Benchmark: 3.7.6 Where manual cleartext cryptographic keymanagement operations are performed by personnel, key-management policies and procedures are implemented, including managing these operations using split knowledge and dual control

Usage

Install the mod:

mkdir dashboards
cd dashboards
powerpipe mod init
powerpipe mod install github.com/turbot/steampipe-mod-aws-compliance

Start the Powerpipe server:

steampipe service start
powerpipe server

Open http://localhost:9033 in your browser and select 3.7.6 Where manual cleartext cryptographic keymanagement operations are performed by personnel, key-management policies and procedures are implemented, including managing these operations using split knowledge and dual control.

Run this benchmark in your terminal:

powerpipe benchmark run aws_compliance.benchmark.pci_dss_v40_requirement_3_7_6

Snapshot and share results via Turbot Pipes:

powerpipe benchmark run aws_compliance.benchmark.pci_dss_v40_requirement_3_7_6 --share

Controls

• ACM certificates should not expire within 30 days
• API Gateway stage should uses SSL certificate
• CloudFront distributions should use custom SSL/TLS certificates
• ELB application and network load balancers should only use SSL or HTTPS listeners
• ELB classic load balancers should use SSL certificates
• Ensure managed IAM policies should not allow blocked actions on KMS keys
• Ensure inline policies attached to IAM users, roles, and groups should not allow blocked actions on KMS keys
• KMS keys should not be pending deletion

Tags