Benchmark: PR.IR-01
Description
Networks and environments are protected from unauthorized logical access and usage.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-aws-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select PR.IR-01.
Run this benchmark in your terminal:
powerpipe benchmark run aws_compliance.benchmark.nist_csf_v2_pr_ir_01Snapshot and share results via Turbot Pipes:
powerpipe benchmark run aws_compliance.benchmark.nist_csf_v2_pr_ir_01 --shareControls
- AWS account should be part of AWS Organizations
- Ensure IAM policy should not grant full access to service
- IAM policy should not have statements with admin access
- Networkfirewall firewall should be in a VPC
- The default stateless action for Network Firewall policies should be drop or forward for fragmented packets
- The default stateless action for Network Firewall policies should be drop or forward for full packets
- Network Firewall policies should have at least one rule group associated
- Stateless network firewall rule group should not be empty
- SNS topic policies should prohibit cross account access
- SNS topic policies should prohibit public access
- SNS topic policies should prohibit publishing access
- SNS topic policies should prohibit subscription public access
- VPC should be configured to use VPC endpoints
- VPC default security group should not allow inbound and outbound traffic
- VPC security groups should restrict ingress access on ports 20, 21, 22, 3306, 3389, 4333 from 0.0.0.0/0
- VPC security groups should restrict ingress SSH access from 0.0.0.0/0
- VPC security groups should restrict ingress TCP and UDP access from 0.0.0.0/0