templates/AwsBiotechBlueprint.template.quickstart.yml [1454:1908]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      DeliveryS3KeyPrefix: Operational-Best-Practices-for-NIST-CSF
      TemplateBody: "##################################################################################\n\
        #\n#   Conformance Pack:\n#     Operational Best Practices for NIST CSF\n\
        #\n#   This conformance pack helps verify compliance with NIST CSF requirements.\n\
        #                                                                        \
        \         \n#   This Conformance Pack has been designed for compatibility\
        \ with the majority of AWS \n#   regions and to not require setting of any\
        \ Parameters. Additional managed rules that \n#   require parameters to be\
        \ set for your environment and/or for your specific region can \n#   be found\
        \ at https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html\n\
        #\n#   See Parameters section for names and descriptions of required parameters.\
        \ \n#\n##################################################################################\n\
        \nParameters:\n  AccessKeysRotatedParamMaxAccessKeyAge:\n    Default: '90'\n\
        \    Type: String\n  AcmCertificateExpirationCheckParamDaysToExpiration:\n\
        \    Default: '90'\n    Type: String\n  GuarddutyNonArchivedFindingsParamDaysHighSev:\n\
        \    Default: '1'\n    Type: String\n  GuarddutyNonArchivedFindingsParamDaysLowSev:\n\
        \    Default: '30'\n    Type: String\n  GuarddutyNonArchivedFindingsParamDaysMediumSev:\n\
        \    Default: '7'\n    Type: String\n  IamPasswordPolicyParamMaxPasswordAge:\n\
        \    Default: '90'\n    Type: String\n  IamPasswordPolicyParamMinimumPasswordLength:\n\
        \    Default: '14'\n    Type: String\n  IamPasswordPolicyParamPasswordReusePrevention:\n\
        \    Default: '24'\n    Type: String\n  IamPasswordPolicyParamRequireLowercaseCharacters:\n\
        \    Default: 'TRUE'\n    Type: String\n  IamPasswordPolicyParamRequireNumbers:\n\
        \    Default: 'TRUE'\n    Type: String\n  IamPasswordPolicyParamRequireSymbols:\n\
        \    Default: 'TRUE'\n    Type: String\n  IamPasswordPolicyParamRequireUppercaseCharacters:\n\
        \    Default: 'TRUE'\n    Type: String\n  IamUserUnusedCredentialsCheckParamMaxCredentialUsageAge:\n\
        \    Default: '90'\n    Type: String\n  RestrictedIncomingTrafficParamBlockedPort1:\n\
        \    Default: '20'\n    Type: String\n  RestrictedIncomingTrafficParamBlockedPort2:\n\
        \    Default: '21'\n    Type: String\n  RestrictedIncomingTrafficParamBlockedPort3:\n\
        \    Default: '3389'\n    Type: String\n  RestrictedIncomingTrafficParamBlockedPort4:\n\
        \    Default: '3306'\n    Type: String\n  RestrictedIncomingTrafficParamBlockedPort5:\n\
        \    Default: '4333'\n    Type: String\n  S3AccountLevelPublicAccessBlocksParamBlockPublicAcls:\n\
        \    Default: 'True'\n    Type: String\n  S3AccountLevelPublicAccessBlocksParamBlockPublicPolicy:\n\
        \    Default: 'True'\n    Type: String\n  S3AccountLevelPublicAccessBlocksParamIgnorePublicAcls:\n\
        \    Default: 'True'\n    Type: String\n  S3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets:\n\
        \    Default: 'True'\n    Type: String\nResources:\n  AccessKeysRotated:\n\
        \    Properties:\n      ConfigRuleName: access-keys-rotated\n      InputParameters:\n\
        \        maxAccessKeyAge:\n          Fn::If:\n          - accessKeysRotatedParamMaxAccessKeyAge\n\
        \          - Ref: AccessKeysRotatedParamMaxAccessKeyAge\n          - Ref:\
        \ AWS::NoValue\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ ACCESS_KEYS_ROTATED\n    Type: AWS::Config::ConfigRule\n  AcmCertificateExpirationCheck:\n\
        \    Properties:\n      ConfigRuleName: acm-certificate-expiration-check\n\
        \      InputParameters:\n        daysToExpiration:\n          Fn::If:\n  \
        \        - acmCertificateExpirationCheckParamDaysToExpiration\n          -\
        \ Ref: AcmCertificateExpirationCheckParamDaysToExpiration\n          - Ref:\
        \ AWS::NoValue\n      Scope:\n        ComplianceResourceTypes:\n        -\
        \ AWS::ACM::Certificate\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ ACM_CERTIFICATE_EXPIRATION_CHECK\n    Type: AWS::Config::ConfigRule\n  AlbHttpToHttpsRedirectionCheck:\n\
        \    Properties:\n      ConfigRuleName: alb-http-to-https-redirection-check\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  ApiGwCacheEnabledAndEncrypted:\n   \
        \ Properties:\n      ConfigRuleName: api-gw-cache-enabled-and-encrypted\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::ApiGateway::Stage\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: API_GW_CACHE_ENABLED_AND_ENCRYPTED\n\
        \    Type: AWS::Config::ConfigRule\n  ApiGwExecutionLoggingEnabled:\n    Properties:\n\
        \      ConfigRuleName: api-gw-execution-logging-enabled\n      Scope:\n  \
        \      ComplianceResourceTypes:\n        - AWS::ApiGateway::Stage\n      \
        \  - AWS::ApiGatewayV2::Stage\n      Source:\n        Owner: AWS\n       \
        \ SourceIdentifier: API_GW_EXECUTION_LOGGING_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  AutoscalingGroupElbHealthcheckRequired:\n    Properties:\n      ConfigRuleName:\
        \ autoscaling-group-elb-healthcheck-required\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::AutoScaling::AutoScalingGroup\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: AUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIRED\n\
        \    Type: AWS::Config::ConfigRule\n  CloudTrailCloudWatchLogsEnabled:\n \
        \   Properties:\n      ConfigRuleName: cloud-trail-cloud-watch-logs-enabled\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  CloudTrailEnabled:\n    Properties:\n\
