Configure Compliance Controls

[sam-goodwin]

Non-compliant

• [ ] The CloudWatch Log Group is not encrypted with an AWS KMS key
• [ ] The DynamoDB table does not have Point-in-time Recovery enabled
• [ ] The DynamoDB table is not in an AWS Backup plan
• [ ] The IAM Group, User, or Role contains an inline policy
• [ ] The Lambda function is not VPC enabled
• [ ] The Lambda function is not configured with a dead-letter configuration
• [ ] The Lambda function is not configured with function-level concurrent execution limits
• [ ] The OpenSearch Service domain does not have encryption at rest enabled
• [ ] The OpenSearch Service domain does not have node-to-node encryption enabled
• [ ] The OpenSearch Service domain does not stream error logs (ES_APPLICATION_LOGS) to CloudWatch Logs
• [ ] The OpenSearch Service domain is not running within a VPC
• [ ] The S3 Bucket does not have replication enabled
• [ ] The S3 Bucket does not have server access logs enabled
• [ ] The S3 Bucket does not have versioning enabled
• [ ] The S3 Bucket does not prohibit public read access through its Block Public Access configurations and bucket ACLs
• [ ] The S3 Bucket does not prohibit public write access through its Block Public Access configurations and bucket ACLs
• [ ] The S3 Bucket is not encrypted with a KMS Key by default
• [ ] The S3 Bucket or bucket policy does not require requests to use SSL

Compliant

• [ ] The CloudWatch Log Group does not have an explicit retention period configured
• [ ] The IAM Group, User, or Role contains an inline policy
• [ ] The IAM policy grants admin access, meaning the policy allows a principal to perform all actions on all resources
• [ ] The IAM policy grants full access, meaning the policy allows a principal to perform all actions on individual resources
• [ ] The IAM policy is attached at the user level
• [ ] The Lambda function is not configured with a dead-letter configuration
• [ ] The Lambda function permission grants public access
• [ ] The S3 bucket does not prohibit public access through bucket level settings
• [ ] The provisioned capacity DynamoDB table does not have Auto Scaling enabled on it's indexes