS Config 规则”: “db-instance-backup-enabled”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.12] 应为 RDS 集群配置 IAM 身份验证”,
“AWS Config 规则”: “rds-cluster-iam-authentication-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.13] 应启用 RDS 自动次要版本升级”,
“AWS Config 规则”: “rds-automatic-minor-version-upgrade-enabled”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[RDS.14] Amazon Aurora 集群应启用回溯”,
“AWS Config 规则”: “aurora-mysql-backtracking-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.15] 应为多个可用区配置 RDS 数据库集群”,
“AWS Config 规则”: “rds-cluster-multi-az-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.16] RDS 数据库集群应配置为将标签复制到快照”,
“AWS Config 规则”: “rds-cluster-copy-tags-to-snapshots-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[RDS.17] RDS 数据库实例应配置为将标签复制到快照”,
“AWS Config 规则”: “rds-instance-copy-tags-to-snapshots-enabled”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[RDS.18] RDS实例应部署在VPC中”,
“AWS Config 规则”: “rds-deployed-in-vpc”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[RDS.19] 应为关键集群事件配置现有 RDS 事件通知订阅”,
“AWS Config 规则”: “rds-cluster-event-notifications-configured”,
“资源类型”: “AWS::RDS::EventSubscription”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[RDS.20] 应为关键数据库实例事件配置现有 RDS 事件通知订阅”,
“AWS Config 规则”: “rds-instance-event-notifications-configured”,
“资源类型”: “AWS::RDS::EventSubscription”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[RDS.21] 应为关键数据库参数组事件配置 RDS 事件通知订阅”,
“AWS Config 规则”: “rds-pg-event-notifications-configured”,
“资源类型”: “AWS::RDS::EventSubscription”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[RDS.22] 应为关键数据库安全组事件配置 RDS 事件通知订阅”,
“AWS Config 规则”: “rds-sg-event-notifications-configured”,
“资源类型”: “AWS::RDS::EventSubscription”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[RDS.23] RDS 实例不应使用数据库引擎默认端口”,
“AWS Config 规则”: “rds-no-default-ports”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[RDS.24] RDS 数据库集群应使用自定义管理员用户名”,
“AWS Config 规则”: “rds-cluster-default-admin-check”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.25] RDS 数据库实例应使用自定义管理员用户名”,
“AWS Config 规则”: “rds-instance-default-admin-check”,
“资源类型”: “AWS::RDS::DBInstance”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.26] RDS 数据库实例应受备份计划保护”,
“AWS Config 规则”: “rds-resources-protected-by-backup-plan”,
“资源类型”: “AWS::RDS::DBInstance”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.27] RDS 数据库集群应静态加密”,
“AWS Config 规则”: “rds-cluster-encrypted-at-rest”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.34] Aurora MySQL 数据库集群应将审核日志发布到 CloudWatch Logs”,
“AWS Config 规则”: “rds-aurora-mysql-audit-logging-enabled”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[RDS.35] RDS 数据库集群应启用自动次要版本升级”,
“AWS Config 规则”: “rds-cluster-auto-minor-version-upgrade-enable”,
“资源类型”: “AWS::RDS::DBCluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Redshift.1] Amazon Redshift 集群应禁止公共访问”,
“AWS Config 规则”: “redshift-cluster-public-access-check”,
“资源类型”: “AWS::Redshift::Cluster”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[Redshift.2] 与 Amazon Redshift 集群的连接应在传输过程中加密”,
“AWS Config 规则”：“redshift-require-tls-ssl”，
“资源类型”: “AWS::Redshift::Cluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Redshift.3] Amazon Redshift 集群应启用自动快照”,
“AWS Config 规则”: “redshift-backup-enabled”,
“资源类型”: “AWS::Redshift::Cluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Redshift.4] Amazon Redshift 集群应启用审核日志记录”,
“AWS Config 规则”: “redshift-cluster-audit-logging-enabled”,
“资源类型”: “AWS::Redshift::Cluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Redshift.6] Amazon Redshift 应该启用到主要版本的自动升级”,
“AWS Config 规则”: “redshift-cluster-maintenancesettings-check”,