        \      ConfigRuleName: cloudtrail-enabled\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: CLOUD_TRAIL_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  CloudTrailEncryptionEnabled:\n    Properties:\n      ConfigRuleName: cloud-trail-encryption-enabled\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CLOUD_TRAIL_ENCRYPTION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  CloudTrailLogFileValidationEnabled:\n\
        \    Properties:\n      ConfigRuleName: cloud-trail-log-file-validation-enabled\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  CloudtrailS3DataeventsEnabled:\n   \
        \ Properties:\n      ConfigRuleName: cloudtrail-s3-dataevents-enabled\n  \
        \    Source:\n        Owner: AWS\n        SourceIdentifier: CLOUDTRAIL_S3_DATAEVENTS_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  CloudwatchAlarmActionCheck:\n    Properties:\n\
        \      ConfigRuleName: cloudwatch-alarm-action-check\n      InputParameters:\n\
        \        alarmActionRequired: 'TRUE'\n        insufficientDataActionRequired:\
        \ 'TRUE'\n        okActionRequired: 'FALSE'\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::CloudWatch::Alarm\n      Source:\n        Owner: AWS\n   \
        \     SourceIdentifier: CLOUDWATCH_ALARM_ACTION_CHECK\n    Type: AWS::Config::ConfigRule\n\
        \  CloudwatchLogGroupEncrypted:\n    Properties:\n      ConfigRuleName: cloudwatch-log-group-encrypted\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CLOUDWATCH_LOG_GROUP_ENCRYPTED\n\
        \    Type: AWS::Config::ConfigRule\n  CodebuildProjectEnvvarAwscredCheck:\n\
        \    Properties:\n      ConfigRuleName: codebuild-project-envvar-awscred-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::CodeBuild::Project\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CODEBUILD_PROJECT_ENVVAR_AWSCRED_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  CodebuildProjectSourceRepoUrlCheck:\n\
        \    Properties:\n      ConfigRuleName: codebuild-project-source-repo-url-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::CodeBuild::Project\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CODEBUILD_PROJECT_SOURCE_REPO_URL_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  DbInstanceBackupEnabled:\n    Properties:\n\
        \      ConfigRuleName: db-instance-backup-enabled\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::RDS::DBInstance\n      Source:\n        Owner: AWS\n     \
        \   SourceIdentifier: DB_INSTANCE_BACKUP_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  DmsReplicationNotPublic:\n    Properties:\n      ConfigRuleName: dms-replication-not-public\n\
        \      Scope:\n        ComplianceResourceTypes: []\n      Source:\n      \
        \  Owner: AWS\n        SourceIdentifier: DMS_REPLICATION_NOT_PUBLIC\n    Type:\
        \ AWS::Config::ConfigRule\n  DynamodbAutoscalingEnabled:\n    Properties:\n\
        \      ConfigRuleName: dynamodb-autoscaling-enabled\n      Scope:\n      \
        \  ComplianceResourceTypes:\n        - AWS::DynamoDB::Table\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: DYNAMODB_AUTOSCALING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  DynamodbPitrEnabled:\n    Properties:\n\
        \      ConfigRuleName: dynamodb-pitr-enabled\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::DynamoDB::Table\n      Source:\n        Owner: AWS\n     \
        \   SourceIdentifier: DYNAMODB_PITR_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  DynamodbThroughputLimitCheck:\n    Properties:\n      ConfigRuleName: dynamodb-throughput-limit-check\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: DYNAMODB_THROUGHPUT_LIMIT_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  EbsOptimizedInstance:\n    Properties:\n\
        \      ConfigRuleName: ebs-optimized-instance\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::EC2::Instance\n      Source:\n        Owner: AWS\n       \
        \ SourceIdentifier: EBS_OPTIMIZED_INSTANCE\n    Type: AWS::Config::ConfigRule\n\
        \  EbsSnapshotPublicRestorableCheck:\n    Properties:\n      ConfigRuleName:\
        \ ebs-snapshot-public-restorable-check\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK\n    Type:\
        \ AWS::Config::ConfigRule\n  Ec2InstanceDetailedMonitoringEnabled:\n    Properties:\n\
        \      ConfigRuleName: ec2-instance-detailed-monitoring-enabled\n      Scope:\n\
        \        ComplianceResourceTypes:\n        - AWS::EC2::Instance\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: EC2_INSTANCE_DETAILED_MONITORING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  Ec2InstanceManagedBySsm:\n    Properties:\n\
        \      ConfigRuleName: ec2-instance-managed-by-systems-manager\n      Scope:\n\
        \        ComplianceResourceTypes:\n        - AWS::EC2::Instance\n        -\
        \ AWS::SSM::ManagedInstanceInventory\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: EC2_INSTANCE_MANAGED_BY_SSM\n    Type: AWS::Config::ConfigRule\n\
        \  Ec2InstanceNoPublicIp:\n    Properties:\n      ConfigRuleName: ec2-instance-no-public-ip\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::Instance\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: EC2_INSTANCE_NO_PUBLIC_IP\n\
        \    Type: AWS::Config::ConfigRule\n  Ec2ManagedinstanceAssociationComplianceStatusCheck:\n\
        \    Properties:\n      ConfigRuleName: ec2-managedinstance-association-compliance-status-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SSM::AssociationCompliance\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: EC2_MANAGEDINSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  Ec2ManagedinstancePatchComplianceStatusCheck:\n\
        \    Properties:\n      ConfigRuleName: ec2-managedinstance-patch-compliance-status-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SSM::PatchCompliance\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: EC2_MANAGEDINSTANCE_PATCH_COMPLIANCE_STATUS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  Ec2SecurityGroupAttachedToEni:\n   \
        \ Properties:\n      ConfigRuleName: ec2-security-group-attached-to-eni\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::SecurityGroup\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: EC2_SECURITY_GROUP_ATTACHED_TO_ENI\n\
