[アップデート] AWS Security Hub に CIS AWS Foundations Benchmark v3.0.0 のセキュリティ基準がリリースされました！

ID,title,severity,add control
Account.1,"Security contact information should be provided for an AWS account",MEDIUM,-
CloudTrail.1,"CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events",HIGH,-
CloudTrail.2,"CloudTrail should have encryption at-rest enabled",MEDIUM,-
CloudTrail.4,"CloudTrail log file validation should be enabled",LOW,-
CloudTrail.7,"Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket",LOW,-
Config.1,"AWS Config should be enabled",MEDIUM,-
EC2.2,"VPC default security groups should not allow inbound or outbound traffic",HIGH,-
EC2.6,"VPC flow logging should be enabled in all VPCs",MEDIUM,-
EC2.7,"EBS default encryption should be enabled",MEDIUM,-
EC2.8,"EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)",HIGH,-
EC2.21,"Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389",MEDIUM,-
EC2.53,"EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports",HIGH,*
EC2.54,"EC2 security groups should not allow ingress from ::/0 to remote server administration ports",HIGH,*
EFS.1,"Elastic File System should be configured to encrypt file data at-rest using AWS KMS",MEDIUM,-
IAM.2,"IAM users should not have IAM policies attached",LOW,-
IAM.3,"IAM users' access keys should be rotated every 90 days or less",MEDIUM,-
IAM.4,"IAM root user access key should not exist",CRITICAL,-
IAM.5,"MFA should be enabled for all IAM users that have a console password",MEDIUM,-
IAM.6,"Hardware MFA should be enabled for the root user",CRITICAL,-
IAM.9,"MFA should be enabled for the root user",CRITICAL,-
IAM.15,"Ensure IAM password policy requires minimum password length of 14 or greater",MEDIUM,-
IAM.16,"Ensure IAM password policy prevents password reuse",LOW,-
IAM.18,"Ensure a support role has been created to manage incidents with AWS Support",LOW,-
IAM.22,"IAM user credentials unused for 45 days should be removed",MEDIUM,-
IAM.26,"Expired SSL/TLS certificates managed in IAM should be removed",MEDIUM,*
IAM.27,"IAM identities should not have the AWSCloudShellFullAccess policy attached",MEDIUM,*
IAM.28,"IAM Access Analyzer external access analyzer should be enabled",HIGH,*
KMS.4,"AWS KMS key rotation should be enabled",MEDIUM,-
RDS.2,"RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible AWS Configuration",CRITICAL,-
RDS.3,"RDS DB instances should have encryption at-rest enabled",MEDIUM,-
RDS.13,"RDS automatic minor version upgrades should be enabled",HIGH,-
S3.1,"S3 general purpose buckets should have block public access settings enabled",MEDIUM,-
S3.5,"S3 general purpose buckets should require requests to use SSL",MEDIUM,-
S3.8,"S3 general purpose buckets should block public access-level",HIGH,-
S3.20,"S3 general purpose buckets should have MFA delete enabled",LOW,-
S3.22,"S3 general purpose buckets should log object-level write events",MEDIUM,*
S3.23,"S3 general purpose buckets should log object-level read events",MEDIUM,*