“资源类型”: “AWS::Redshift::Cluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Redshift.7] Redshift 集群应使用增强型 VPC 路由”,
“AWS Config 规则”: “redshift-enhanced-vpc-routing-enabled”,
“资源类型”: “AWS::Redshift::Cluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Redshift.8] Amazon Redshift 集群不应使用默认管理员用户名”,
“AWS Config 规则”: “redshift-default-admin-check”,
“资源类型”: “AWS::Redshift::Cluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Redshift.9] Redshift 集群不应使用默认数据库名称”,
“AWS Config 规则”: “redshift-default-db-name-check”,
“资源类型”: “AWS::Redshift::Cluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Redshift.10] Redshift 集群应静态加密”,
“AWS Config 规则”: “redshift-cluster-kms-enabled”,
“资源类型”: “AWS::Redshift::Cluster”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[Route53.2] Route 53 公共托管区域应记录 DNS 查询”,
“AWS Config 规则”: “route53-query-logging-enabled”,
“资源类型”: “AWS::Route53::HostedZone”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[S3.1] 应启用 S3 块公共访问设置”,
“AWS Config 规则”: “s3-account-level-public-access-blocks-periodic”,
“资源类型”: “AWS::::账户”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[S3.2] S3 存储桶应禁止公共读取访问”,
“AWS Config 规则”: “s3-bucket-public-read-prohibited”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “定期和更改触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[S3.3] S3 存储桶应禁止公共写入访问”,
“AWS Config 规则”: “s3-bucket-public-write-prohibited”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “定期和更改触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[S3.5] S3 存储桶应要求请求使用安全套接字层”,
“AWS Config 规则”: “s3-bucket-ssl-requests-only”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[S3.6] 授予存储桶策略中其他 AWS 账户的 S3 权限应受到限制”,
“AWS Config 规则”: “s3-bucket-blacklisted-actions-prohibited”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[S3.7] S3 存储桶应启用跨区域复制”,
“AWS Config 规则”: “s3-bucket-replication-enabled”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[S3.8] S3 块公共访问设置应在存储桶级别启用”,
“AWS Config 规则”: “s3-bucket-level-public-access-prohibited”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[S3.9] 应启用 S3 存储桶服务器访问日志记录”,
“AWS Config 规则”: “s3-bucket-logging-enabled”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[S3.10] 启用版本控制的 S3 存储桶应配置生命周期策略”,
“AWS Config 规则”: “s3-version-lifecycle-policy-check”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[S3.11] S3 存储桶应启用事件通知”,
“AWS Config 规则”: “s3-event-notifications-enabled”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[S3.12] S3 访问控制列表 (ACL) 不应用于管理用户对存储桶的访问”,
“AWS Config 规则”: “s3-bucket-acl-prohibited”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[S3.13] S3 存储桶应配置生命周期策略”,
“AWS Config 规则”: “s3-lifecycle-policy-check”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[S3.14] S3 存储桶应使用版本控制”,
“AWS Config 规则”: “s3-bucket-versioning-enabled”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[S3.15] S3 存储桶应配置为使用对象锁”,
“AWS Config 规则”: “s3-bucket-default-lock-enabled”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[S3.17] S3 存储桶应使用 AWS KMS 密钥进行静态加密”,
“AWS Config 规则”: “s3-default-加密-kms”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[S3.19] S3 接入点应启用阻止公共访问设置”,
“AWS Config 规则”: “s3-access-point-public-access-blocks”,
“资源类型”: “AWS::S3::AccessPoint”,
“计划类型”: “更改已触发”,
“严重性”：“严重”
},
{
“find_element.text”: “[S3.20] S3 通用存储桶应启用 MFA 删除”,
“AWS Config 规则”: “s3-bucket-mfa-delete-enabled”,
“资源类型”: “AWS::S3::Bucket”,
“计划类型”: “更改已触发”,
“严重性”：“低”
},
{
“find_element.text”: “[SageMaker.1] Amazon SageMaker 笔记本实例不应直接访问互联网”,
“AWS Config 规则”: “sagemaker-notebook-no-direct-internet-access”,
“资源类型”: “AWS::SageMaker::NotebookInstance”,
“时间表类型”：“定期”，
“严重性”：“高”
},
{