        \    Type: AWS::Config::ConfigRule\n  Ec2StoppedInstance:\n    Properties:\n\
        \      ConfigRuleName: ec2-stopped-instance\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: EC2_STOPPED_INSTANCE\n    Type: AWS::Config::ConfigRule\n\
        \  Ec2VolumeInuseCheck:\n    Properties:\n      ConfigRuleName: ec2-volume-inuse-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::Volume\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: EC2_VOLUME_INUSE_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  EfsEncryptedCheck:\n    Properties:\n\
        \      ConfigRuleName: efs-encrypted-check\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: EFS_ENCRYPTED_CHECK\n    Type: AWS::Config::ConfigRule\n\
        \  EipAttached:\n    Properties:\n      ConfigRuleName: eip-attached\n   \
        \   Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::EIP\n  \
        \    Source:\n        Owner: AWS\n        SourceIdentifier: EIP_ATTACHED\n\
        \    Type: AWS::Config::ConfigRule\n  ElasticacheRedisClusterAutomaticBackupCheck:\n\
        \    Properties:\n      ConfigRuleName: elasticache-redis-cluster-automatic-backup-check\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: ELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  ElasticsearchEncryptedAtRest:\n    Properties:\n\
        \      ConfigRuleName: elasticsearch-encrypted-at-rest\n      Source:\n  \
        \      Owner: AWS\n        SourceIdentifier: ELASTICSEARCH_ENCRYPTED_AT_REST\n\
        \    Type: AWS::Config::ConfigRule\n  ElasticsearchInVpcOnly:\n    Properties:\n\
        \      ConfigRuleName: elasticsearch-in-vpc-only\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: ELASTICSEARCH_IN_VPC_ONLY\n    Type: AWS::Config::ConfigRule\n\
        \  ElbAcmCertificateRequired:\n    Properties:\n      ConfigRuleName: elb-acm-certificate-required\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::ElasticLoadBalancing::LoadBalancer\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: ELB_ACM_CERTIFICATE_REQUIRED\n\
        \    Type: AWS::Config::ConfigRule\n  ElbDeletionProtectionEnabled:\n    Properties:\n\
        \      ConfigRuleName: elb-deletion-protection-enabled\n      Scope:\n   \
        \     ComplianceResourceTypes:\n        - AWS::ElasticLoadBalancingV2::LoadBalancer\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: ELB_DELETION_PROTECTION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  ElbLoggingEnabled:\n    Properties:\n\
        \      ConfigRuleName: elb-logging-enabled\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::ElasticLoadBalancing::LoadBalancer\n        - AWS::ElasticLoadBalancingV2::LoadBalancer\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: ELB_LOGGING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  EmrKerberosEnabled:\n    Properties:\n\
        \      ConfigRuleName: emr-kerberos-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: EMR_KERBEROS_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  EmrMasterNoPublicIp:\n    Properties:\n      ConfigRuleName: emr-master-no-public-ip\n\
        \      Scope:\n        ComplianceResourceTypes: []\n      Source:\n      \
        \  Owner: AWS\n        SourceIdentifier: EMR_MASTER_NO_PUBLIC_IP\n    Type:\
        \ AWS::Config::ConfigRule\n  EncryptedVolumes:\n    Properties:\n      ConfigRuleName:\
        \ encrypted-volumes\n      Scope:\n        ComplianceResourceTypes:\n    \
        \    - AWS::EC2::Volume\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ ENCRYPTED_VOLUMES\n    Type: AWS::Config::ConfigRule\n  GuarddutyEnabledCentralized:\n\
        \    Properties:\n      ConfigRuleName: guardduty-enabled-centralized\n  \
        \    Source:\n        Owner: AWS\n        SourceIdentifier: GUARDDUTY_ENABLED_CENTRALIZED\n\
        \    Type: AWS::Config::ConfigRule\n  GuarddutyNonArchivedFindings:\n    Properties:\n\
        \      ConfigRuleName: guardduty-non-archived-findings\n      InputParameters:\n\
        \        daysHighSev:\n          Fn::If:\n          - guarddutyNonArchivedFindingsParamDaysHighSev\n\
        \          - Ref: GuarddutyNonArchivedFindingsParamDaysHighSev\n         \
        \ - Ref: AWS::NoValue\n        daysLowSev:\n          Fn::If:\n          -\
        \ guarddutyNonArchivedFindingsParamDaysLowSev\n          - Ref: GuarddutyNonArchivedFindingsParamDaysLowSev\n\
        \          - Ref: AWS::NoValue\n        daysMediumSev:\n          Fn::If:\n\
        \          - guarddutyNonArchivedFindingsParamDaysMediumSev\n          - Ref:\
        \ GuarddutyNonArchivedFindingsParamDaysMediumSev\n          - Ref: AWS::NoValue\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: GUARDDUTY_NON_ARCHIVED_FINDINGS\n\
        \    Type: AWS::Config::ConfigRule\n  IamGroupHasUsersCheck:\n    Properties:\n\
        \      ConfigRuleName: iam-group-has-users-check\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::IAM::Group\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ IAM_GROUP_HAS_USERS_CHECK\n    Type: AWS::Config::ConfigRule\n  IamPasswordPolicy:\n\
        \    Properties:\n      ConfigRuleName: iam-password-policy\n      InputParameters:\n\
        \        MaxPasswordAge:\n          Fn::If:\n          - iamPasswordPolicyParamMaxPasswordAge\n\
        \          - Ref: IamPasswordPolicyParamMaxPasswordAge\n          - Ref: AWS::NoValue\n\
        \        MinimumPasswordLength:\n          Fn::If:\n          - iamPasswordPolicyParamMinimumPasswordLength\n\
        \          - Ref: IamPasswordPolicyParamMinimumPasswordLength\n          -\
        \ Ref: AWS::NoValue\n        PasswordReusePrevention:\n          Fn::If:\n\
        \          - iamPasswordPolicyParamPasswordReusePrevention\n          - Ref:\
        \ IamPasswordPolicyParamPasswordReusePrevention\n          - Ref: AWS::NoValue\n\
        \        RequireLowercaseCharacters:\n          Fn::If:\n          - iamPasswordPolicyParamRequireLowercaseCharacters\n\
        \          - Ref: IamPasswordPolicyParamRequireLowercaseCharacters\n     \
