CGPulse

Sign In

Cloud Foundations Benchmark v3.0

AWS 34 automated checks

Cloud foundations security benchmark v3.0 — security best practices for cloud accounts

General

IAM root user must not have access keys 1.4 · Critical
IAM password policy must require minimum length of 14 1.8 · Medium
IAM password policy must require minimum length of 14 1.14 · Medium
IAM password policy must require minimum length of 14 1.16 · Medium
IAM password policy must require minimum length of 14 1.17 · Medium
S3 bucket must block all public access 2.1.1 · Critical
S3 bucket must have server-side encryption enabled 2.1.2 · High
S3 bucket must have versioning enabled 2.1.4 · High
CloudTrail must be enabled in all regions 3.1 · Critical
AWS Config must be enabled in all regions 4.16 · High
EFS file system must be encrypted at rest 2.4.1 · High

Identity and Access Management

IAM user must have MFA enabled 1.5 · Critical

Logging

CloudTrail trail must have log file validation enabled 3.2 · High
CloudTrail trail should be encrypted with a KMS key 3.4 · High
CloudWatch log group must have a retention period configured 3.7 · Medium
S3 bucket must have access logging enabled 3.8 · Medium

Monitoring

IAM password policy must require minimum length of 14 4.1 · Medium
IAM password policy must require minimum length of 14 4.3 · Medium
IAM password policy must require minimum length of 14 4.4 · Medium
IAM password policy must require minimum length of 14 4.5 · Medium
IAM password policy must require minimum length of 14 4.6 · Medium
IAM password policy must require minimum length of 14 4.8 · Medium
IAM password policy must require minimum length of 14 4.12 · Medium
IAM password policy must require minimum length of 14 4.14 · Medium

Networking

Security group must not allow unrestricted ingress (0.0.0.0/0) 5.1 · Critical
Security group must not allow unrestricted ingress (0.0.0.0/0) 5.2 · Critical
IAM password policy must require minimum length of 14 5.3 · Medium
VPC must have flow logs enabled 5.4 · High
EC2 instance must enforce IMDSv2 (metadata tokens required) 5.6 · High
Subnet should not auto-assign public IPs 5.5 · High

Storage

EBS volume must be encrypted 2.2.1 · High
RDS instance must have storage encryption enabled 2.3.1 · High
RDS instance must have auto minor version upgrade enabled 2.3.2 · Medium
RDS instance must not be publicly accessible 2.3.3 · Critical

Measure your Cloud Foundations Benchmark v3.0 posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation