aws_compliance

AWS Compliance

To help with logging and monitoring within your environment, enable AWS WAF logging on regional and global web ACLs.

waf_web_acl_logging_enabled

pci_dss_v321_requirement_10_1

10.1 Implement audit trails to link all access to system components to each individual user

hipaa_security_rule_2003_164_308_a_1_ii_d

164.308(a)(1)(ii)(D) Information system activity review

hipaa_final_omnibus_security_rule_2013_164_308_a_1_ii_d

hipaa_final_omnibus_security_rule_2013_164_308_a_4_ii_a

164.308(a)(4)(ii)(A) Isolating healthcare clearing house functions

hipaa_security_rule_2003_164_308_a_4_ii_a

hipaa_security_rule_2003_164_312_b

164.312(b) Audit controls

hipaa_final_omnibus_security_rule_2013_164_312_b

pci_dss_v321_requirement_3_2_3

3.2.3 Do not store the personal identification number (PIN) or the encrypted PIN block after authorization

pci_dss_v321_requirement_3_4_d

3.4.d Examine a sample of audit logs, including payment application logs, to confirm that PAN is rendered unreadable or is not present in the logs

nist_800_171_rev_2_3_6_1

3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities

nist_800_171_rev_2_3_6_2

3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization

cis_controls_v8_ig1_8_2

8.2 Collect Audit Logs

soc_2_a_1_2

A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives

acsc_essential_eight_ml_2_1_3

ACSC-EE-ML2-1.3: Application control ML2

acsc_essential_eight_ml_2_5_11

ACSC-EE-ML2-5.11: Restrict administrative privileges ML2

acsc_essential_eight_ml_2_5_12

ACSC-EE-ML2-5.12: Restrict administrative privileges ML2

acsc_essential_eight_ml_2_7_7

ACSC-EE-ML2-7.7: Multi-factor authentication ML2

soc_2_cc_7_2

CC7.2 The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events

soc_2_cc_7_3

CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures

nist_csf_de_ae_1

DE.AE-1

nist_csf_de_ae_3

DE.AE-3

nist_csf_pr_pt_1

PR.PT-1

all_controls_waf

WAF web ACL logging should be enabled

Run individual configuration, compliance and security controls or full compliance benchmarks for CIS, FFIEC, PCI, NIST, HIPAA, RBI CSF, GDPR, SOC 2, Audit Manager Control Tower, FedRAMP, GxP and AWS Foundational Security Best Practices controls across all your AWS accounts using Powerpipe and Steampipe.

Apache License 2.0

steampipe-mod-aws-compliance

Control: WAF web ACL logging should be enabled

Description

Usage

SQL

Tags