        \     - Ref: AWS::NoValue\n        RequireNumbers:\n          Fn::If:\n  \
        \        - iamPasswordPolicyParamRequireNumbers\n          - Ref: IamPasswordPolicyParamRequireNumbers\n\
        \          - Ref: AWS::NoValue\n        RequireSymbols:\n          Fn::If:\n\
        \          - iamPasswordPolicyParamRequireSymbols\n          - Ref: IamPasswordPolicyParamRequireSymbols\n\
        \          - Ref: AWS::NoValue\n        RequireUppercaseCharacters:\n    \
        \      Fn::If:\n          - iamPasswordPolicyParamRequireUppercaseCharacters\n\
        \          - Ref: IamPasswordPolicyParamRequireUppercaseCharacters\n     \
        \     - Ref: AWS::NoValue\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ IAM_PASSWORD_POLICY\n    Type: AWS::Config::ConfigRule\n  IamPolicyNoStatementsWithAdminAccess:\n\
        \    Properties:\n      ConfigRuleName: iam-policy-no-statements-with-admin-access\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::IAM::Policy\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS\n\
        \    Type: AWS::Config::ConfigRule\n  IamRootAccessKeyCheck:\n    Properties:\n\
        \      ConfigRuleName: iam-root-access-key-check\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: IAM_ROOT_ACCESS_KEY_CHECK\n    Type: AWS::Config::ConfigRule\n\
        \  IamUserGroupMembershipCheck:\n    Properties:\n      ConfigRuleName: iam-user-group-membership-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::IAM::User\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_USER_GROUP_MEMBERSHIP_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  IamUserMfaEnabled:\n    Properties:\n\
        \      ConfigRuleName: iam-user-mfa-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: IAM_USER_MFA_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  IamUserNoPoliciesCheck:\n    Properties:\n      ConfigRuleName: iam-user-no-policies-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::IAM::User\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_USER_NO_POLICIES_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  IamUserUnusedCredentialsCheck:\n   \
        \ Properties:\n      ConfigRuleName: iam-user-unused-credentials-check\n \
        \     InputParameters:\n        maxCredentialUsageAge:\n          Fn::If:\n\
        \          - iamUserUnusedCredentialsCheckParamMaxCredentialUsageAge\n   \
        \       - Ref: IamUserUnusedCredentialsCheckParamMaxCredentialUsageAge\n \
        \         - Ref: AWS::NoValue\n      Source:\n        Owner: AWS\n       \
        \ SourceIdentifier: IAM_USER_UNUSED_CREDENTIALS_CHECK\n    Type: AWS::Config::ConfigRule\n\
        \  IncomingSshDisabled:\n    Properties:\n      ConfigRuleName: restricted-ssh\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::SecurityGroup\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: INCOMING_SSH_DISABLED\n\
        \    Type: AWS::Config::ConfigRule\n  InstancesInVpc:\n    Properties:\n \
        \     ConfigRuleName: ec2-instances-in-vpc\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::EC2::Instance\n      Source:\n        Owner: AWS\n       \
        \ SourceIdentifier: INSTANCES_IN_VPC\n    Type: AWS::Config::ConfigRule\n\
        \  InternetGatewayAuthorizedVpcOnly:\n    Properties:\n      ConfigRuleName:\
        \ internet-gateway-authorized-vpc-only\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::EC2::InternetGateway\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: INTERNET_GATEWAY_AUTHORIZED_VPC_ONLY\n    Type:\
        \ AWS::Config::ConfigRule\n  KmsCmkNotScheduledForDeletion:\n    Properties:\n\
        \      ConfigRuleName: kms-cmk-not-scheduled-for-deletion\n      Scope:\n\
        \        ComplianceResourceTypes:\n        - AWS::KMS::Key\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: KMS_CMK_NOT_SCHEDULED_FOR_DELETION\n\
        \    Type: AWS::Config::ConfigRule\n  LambdaConcurrencyCheck:\n    Properties:\n\
        \      ConfigRuleName: lambda-concurrency-check\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::Lambda::Function\n      Source:\n        Owner: AWS\n    \
        \    SourceIdentifier: LAMBDA_CONCURRENCY_CHECK\n    Type: AWS::Config::ConfigRule\n\
        \  LambdaDlqCheck:\n    Properties:\n      ConfigRuleName: lambda-dlq-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::Lambda::Function\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: LAMBDA_DLQ_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  LambdaFunctionPublicAccessProhibited:\n\
        \    Properties:\n      ConfigRuleName: lambda-function-public-access-prohibited\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::Lambda::Function\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED\n\
        \    Type: AWS::Config::ConfigRule\n  LambdaInsideVpc:\n    Properties:\n\
        \      ConfigRuleName: lambda-inside-vpc\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::Lambda::Function\n      Source:\n        Owner: AWS\n    \
        \    SourceIdentifier: LAMBDA_INSIDE_VPC\n    Type: AWS::Config::ConfigRule\n\
        \  MfaEnabledForIamConsoleAccess:\n    Properties:\n      ConfigRuleName:\
        \ mfa-enabled-for-iam-console-access\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS\n    Type: AWS::Config::ConfigRule\n\
        \  MultiRegionCloudTrailEnabled:\n    Properties:\n      ConfigRuleName: multi-region-cloudtrail-enabled\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: MULTI_REGION_CLOUD_TRAIL_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  RdsEnhancedMonitoringEnabled:\n    Properties:\n\
        \      ConfigRuleName: rds-enhanced-monitoring-enabled\n      Scope:\n   \
        \     ComplianceResourceTypes:\n        - AWS::RDS::DBInstance\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: RDS_ENHANCED_MONITORING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  RdsInstancePublicAccessCheck:\n    Properties:\n\
        \      ConfigRuleName: rds-instance-public-access-check\n      Scope:\n  \
