Benchmark: 10.7.1: Additional requirement for service providers only: Failures of critical security control systems are detected, alerted, and addressed promptly, including but not limited to failure

Usage

Install the mod:

mkdir dashboards
cd dashboards
powerpipe mod init
powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance

Start the Powerpipe server:

steampipe service start
powerpipe server

Open http://localhost:9033 in your browser and select 10.7.1: Additional requirement for service providers only: Failures of critical security control systems are detected, alerted, and addressed promptly, including but not limited to failure.

Run this benchmark in your terminal:

powerpipe benchmark run aws_compliance.benchmark.pci_dss_v40_requirement_10_7_1

Snapshot and share results via Turbot Pipes:

powerpipe benchmark run aws_compliance.benchmark.pci_dss_v40_requirement_10_7_1 --share

Controls

• API Gateway REST API stages should have AWS X-Ray tracing enabled
• CloudFormation stacks should have notifications enabled
• CloudWatch alarm should have an action configured
• EC2 instance detailed monitoring should be enabled
• Ensure a log metric filter and alarm exist for S3 bucket policy changes
• Ensure a log metric filter and alarm exist for CloudTrail configuration changes
• Ensure a log metric filter and alarm exist for AWS Config configuration changes
• Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
• Ensure a log metric filter and alarm exist for AWS Management Console sign-in without MFA
• Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer managed keys
• Ensure a log metric filter and alarm exist for IAM policy changes
• Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)
• Ensure a log metric filter and alarm exist for changes to network gateways
• Ensure a log metric filter and alarm exist for usage of 'root' account
• Ensure a log metric filter and alarm exist for route table changes
• Ensure a log metric filter and alarm exist for security group changes
• Ensure a log metric filter and alarm exist for unauthorized API calls
• Ensure a log metric filter and alarm exist for VPC changes
• AWS Security Hub should be enabled for an AWS Account
• Logging of delivery status should be enabled for notification messages sent to a topic
• AWS WAF rules should have CloudWatch metrics enabled

Tags