Skip to content

Commit a9e2dbe

Browse files
tyler-dunkeltyler-dunkel
authored
Merge pull request #110 from cloudgraphdev/feature/CG-1289-aws-cis-150-241
Feature/cg 1289 aws cis 150 241
2 parents 6328c5d + 85eb2c5 commit a9e2dbe

3 files changed

Lines changed: 98 additions & 0 deletions

File tree

‎src/aws/cis-1.5.0/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ Policy Pack based on the [AWS Foundations 1.5.0](https://drive.google.com/file/d
8787
| AWS CIS 2.3.1 | Ensure that encryption is enabled for RDS Instances |
8888
| AWS CIS 2.3.2 | Ensure Auto Minor Version Upgrade feature is Enabled for RDS Instances |
8989
| AWS CIS 2.3.3 | Ensure that public access is not given to RDS Instance |
90+
| AWS CIS 2.4.1 | Ensure that encryption is enabled for EFS file systems |
9091
| AWS CIS 3.1 | Ensure CloudTrail is enabled in all regions |
9192
| AWS CIS 3.2 | Ensure CloudTrail log file validation is enabled |
9293
| AWS CIS 3.3 | Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible |

‎src/aws/cis-1.5.0/rules/aws-cis-1.5.0-2.4.1.ts‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
export default {
2+
id: 'aws-cis-1.5.0-2.4.1',
3+
title: 'AWS CIS 2.4.1 Ensure that encryption is enabled for EFS file systems',
4+
5+
description: 'EFS data should be encrypted at rest using AWS KMS (Key Management Service).',
6+
7+
audit: `**From Console:**
8+
9+
1. Login to the AWS Management Console and Navigate to Elastic File System (EFS) dashboard.
10+
2. Select *File Systems* from the left navigation panel.
11+
3. Each item on the list has a visible Encrypted field that displays data at rest encryption status.
12+
4. Validate that this field reads *Encrypted* for all EFS file systems in all AWS regions.
13+
14+
**From CLI:**
15+
16+
1. Run describe-file-systems command using custom query filters to list the identifiers of all AWS EFS file systems currently available within the selected region:
17+
18+
aws efs describe-file-systems --region <region> --output table --query 'FileSystems[*].FileSystemId'
19+
20+
2. The command output should return a table with the requested file system IDs.
21+
3. Run describe-file-systems command using the ID of the file system that you want to examine as identifier and the necessary query filters:
22+
23+
aws efs describe-file-systems --region <region> --file-system-id <file-system-id from step 2 output> --query 'FileSystems[*].Encrypted'
24+
25+
4. The command output should return the file system encryption status true or false. If the returned value is *false*, the selected AWS EFS file system is not encrypted and if the returned value is *true*, the selected AWS EFS file system is encrypted.`,
26+
27+
rationale: 'Data should be encrypted at rest to reduce the risk of a data breach via direct access to the storage device.',
28+
29+
remediation: `**It is important to note that EFS file system data at rest encryption must be turned on when creating the file system.**
30+
31+
If an EFS file system has been created without data at rest encryption enabled then you must create another EFS file system with the correct configuration and transfer the data.
32+
33+
**Steps to create an EFS file system with data encrypted at rest:**
34+
35+
**From Console:**
36+
37+
1. Login to the AWS Management Console and Navigate to *Elastic File System (EFS)* dashboard.
38+
2. Select *File Systems* from the left navigation panel.
39+
3. Click *Create File System* button from the dashboard top menu to start the file system setup process.
40+
4. On the *Configure file system access* configuration page, perform the following actions.
41+
42+
• Choose the right VPC from the VPC dropdown list.
43+
• Within Create mount targets section, select the checkboxes for all of the Availability Zones (AZs) within the selected VPC. These will be your mount targets.
44+
• Click *Next step* to continue.
45+
46+
5. Perform the following on the *Configure optional settings* page.
47+
48+
• Create *tags* to describe your new file system.