        \      ComplianceResourceTypes:\n        - AWS::RDS::DBInstance\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: RDS_INSTANCE_PUBLIC_ACCESS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  RdsMultiAzSupport:\n    Properties:\n\
        \      ConfigRuleName: rds-multi-az-support\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::RDS::DBInstance\n      Source:\n        Owner: AWS\n     \
        \   SourceIdentifier: RDS_MULTI_AZ_SUPPORT\n    Type: AWS::Config::ConfigRule\n\
        \  RdsSnapshotsPublicProhibited:\n    Properties:\n      ConfigRuleName: rds-snapshots-public-prohibited\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::RDS::DBSnapshot\n\
        \        - AWS::RDS::DBClusterSnapshot\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: RDS_SNAPSHOTS_PUBLIC_PROHIBITED\n    Type: AWS::Config::ConfigRule\n\
        \  RdsStorageEncrypted:\n    Properties:\n      ConfigRuleName: rds-storage-encrypted\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::RDS::DBInstance\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: RDS_STORAGE_ENCRYPTED\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftClusterConfigurationCheck:\n\
        \    Properties:\n      ConfigRuleName: redshift-cluster-configuration-check\n\
        \      InputParameters:\n        clusterDbEncrypted: 'TRUE'\n        loggingEnabled:\
        \ 'TRUE'\n      Scope:\n        ComplianceResourceTypes:\n        - AWS::Redshift::Cluster\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: REDSHIFT_CLUSTER_CONFIGURATION_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftClusterPublicAccessCheck:\n\
        \    Properties:\n      ConfigRuleName: redshift-cluster-public-access-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::Redshift::Cluster\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftRequireTlsSsl:\n    Properties:\n\
        \      ConfigRuleName: redshift-require-tls-ssl\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::Redshift::Cluster\n      Source:\n        Owner: AWS\n   \
        \     SourceIdentifier: REDSHIFT_REQUIRE_TLS_SSL\n    Type: AWS::Config::ConfigRule\n\
        \  RestrictedIncomingTraffic:\n    Properties:\n      ConfigRuleName: restricted-common-ports\n\
        \      InputParameters:\n        blockedPort1:\n          Fn::If:\n      \
        \    - restrictedIncomingTrafficParamBlockedPort1\n          - Ref: RestrictedIncomingTrafficParamBlockedPort1\n\
        \          - Ref: AWS::NoValue\n        blockedPort2:\n          Fn::If:\n\
        \          - restrictedIncomingTrafficParamBlockedPort2\n          - Ref:\
        \ RestrictedIncomingTrafficParamBlockedPort2\n          - Ref: AWS::NoValue\n\
        \        blockedPort3:\n          Fn::If:\n          - restrictedIncomingTrafficParamBlockedPort3\n\
        \          - Ref: RestrictedIncomingTrafficParamBlockedPort3\n          -\
        \ Ref: AWS::NoValue\n        blockedPort4:\n          Fn::If:\n          -\
        \ restrictedIncomingTrafficParamBlockedPort4\n          - Ref: RestrictedIncomingTrafficParamBlockedPort4\n\
        \          - Ref: AWS::NoValue\n        blockedPort5:\n          Fn::If:\n\
        \          - restrictedIncomingTrafficParamBlockedPort5\n          - Ref:\
        \ RestrictedIncomingTrafficParamBlockedPort5\n          - Ref: AWS::NoValue\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::SecurityGroup\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: RESTRICTED_INCOMING_TRAFFIC\n\
        \    Type: AWS::Config::ConfigRule\n  RootAccountHardwareMfaEnabled:\n   \
        \ Properties:\n      ConfigRuleName: root-account-hardware-mfa-enabled\n \
        \     Source:\n        Owner: AWS\n        SourceIdentifier: ROOT_ACCOUNT_HARDWARE_MFA_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  RootAccountMfaEnabled:\n    Properties:\n\
        \      ConfigRuleName: root-account-mfa-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  S3AccountLevelPublicAccessBlocks:\n    Properties:\n      ConfigRuleName:\
        \ s3-account-level-public-access-blocks\n      InputParameters:\n        BlockPublicAcls:\n\
        \          Fn::If:\n          - s3AccountLevelPublicAccessBlocksParamBlockPublicAcls\n\
        \          - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicAcls\n \
        \         - Ref: AWS::NoValue\n        BlockPublicPolicy:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamBlockPublicPolicy\n    \
        \      - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicPolicy\n   \
        \       - Ref: AWS::NoValue\n        IgnorePublicAcls:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamIgnorePublicAcls\n     \
        \     - Ref: S3AccountLevelPublicAccessBlocksParamIgnorePublicAcls\n     \
        \     - Ref: AWS::NoValue\n        RestrictPublicBuckets:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets\n\
        \          - Ref: S3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets\n\
        \          - Ref: AWS::NoValue\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::S3::AccountPublicAccessBlock\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS\n \
        \   Type: AWS::Config::ConfigRule\n  S3BucketDefaultLockEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-default-lock-enabled\n      Scope:\n    \
        \    ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: S3_BUCKET_DEFAULT_LOCK_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketLoggingEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-logging-enabled\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::S3::Bucket\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ S3_BUCKET_LOGGING_ENABLED\n    Type: AWS::Config::ConfigRule\n  S3BucketPolicyGranteeCheck:\n\
        \    Properties:\n      ConfigRuleName: s3-bucket-policy-grantee-check\n \
        \     Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_POLICY_GRANTEE_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketPublicReadProhibited:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-public-read-prohibited\n      Scope:\n  \