“find_element.text”: “[SageMaker.2] SageMaker 笔记本实例应在自定义 VPC 中启动”,
“AWS Config 规则”: “sagemaker-notebook-instance-inside-vpc”,
“资源类型”: “AWS::SageMaker::NotebookInstance”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[SageMaker.3] 用户不应拥有 SageMaker 笔记本实例的 root 访问权限”,
“AWS Config 规则”: “sagemaker-notebook-instance-root-access-check”,
“资源类型”: “AWS::SageMaker::NotebookInstance”,
“计划类型”: “更改已触发”,
“严重性”：“高”
},
{
“find_element.text”: “[SecretsManager.1] Secrets Manager 机密应启用自动轮换”,
“AWS Config 规则”: “secretsmanager-rotation-enabled-check”,
“资源类型”: “AWS::SecretsManager::Secret”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[SecretsManager.2] 配置自动轮换的 Secrets Manager 机密应成功轮换”,
“AWS Config 规则”: “secretsmanager-scheduled-rotation-success-check”,
“资源类型”: “AWS::SecretsManager::Secret”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[SecretsManager.3] 删除未使用的 Secrets Manager 密钥”,
“AWS Config 规则”: “secretsmanager-secret-unused”,
“资源类型”: “AWS::SecretsManager::Secret”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[SecretsManager.4] Secrets Manager 机密应在指定天数内轮换”,
“AWS Config 规则”: “secretsmanager-secret-periodic-rotation”,
“资源类型”: “AWS::SecretsManager::Secret”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[SNS.1] SNS 主题应使用 AWS KMS 进行静态加密”,
“AWS Config 规则”: “sns-加密-kms”,
“资源类型”: “AWS::SNS::主题”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[SNS.2] 应为发送到主题的通知消息启用传送状态记录”,
“AWS Config 规则”: “sns-topic-message-delivery-notification-enabled”,
“资源类型”: “AWS::SNS::主题”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[SQS.1] Amazon SQS 队列应静态加密”,
“AWS Config 规则”: “sqs-queue-encrypted”,
“资源类型”: “AWS::SQS::Queue”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[StepFunctions.1] Step Functions 状态机应该打开日志记录”,
“AWS Config 规则”: “step-functions-state-machine-logging-enabled”,
“资源类型”: “AWS::StepFunctions::StateMachine”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[WAF.1] 应启用 AWS WAF Classic Global Web ACL 日志记录”,
“AWS Config 规则”: “waf-classic-logging-enabled”,
“资源类型”: “AWS::WAF::WebACL”,
“时间表类型”：“定期”，
“严重程度”：“中”
},
{
“find_element.text”: “[WAF.2] AWS WAF Classic 区域规则应至少有一个条件”,
“AWS Config 规则”: “waf-regional-rule-not-empty”,
“资源类型”: “AWS::WAFRegional::Rule”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[WAF.3] AWS WAF Classic 区域规则组应至少有一个规则”,
“AWS Config 规则”: “waf-regional-rulegroup-not-empty”,
“资源类型”: “AWS::WAFRegional::RuleGroup”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[WAF.4] AWS WAF Classic 区域 Web ACL 应至少有一个规则或规则组”,
“AWS Config 规则”: “waf-regional-webacl-not-empty”,
“资源类型”: “AWS::WAFRegional::WebACL”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[WAF.6] AWS WAF Classic 全局规则应至少有一个条件”,
“AWS Config 规则”: “waf-global-rule-not-empty”,
“资源类型”: “AWS::WAF::规则”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[WAF.7] AWS WAF Classic 全局规则组应至少有一个规则”,
“AWS Config 规则”: “waf-global-rulegroup-not-empty”,
“资源类型”: “AWS::WAF::RuleGroup”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[WAF.8] AWS WAF Classic 全局 Web ACL 应至少有一个规则或规则组”,
“AWS Config 规则”: “waf-global-webacl-not-empty”,
“资源类型”: “AWS::WAF::WebACL”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[WAF.10] AWS WAF Web ACL 应至少有一个规则或规则组”,
“AWS Config 规则”: “wafv2-webacl-not-empty”,
“资源类型”: “AWS::WAFv2::WebACL”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
},
{
“find_element.text”: “[WAF.11] 应启用 AWS WAF Web ACL 日志记录”,
“AWS Config 规则”: “wafv2-logging-enabled”,
“资源类型”: “AWS::WAFv2::WebACL”,
“时间表类型”：“定期”，
“严重性”：“低”
},
{
“find_element.text”: “[WAF.12] AWS WAF 规则应启用 CloudWatch 指标”,
“AWS Config 规则”: “wafv2-rulegroup-logging-enabled”,
“资源类型”: “AWS::WAFv2::RuleGroup”,
“计划类型”: “更改已触发”,
“严重程度”：“中”
}]

