Benchmark: 164.308(a)(3)(i) Workforce security
Description
Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-aws-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select 164.308(a)(3)(i) Workforce security.
Run this benchmark in your terminal:
powerpipe benchmark run aws_compliance.benchmark.hipaa_security_rule_2003_164_308_a_3_iSnapshot and share results via Turbot Pipes:
powerpipe benchmark run aws_compliance.benchmark.hipaa_security_rule_2003_164_308_a_3_i --shareControls
- DMS replication instances should not be publicly accessible
- EBS snapshots should not be publicly restorable
- EC2 instances should be in a VPC
- EC2 instances should not have a public IP address
- ES domains should be in a VPC
- IAM groups should have at least one user
- IAM policy should not have statements with admin access
- IAM root user should not have access keys
- IAM users should be in at least one group
- IAM user should not have any inline or attached policies
- Lambda functions should be in a VPC
- Lambda functions should restrict public access
- OpenSearch domains should be in a VPC
- RDS DB instances should prohibit public access
- RDS snapshots should prohibit public access
- Redshift clusters should prohibit public access
- S3 bucket policy should prohibit public access
- S3 buckets should prohibit public read access
- S3 buckets should prohibit public write access
- S3 public access should be blocked at account level
- SageMaker notebook instances should not have direct internet access