        \      ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketPublicWriteProhibited:\n   \
        \ Properties:\n      ConfigRuleName: s3-bucket-public-write-prohibited\n \
        \     Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketReplicationEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-replication-enabled\n      Scope:\n     \
        \   ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n \
        \       Owner: AWS\n        SourceIdentifier: S3_BUCKET_REPLICATION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketServerSideEncryptionEnabled:\n\
        \    Properties:\n      ConfigRuleName: s3-bucket-server-side-encryption-enabled\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketSslRequestsOnly:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-ssl-requests-only\n      Scope:\n       \
        \ ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n   \
        \     Owner: AWS\n        SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketVersioningEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-versioning-enabled\n      Scope:\n      \
        \  ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n  \
        \      Owner: AWS\n        SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerEndpointConfigurationKmsKeyConfigured:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-endpoint-configuration-kms-key-configured\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGURED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerNotebookInstanceKmsKeyConfigured:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-notebook-instance-kms-key-configured\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGURED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerNotebookNoDirectInternetAccess:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-notebook-no-direct-internet-access\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS\n\
        \    Type: AWS::Config::ConfigRule\n  SecretsmanagerRotationEnabledCheck:\n\
        \    Properties:\n      ConfigRuleName: secretsmanager-rotation-enabled-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SecretsManager::Secret\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SECRETSMANAGER_ROTATION_ENABLED_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  SecretsmanagerScheduledRotationSuccessCheck:\n\
        \    Properties:\n      ConfigRuleName: secretsmanager-scheduled-rotation-success-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SecretsManager::Secret\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SECRETSMANAGER_SCHEDULED_ROTATION_SUCCESS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  SecurityhubEnabled:\n    Properties:\n\
        \      ConfigRuleName: securityhub-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: SECURITYHUB_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  SnsEncryptedKms:\n    Properties:\n      ConfigRuleName: sns-encrypted-kms\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SNS::Topic\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SNS_ENCRYPTED_KMS\n\
        \    Type: AWS::Config::ConfigRule\n  VpcDefaultSecurityGroupClosed:\n   \
        \ Properties:\n      ConfigRuleName: vpc-default-security-group-closed\n \
        \     Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::SecurityGroup\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: VPC_DEFAULT_SECURITY_GROUP_CLOSED\n\
        \    Type: AWS::Config::ConfigRule\n  VpcFlowLogsEnabled:\n    Properties:\n\
        \      ConfigRuleName: vpc-flow-logs-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: VPC_FLOW_LOGS_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  VpcSgOpenOnlyToAuthorizedPorts:\n    Properties:\n      ConfigRuleName:\
        \ vpc-sg-open-only-to-authorized-ports\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::EC2::SecurityGroup\n      Source:\n        Owner: AWS\n  \
        \      SourceIdentifier: VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS\n    Type: AWS::Config::ConfigRule\n\
        \  VpcVpn2TunnelsUp:\n    Properties:\n      ConfigRuleName: vpc-vpn-2-tunnels-up\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::VPNConnection\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: VPC_VPN_2_TUNNELS_UP\n\
        \    Type: AWS::Config::ConfigRule\nConditions:\n  accessKeysRotatedParamMaxAccessKeyAge:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: AccessKeysRotatedParamMaxAccessKeyAge\n\
        \  acmCertificateExpirationCheckParamDaysToExpiration:\n    Fn::Not:\n   \
        \ - Fn::Equals:\n      - ''\n      - Ref: AcmCertificateExpirationCheckParamDaysToExpiration\n\
        \  guarddutyNonArchivedFindingsParamDaysHighSev:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: GuarddutyNonArchivedFindingsParamDaysHighSev\n \
        \ guarddutyNonArchivedFindingsParamDaysLowSev:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: GuarddutyNonArchivedFindingsParamDaysLowSev\n  guarddutyNonArchivedFindingsParamDaysMediumSev:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: GuarddutyNonArchivedFindingsParamDaysMediumSev\n\
        \  iamPasswordPolicyParamMaxPasswordAge:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: IamPasswordPolicyParamMaxPasswordAge\n  iamPasswordPolicyParamMinimumPasswordLength:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: IamPasswordPolicyParamMinimumPasswordLength\n\
        \  iamPasswordPolicyParamPasswordReusePrevention:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: IamPasswordPolicyParamPasswordReusePrevention\n\
        \  iamPasswordPolicyParamRequireLowercaseCharacters:\n    Fn::Not:\n    -\
        \ Fn::Equals:\n      - ''\n      - Ref: IamPasswordPolicyParamRequireLowercaseCharacters\n\
        \  iamPasswordPolicyParamRequireNumbers:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: IamPasswordPolicyParamRequireNumbers\n  iamPasswordPolicyParamRequireSymbols:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: IamPasswordPolicyParamRequireSymbols\n\
        \  iamPasswordPolicyParamRequireUppercaseCharacters:\n    Fn::Not:\n    -\
