Loading controls...
Benchmark: Least Privilege (AC-6)
Description
The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-aws-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select Least Privilege (AC-6).
Run this benchmark in your terminal:
powerpipe benchmark run aws_compliance.benchmark.fedramp_moderate_rev_4_ac_6Snapshot and share results via Turbot Pipes:
powerpipe benchmark run aws_compliance.benchmark.fedramp_moderate_rev_4_ac_6 --shareBenchmarks
Controls
- CodeBuild project plaintext environment variables should not contain sensitive AWS values
- DMS replication instances should not be publicly accessible
- EBS snapshots should not be publicly restorable
- EC2 instances should be in a VPC
- EC2 instances should not have a public IP address
- EC2 instances should use IMDSv2
- EMR cluster master nodes should not have public IP addresses
- ES domains should be in a VPC
- IAM groups should have at least one user
- IAM policy should not have statements with admin access
- IAM root user should not have access keys
- IAM users should be in at least one group
- IAM user should not have any inline or attached policies
- IAM user credentials that have not been used in 90 days should be disabled
- Lambda functions should be in a VPC
- Lambda functions should restrict public access
- RDS DB instances should prohibit public access
- RDS snapshots should prohibit public access
- Redshift clusters should prohibit public access
- S3 buckets should prohibit public read access
- S3 buckets should prohibit public write access
- S3 public access should be blocked at account level
- S3 public access should be blocked at bucket levels
- SageMaker notebook instances should not have direct internet access
- VPC subnet auto assign public IP should be disabled