49+
• Choose *performance mode* based on your requirements.
50+
• Check *Enable encryption* checkbox and choose *aws/elasticfilesystem* from Select KMS master key dropdown list to enable encryption for the new file system using the default master key provided and managed by AWS KMS.
51+
• Click *Next step* to continue.
52+
53+
6. Review the file system configuration details on the *review and create* page and then click *Create File System* to create your new AWS EFS file system.
54+
7. Copy the data from the old unencrypted EFS file system onto the newly create encrypted file system.
55+
8. Remove the unencrypted file system as soon as your data migration to the newly create encrypted file system is completed.
56+
9. Change the AWS region from the navigation bar and repeat the entire process for other aws regions.
57+
58+
**From CLI:**
59+
60+
1. Run describe-file-systems command to describe the configuration information available for the selected (unencrypted) file system (see Audit section to identify the right resource):
61+
62+
aws efs describe-file-systems --region <region> --file-system-id <file-system-id from audit section step 2 output>
63+
64+
2. The command output should return the requested configuration information.
65+
3. To provision a new AWS EFS file system, you need to generate a universally unique identifier (UUID) in order to create the token required by the create-file- system command. To create the required token, you can use a randomly generated UUID from "https://www.uuidgenerator.net".
66+
4. Run create-file-system command using the unique token created at the previous step.
67+
68+
aws efs create-file-system --region <region> --creation-token <Token (randomly generated UUID from step 3)> --performance-mode generalPurpose --encrypted
69+
70+
5. The command output should return the new file system configuration metadata.
71+
6. Run create-mount-target command using the newly created EFS file system ID returned at the previous step as identifier and the ID of the Availability Zone (AZ) that will represent the mount target:
72+
73+
aws efs create-mount-target --region <region> --file-system-id <file-system-id> --subnet-id <subnet-id>
74+
75+
7. The command output should return the new mount target metadata.
76+
8. Now you can mount your file system from an EC2 instance.
77+
9. Copy the data from the old unencrypted EFS file system onto the newly create encrypted file system.
78+
10.Remove the unencrypted file system as soon as your data migration to the newly
79+
create encrypted file system is completed.
80+
81+
aws efs delete-file-system --region <region> --file-system-id <unencrypted-file-system-id>
82+
83+
11.Change the AWS region by updating the --region and repeat the entire process for other aws regions.
84+
85+
**Default Value:**
86+
87+
EFS file system data is encrypted at rest by default when creating a file system via the Console. Encryption at rest is not enabled by default when creating a new file system using the AWS CLI, API, and SDKs.`,
88+
89+
references: [
90+
'https://docs.aws.amazon.com/efs/latest/ug/encryption-at-rest.html',
91+
'https://awscli.amazonaws.com/v2/documentation/api/latest/reference/efs/index.html#efs',
92+
],
93+
94+
severity: 'high',
95+
}

‎src/aws/cis-1.5.0/rules/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import Aws_CIS_150_221 from './aws-cis-1.5.0-2.2.1'
2828
import Aws_CIS_150_231 from './aws-cis-1.5.0-2.3.1'
2929
import Aws_CIS_150_232 from './aws-cis-1.5.0-2.3.2'
3030
import Aws_CIS_150_233 from './aws-cis-1.5.0-2.3.3'
31+
import Aws_CIS_150_241 from './aws-cis-1.5.0-2.4.1'
3132
import Aws_CIS_150_31 from './aws-cis-1.5.0-3.1'
3233
import Aws_CIS_150_32 from './aws-cis-1.5.0-3.2'
3334
import Aws_CIS_150_33 from './aws-cis-1.5.0-3.3'
@@ -91,6 +92,7 @@ export default [
9192
Aws_CIS_150_231,
9293
Aws_CIS_150_232,
9394
Aws_CIS_150_233,
95+
Aws_CIS_150_241,
9496
Aws_CIS_150_31,
9597
Aws_CIS_150_32,
9698
Aws_CIS_150_33,

0 commit comments

Comments
 (0)