        \ Fn::Equals:\n      - ''\n      - Ref: IamPasswordPolicyParamRequireUppercaseCharacters\n\
        \  iamUserUnusedCredentialsCheckParamMaxCredentialUsageAge:\n    Fn::Not:\n\
        \    - Fn::Equals:\n      - ''\n      - Ref: IamUserUnusedCredentialsCheckParamMaxCredentialUsageAge\n\
        \  restrictedIncomingTrafficParamBlockedPort1:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: RestrictedIncomingTrafficParamBlockedPort1\n  restrictedIncomingTrafficParamBlockedPort2:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: RestrictedIncomingTrafficParamBlockedPort2\n\
        \  restrictedIncomingTrafficParamBlockedPort3:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: RestrictedIncomingTrafficParamBlockedPort3\n  restrictedIncomingTrafficParamBlockedPort4:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: RestrictedIncomingTrafficParamBlockedPort4\n\
        \  restrictedIncomingTrafficParamBlockedPort5:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: RestrictedIncomingTrafficParamBlockedPort5\n  s3AccountLevelPublicAccessBlocksParamBlockPublicAcls:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicAcls\n\
        \  s3AccountLevelPublicAccessBlocksParamBlockPublicPolicy:\n    Fn::Not:\n\
        \    - Fn::Equals:\n      - ''\n      - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicPolicy\n\
        \  s3AccountLevelPublicAccessBlocksParamIgnorePublicAcls:\n    Fn::Not:\n\
        \    - Fn::Equals:\n      - ''\n      - Ref: S3AccountLevelPublicAccessBlocksParamIgnorePublicAcls\n\
        \  s3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets:\n    Fn::Not:\n\
        \    - Fn::Equals:\n      - ''\n      - Ref: S3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets"
    Type: AWS::Config::ConformancePack
  DnsHostedZone9A2A44DA:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/AwsBiotechBlueprint.template.yml [1281:1735]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      DeliveryS3KeyPrefix: Operational-Best-Practices-for-NIST-CSF
      TemplateBody: "##################################################################################\n\
        #\n#   Conformance Pack:\n#     Operational Best Practices for NIST CSF\n\
        #\n#   This conformance pack helps verify compliance with NIST CSF requirements.\n\
        #                                                                        \
        \         \n#   This Conformance Pack has been designed for compatibility\
        \ with the majority of AWS \n#   regions and to not require setting of any\
        \ Parameters. Additional managed rules that \n#   require parameters to be\
        \ set for your environment and/or for your specific region can \n#   be found\
        \ at https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html\n\
        #\n#   See Parameters section for names and descriptions of required parameters.\
        \ \n#\n##################################################################################\n\
        \nParameters:\n  AccessKeysRotatedParamMaxAccessKeyAge:\n    Default: '90'\n\
        \    Type: String\n  AcmCertificateExpirationCheckParamDaysToExpiration:\n\
        \    Default: '90'\n    Type: String\n  GuarddutyNonArchivedFindingsParamDaysHighSev:\n\
        \    Default: '1'\n    Type: String\n  GuarddutyNonArchivedFindingsParamDaysLowSev:\n\
        \    Default: '30'\n    Type: String\n  GuarddutyNonArchivedFindingsParamDaysMediumSev:\n\
        \    Default: '7'\n    Type: String\n  IamPasswordPolicyParamMaxPasswordAge:\n\
        \    Default: '90'\n    Type: String\n  IamPasswordPolicyParamMinimumPasswordLength:\n\
        \    Default: '14'\n    Type: String\n  IamPasswordPolicyParamPasswordReusePrevention:\n\
        \    Default: '24'\n    Type: String\n  IamPasswordPolicyParamRequireLowercaseCharacters:\n\
        \    Default: 'TRUE'\n    Type: String\n  IamPasswordPolicyParamRequireNumbers:\n\
        \    Default: 'TRUE'\n    Type: String\n  IamPasswordPolicyParamRequireSymbols:\n\
        \    Default: 'TRUE'\n    Type: String\n  IamPasswordPolicyParamRequireUppercaseCharacters:\n\
        \    Default: 'TRUE'\n    Type: String\n  IamUserUnusedCredentialsCheckParamMaxCredentialUsageAge:\n\
        \    Default: '90'\n    Type: String\n  RestrictedIncomingTrafficParamBlockedPort1:\n\
        \    Default: '20'\n    Type: String\n  RestrictedIncomingTrafficParamBlockedPort2:\n\
        \    Default: '21'\n    Type: String\n  RestrictedIncomingTrafficParamBlockedPort3:\n\
        \    Default: '3389'\n    Type: String\n  RestrictedIncomingTrafficParamBlockedPort4:\n\
        \    Default: '3306'\n    Type: String\n  RestrictedIncomingTrafficParamBlockedPort5:\n\
        \    Default: '4333'\n    Type: String\n  S3AccountLevelPublicAccessBlocksParamBlockPublicAcls:\n\
        \    Default: 'True'\n    Type: String\n  S3AccountLevelPublicAccessBlocksParamBlockPublicPolicy:\n\
        \    Default: 'True'\n    Type: String\n  S3AccountLevelPublicAccessBlocksParamIgnorePublicAcls:\n\
        \    Default: 'True'\n    Type: String\n  S3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets:\n\
        \    Default: 'True'\n    Type: String\nResources:\n  AccessKeysRotated:\n\
        \    Properties:\n      ConfigRuleName: access-keys-rotated\n      InputParameters:\n\
        \        maxAccessKeyAge:\n          Fn::If:\n          - accessKeysRotatedParamMaxAccessKeyAge\n\
        \          - Ref: AccessKeysRotatedParamMaxAccessKeyAge\n          - Ref:\
        \ AWS::NoValue\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ ACCESS_KEYS_ROTATED\n    Type: AWS::Config::ConfigRule\n  AcmCertificateExpirationCheck:\n\
        \    Properties:\n      ConfigRuleName: acm-certificate-expiration-check\n\
        \      InputParameters:\n        daysToExpiration:\n          Fn::If:\n  \
        \        - acmCertificateExpirationCheckParamDaysToExpiration\n          -\
        \ Ref: AcmCertificateExpirationCheckParamDaysToExpiration\n          - Ref:\
        \ AWS::NoValue\n      Scope:\n        ComplianceResourceTypes:\n        -\
