Benchmark: 5. Intentional data policies
Description
Not all data is created equal, which means classifying data properly is crucial to its security. It's important to accommodate the complex tradeoffs between a strict security posture and a flexible agile environment.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-aws-top-10Start the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select 5. Intentional data policies.
Run this benchmark in your terminal:
powerpipe benchmark run aws_top_10.benchmark.account_security_intentional_data_policiesSnapshot and share results via Turbot Pipes:
powerpipe benchmark run aws_top_10.benchmark.account_security_intentional_data_policies --shareControls
- API Gateway REST API endpoint type should be configured to private
- Ensure the S3 bucket CloudTrail logs to is not publicly accessible
- EBS snapshots should not be publicly restorable
- EC2 AMIs should restrict public access
- EC2 instances should not have a public IP address
- ECR repositories should prohibit public access
- EFS file systems should restrict public access
- EKS clusters endpoint should restrict public access
- ELB load balancers should prohibit public access
- EMR public access should be blocked at account level
- KMS CMK policies should prohibit public access
- Lambda functions should restrict public access
- RDS DB instances should prohibit public access
- Redshift clusters should prohibit public access
- S3 bucket policy should prohibit public access
- AWS S3 permissions granted to other AWS accounts in bucket policies should be restricted
- S3 buckets should prohibit public read access
- S3 buckets should prohibit public write access
- S3 public access should be blocked at account level
- S3 public access should be blocked at account and bucket levels
- SNS topic policies should prohibit public access
- SQS queue policies should prohibit public access
- SSM documents should not be public