</details>

## Filtering with Jq Command (Severity = Critical or High)

- I filtered the retrieved JSON file with the jq command to extract the AWS Config rules according to their respective severity.

- First, let's extract the AWS Config rules with Critical severity.
  - AWS Config rules that are considered to have high security risks, such as public exposure of AWS resources, security groups allowing access to common ports, and potential credential leaks, were extracted.
  - The items marked as `Not Found` are custom Security Hub rules.

<pre class="line-numbers" data-line="4"><code class="language-bash">
% cat result_20240204153052.json| jq '.[] | select(.Severity == "Critical") | {title: ."find_element.text" ,config_rule: ."AWS Config rule"}'
{
  "title": "[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible",
  "config_rule": "Not Found"
}
{
  "title": "[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials",
  "config_rule": "codebuild-project-source-repo-url-check"
}
{
  "title": "[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials",
  "config_rule": "codebuild-project-envvar-awscred-check"
}
{
  "title": "[DMS.1] Database Migration Service replication instances should not be public",
  "config_rule": "dms-replication-not-public"
}
{
  "title": "[DocumentDB.3] Amazon DocumentDB manual cluster snapshots should not be public",
  "config_rule": "docdb-cluster-snapshot-public-prohibited"
}
{
  "title": "[EC2.1] Amazon EBS snapshots should not be publicly restorable",
  "config_rule": "ebs-snapshot-public-restorable-check"
}
{
  "title": "[EC2.19] Security groups should not allow unrestricted\n                access to ports with high risk",
  "config_rule": "vpc-sg-restricted-common-ports"
}
{
  "title": "[SSM.4] SSM documents should not be public",
  "config_rule": "ssm-document-not-public"
}
{
  "title": "[EMR.2] Amazon EMR block public access setting should be enabled",
  "config_rule": "emr-block-public-access"
}
{
  "title": "[ES.2] Elasticsearch domains should not be publicly accessible",
  "config_rule": "elasticsearch-in-vpc-only"
}
{
  "title": "[IAM.4] IAM root user access key should not exist",
  "config_rule": "iam-root-access-key-check"
}
{
  "title": "[IAM.6] Hardware MFA should be enabled for the root user",
  "config_rule": "root-account-hardware-mfa-enabled"
}
{
  "title": "[IAM.9] MFA should be enabled for the root user",
  "config_rule": "root-account-mfa-enabled"
}
{
  "title": "[KMS.3] AWS KMS keys should not be deleted unintentionally",
  "config_rule": "kms-cmk-not-scheduled-for-deletion-2"
}
{
  "title": "[Lambda.1] Lambda function policies should prohibit public access",
  "config_rule": "lambda-function-public-access-prohibited"
}
{
  "title": "[Neptune.3] Neptune DB cluster snapshots should not be\n                public",
  "config_rule": "neptune-cluster-snapshot-public-prohibited"
}
{
  "title": "[Opensearch.2] OpenSearch domains should not be publicly accessible",
  "config_rule": "opensearch-in-vpc-only"
}
{
  "title": "[RDS.1] RDS snapshot should be private",
  "config_rule": "rds-snapshots-public-prohibited"
}
{
  "title": "[RDS.2] RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible AWS Configuration",
  "config_rule": "rds-instance-public-access-check"
}
{
  "title": "[Redshift.1] Amazon Redshift clusters should prohibit public access",
  "config_rule": "redshift-cluster-public-access-check"
}
{
  "title": "[S3.2] S3 buckets should prohibit public read access",
  "config_rule": "s3-bucket-public-read-prohibited"
}
{
  "title": "[S3.3] S3 buckets should prohibit public write access",
  "config_rule": "s3-bucket-public-write-prohibited"
}
{
  "title": "[S3.19] S3 access points should have block public access settings enabled",
  "config_rule": "s3-access-point-public-access-blocks"
}

