Benchmark: 7.1 Data Storage - Damage Protection

Usage

Browse dashboards and select 7.1 Data Storage - Damage Protection:

steampipe dashboard

Or run the benchmarks in your terminal:

steampipe check aws_compliance.benchmark.gxp_eu_annex_11_operational_phase_7_1

Snapshot and share results via Steampipe Cloud:

steampipe login
steampipe check --share aws_compliance.benchmark.gxp_eu_annex_11_operational_phase_7_1

Controls

• API Gateway stage cache encryption at rest should be enabled
• CloudFront distributions should encrypt traffic to custom origins
• CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins
• CloudTrail trail logs should be encrypted with KMS CMK
• CodeBuild project artifact encryption should be enabled
• CodeBuild project S3 logs should be encrypted
• DynamoDB Accelerator (DAX) clusters should be encrypted at rest
• DynamoDB table should be encrypted with AWS KMS
• DynamoDB table should have encryption enabled
• DynamoDB tables should be in a backup plan
• DynamoDB table point-in-time recovery should be enabled
• Attached EBS volumes should have encryption enabled
• EBS volumes should be in a backup plan
• EBS default encryption should be enabled
• EC2 instance should have EBS optimization enabled
• EFS file system encryption at rest should be enabled
• EFS file systems should be in a backup plan
• EKS clusters should be configured to have kubernetes secrets encrypted using KMS
• ElastiCache Redis cluster automatic backup should be enabled with retention period of 15 days or greater
• ELB application and network load balancers should only use SSL or HTTPS listeners
• ES domain encryption at rest should be enabled
• Kinesis streams should have server side encryption enabled
• Log group encryption at rest should be enabled
• OpenSearch domains should have encryption at rest enabled
• OpenSearch domains should use HTTPS
• OpenSearch domains node-to-node encryption should be enabled
• RDS DB instance backup should be enabled
• RDS DB instance encryption at rest should be enabled
• RDS DB instances should be in a backup plan
• RDS DB snapshots should be encrypted at rest
• AWS Redshift clusters should have automatic snapshots enabled
• Redshift cluster audit logging and encryption should be enabled
• S3 bucket cross-region replication should be enabled
• S3 bucket default encryption should be enabled
• S3 bucket default encryption should be enabled with KMS
• S3 bucket versioning should be enabled
• SageMaker endpoint configuration encryption should be enabled
• SageMaker notebook instance encryption should be enabled
• Secrets Manager secrets should be encrypted using CMK
• SNS topics should be encrypted at rest

Tags