接下来，我们提取高严重性的 AWS Config 规则。
提取了被认为具有高安全风险但低于“严重”风险的 AWS Config 规则。
标记为“未找到”的项目不会被提取，因为它们在文档中被列为“AWS Configrule”而不是“AWS Config 规则”。

                    
% cat result_20240204153052.json|jq ‘.[] |select(.Severity == “高”) |{title: .”find_element.text” ,config_rule: .”AWS Config 规则”}’
{
“title”: “[Account.2] AWS 账户应属于 AWS Organizations 组织”,
“config_rule”: “组织的帐户部分”
}
{
“title”: “[ACM.2] ACM 管理的 RSA 证书应使用至少 2,048 位的密钥长度”,
“config_rule”：“acm-证书-rsa-检查”
}
{
“title”: “[AppSync.5] AWS AppSync GraphQL API 不应使用 API 密钥进行身份验证”,
“config_rule”: “appsync-授权-检查”
}
{
“title”: “[CloudFront.1] CloudFront 发行版应配置默认根对象”,
“config_rule”：“cloudfront-default-root-object-configured”
}
{
“title”: “[CloudFront.12] CloudFront 发行版不应指向不存在的 S3 源”,
“config_rule”：“cloudfront-s3-origin-non-existent-bucket”
}
{
“title”: “[CloudTrail.1] CloudTrail 应启用并配置至少一个包含读写管理事件的多区域跟踪”,
“config_rule”: “启用多区域cloudtrail”
}
{
“title”: “[CloudTrail.3] 应启用 CloudTrail”,
“config_rule”: “启用cloudtrail”
}
{
“title”: “[CloudWatch.15] CloudWatch 警报应配置指定的操作”,
“config_rule”: “cloudwatch-警报-操作-检查”
}
{
“title”: “[CloudWatch.17] 应激活 CloudWatch 警报操作”,
“config_rule”：“cloudwatch-警报-操作-启用-检查”
}
{
“title”: “[CodeBuild.5] CodeBuild 项目环境不应启用特权模式”,
“config_rule”：“codebuild-项目-环境-特权-检查”
}
{
“title”: “[ECR.1] ECR 私有存储库应配置图像扫描”,
“config_rule”: “ecr-private-image-scanning-enabled”
}
{
“title”: “[ECS.1] Amazon ECS 任务定义应具有安全网络模式和用户定义。”,
“config_rule”: “ecs-任务定义-用户-主机模式-检查”
}
{
“title”: “[ECS.2] ECS 服务不应自动分配公共 IP 地址”,
“config_rule”: “未找到”
}
{
“title”: “[ECS.3] ECS 任务定义不应共享主机的进程命名空间”,
“config_rule”: “未找到”
}
{
“title”: “[ECS.4] ECS 容器应以非特权方式运行”,
“config_rule”: “未找到”
}
{
“title”: “[ECS.5] ECS 容器应限制为对根文件系统的只读访问”,
“config_rule”: “未找到”
}
{
“title”: “[ECS.8] 机密不应作为容器环境变量传递”,
“config_rule”: “未找到”
}
{
“title”: “[ECS.9] ECS 任务定义应具有日志记录配置”,
“config_rule”: “未找到”
}
{
“title”: “[EC2.2] VPC 默认安全组不应允许入站或出站流量”,
“config_rule”：“vpc-默认安全组-关闭”
}
{
“title”: “[EC2.8] EC2 实例应使用实例元数据服务版本 2 (IMDSv2)”,
“config_rule”: “ec2-imdsv2-check”
}
{
“title”: “[EC2.9] Amazon EC2 实例不应具有公共 IPv4 地址”,
“config_rule”：“ec2-instance-no-public-ip”
}
{
“title”: “[EC2.13] 安全组不应允许从.0.0/0 或 ::/0 进入端口 22”,
“config_rule”：“限制 ssh”
}
{
“title”: “[EC2.14] 安全组不应允许从 0.0.0.0/0 或 ::/0 进入端口 3389”,
“config_rule”: “限制公共端口”
}
{
“title”: “[EC2.18] 安全组应仅允许授权端口不受限制的传入流量”,
“config_rule”: “vpc-sg-仅开放至授权端口”
}
{
“title”: “[EC2.23] Amazon EC2 Transit Gateway 不应自动接受 VPC 附件请求”,
“config_rule”：“ec2-transit-gateway-auto-vpc-attach-disabled”
}
{
“title”: “[EC2.25] Amazon EC2 启动模板不应将公共IP 分配给网络接口”,
“config_rule”：“ec2-launch-template-public-ip-disabled”
}
{
“title”: “[AutoScaling.3] Auto Scaling 组启动配置应将 EC2 实例配置为需要实例元数据服务版本 2 (IMDSv2)”,
“config_rule”：“自动缩放-launchconfig-requires-imdsv2”
}
{
“title”: “[AutoScaling.4] Auto Scaling 组启动配置的元数据响应跃点限制不应大于 1”,
“config_rule”：“自动缩放启动配置跳数限制”
}
{
“title”: “[Autoscaling.5] 使用 Auto Scaling 组启动配置启动的 Amazon EC2 实例不应具有公共 IP 地址”,
“config_rule”：“自动缩放启动配置-公共IP-禁用”
}
{
“title”: “[SSM.2] 由 Systems Manager 管理的 Amazon EC2 实例在安装补丁后应具有“COMPLIANT”的补丁合规性状态”,
“config_rule”：“ec2-托管实例-补丁-合规性-状态-检查”
}
{
“title”: “[EKS.1] EKS 集群端点不应公开访问”,
“config_rule”：“eks-端点-无公共访问”
}
{
“title”: “[EKS.2] EKS 集群应在受支持的 Kubernetes 版本上运行”,
“config_rule”：“eks-cluster-supported-version”
}
{
“title”: “[ElastiCache.1] ElastiCache Redis 集群应启用自动备份”,
“config_rule”：“elasticache-redis-集群-自动备份-检查”
}
{
“title”: “[ElastiCache.2] ElastiCache for Redis 缓存集群应启用自动次要版本升级”,
“config_rule”：“elasticache-自动次要版本-升级检查”
}
{
“title”: “[ElastiCache.7] ElastiCache 集群不应使用默认子网组”,
“config_rule”: “elasticache-子网组-检查”
}
{
“title”: “[ElasticBeanstalk.2] 应启用 Elastic Beanstalk 托管平台更新”,
“config_rule”：“启用弹性beanstalk管理更新”
}
{
“title”: “[ElasticBeanstalk.3] Elastic Beanstalk 应将日志流式传输到 CloudWatch”,
“config_rule”: “elastic-beanstalk-logs-to-cloudwatch”
}
{
“title”: “[EMR.1] Amazon EMR 集群主节点不应具有公共 IP 地址”,
“config_rule”：“emr-master-no-public-ip”
}
{
“title”: “[GuardDuty.1] 应启用 GuardDuty”,
“config_rule”: “guardduty-enabled-centralized”
}
{
“title”: “[IAM.1] IAM 策略不应允许完全"*" 管理权限”,
“config_rule”: “iam-policy-no-statements-with-admin-access”
}
{
“title”: “[Opensearch.7] OpenSearch 域应启用细粒度访问控制”,
“config_rule”：“启用开放搜索访问控制”
}
{
“title”: “[RDS.13] 应启用 RDS 自动次要版本升级”,
“config_rule”：“rds-自动次要版本升级启用”
}
{
“title”: “[RDS.18] RDS实例应部署在VPC中”,
“config_rule”：“rds-部署在-vpc”
}
{
“title”: “[S3.6] 应限制在存储桶策略中授予其他 AWS 账户的 S3 权限”,
“config_rule”: “s3-bucket-blacklisted-actions-prohibited”
}
{
“title”: “[S3.8] S3 块公共访问设置应在存储桶级别启用”,
“config_rule”: “s3-bucket-level-public-access-prohibited”
}
{
“title”: “[SageMaker.1] Amazon SageMaker 笔记本实例不应直接访问互联网”,
“config_rule”: “sagemaker-notebook-no-direct-internet-access”
}
{
“title”: “[SageMaker.2] SageMaker 笔记本实例应在自定义 VPC 中启动”,
“config_rule”：“sagemaker-notebook-instance-inside-vpc”
}
{
“title”: “[SageMaker.3] 用户不应拥有 SageMaker 笔记本实例的 root 访问权限”,
“config_rule”：“sagemaker-notebook-instance-root-access-check”
}
                    ````

          
          
          
            
              📢 分享本文
            
            
              
              
                
                在 X 上分享