        \ AWS::ACM::Certificate\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ ACM_CERTIFICATE_EXPIRATION_CHECK\n    Type: AWS::Config::ConfigRule\n  AlbHttpToHttpsRedirectionCheck:\n\
        \    Properties:\n      ConfigRuleName: alb-http-to-https-redirection-check\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: ALB_HTTP_TO_HTTPS_REDIRECTION_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  ApiGwCacheEnabledAndEncrypted:\n   \
        \ Properties:\n      ConfigRuleName: api-gw-cache-enabled-and-encrypted\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::ApiGateway::Stage\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: API_GW_CACHE_ENABLED_AND_ENCRYPTED\n\
        \    Type: AWS::Config::ConfigRule\n  ApiGwExecutionLoggingEnabled:\n    Properties:\n\
        \      ConfigRuleName: api-gw-execution-logging-enabled\n      Scope:\n  \
        \      ComplianceResourceTypes:\n        - AWS::ApiGateway::Stage\n      \
        \  - AWS::ApiGatewayV2::Stage\n      Source:\n        Owner: AWS\n       \
        \ SourceIdentifier: API_GW_EXECUTION_LOGGING_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  AutoscalingGroupElbHealthcheckRequired:\n    Properties:\n      ConfigRuleName:\
        \ autoscaling-group-elb-healthcheck-required\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::AutoScaling::AutoScalingGroup\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: AUTOSCALING_GROUP_ELB_HEALTHCHECK_REQUIRED\n\
        \    Type: AWS::Config::ConfigRule\n  CloudTrailCloudWatchLogsEnabled:\n \
        \   Properties:\n      ConfigRuleName: cloud-trail-cloud-watch-logs-enabled\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  CloudTrailEnabled:\n    Properties:\n\
        \      ConfigRuleName: cloudtrail-enabled\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: CLOUD_TRAIL_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  CloudTrailEncryptionEnabled:\n    Properties:\n      ConfigRuleName: cloud-trail-encryption-enabled\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CLOUD_TRAIL_ENCRYPTION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  CloudTrailLogFileValidationEnabled:\n\
        \    Properties:\n      ConfigRuleName: cloud-trail-log-file-validation-enabled\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  CloudtrailS3DataeventsEnabled:\n   \
        \ Properties:\n      ConfigRuleName: cloudtrail-s3-dataevents-enabled\n  \
        \    Source:\n        Owner: AWS\n        SourceIdentifier: CLOUDTRAIL_S3_DATAEVENTS_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  CloudwatchAlarmActionCheck:\n    Properties:\n\
        \      ConfigRuleName: cloudwatch-alarm-action-check\n      InputParameters:\n\
        \        alarmActionRequired: 'TRUE'\n        insufficientDataActionRequired:\
        \ 'TRUE'\n        okActionRequired: 'FALSE'\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::CloudWatch::Alarm\n      Source:\n        Owner: AWS\n   \
        \     SourceIdentifier: CLOUDWATCH_ALARM_ACTION_CHECK\n    Type: AWS::Config::ConfigRule\n\
        \  CloudwatchLogGroupEncrypted:\n    Properties:\n      ConfigRuleName: cloudwatch-log-group-encrypted\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CLOUDWATCH_LOG_GROUP_ENCRYPTED\n\
        \    Type: AWS::Config::ConfigRule\n  CodebuildProjectEnvvarAwscredCheck:\n\
        \    Properties:\n      ConfigRuleName: codebuild-project-envvar-awscred-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::CodeBuild::Project\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CODEBUILD_PROJECT_ENVVAR_AWSCRED_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  CodebuildProjectSourceRepoUrlCheck:\n\
        \    Properties:\n      ConfigRuleName: codebuild-project-source-repo-url-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::CodeBuild::Project\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: CODEBUILD_PROJECT_SOURCE_REPO_URL_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  DbInstanceBackupEnabled:\n    Properties:\n\
        \      ConfigRuleName: db-instance-backup-enabled\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::RDS::DBInstance\n      Source:\n        Owner: AWS\n     \
        \   SourceIdentifier: DB_INSTANCE_BACKUP_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  DmsReplicationNotPublic:\n    Properties:\n      ConfigRuleName: dms-replication-not-public\n\
        \      Scope:\n        ComplianceResourceTypes: []\n      Source:\n      \
        \  Owner: AWS\n        SourceIdentifier: DMS_REPLICATION_NOT_PUBLIC\n    Type:\
        \ AWS::Config::ConfigRule\n  DynamodbAutoscalingEnabled:\n    Properties:\n\
        \      ConfigRuleName: dynamodb-autoscaling-enabled\n      Scope:\n      \
        \  ComplianceResourceTypes:\n        - AWS::DynamoDB::Table\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: DYNAMODB_AUTOSCALING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  DynamodbPitrEnabled:\n    Properties:\n\
        \      ConfigRuleName: dynamodb-pitr-enabled\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::DynamoDB::Table\n      Source:\n        Owner: AWS\n     \
        \   SourceIdentifier: DYNAMODB_PITR_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  DynamodbThroughputLimitCheck:\n    Properties:\n      ConfigRuleName: dynamodb-throughput-limit-check\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: DYNAMODB_THROUGHPUT_LIMIT_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  EbsOptimizedInstance:\n    Properties:\n\
        \      ConfigRuleName: ebs-optimized-instance\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::EC2::Instance\n      Source:\n        Owner: AWS\n       \
        \ SourceIdentifier: EBS_OPTIMIZED_INSTANCE\n    Type: AWS::Config::ConfigRule\n\
        \  EbsSnapshotPublicRestorableCheck:\n    Properties:\n      ConfigRuleName:\
        \ ebs-snapshot-public-restorable-check\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: EBS_SNAPSHOT_PUBLIC_RESTORABLE_CHECK\n    Type:\
        \ AWS::Config::ConfigRule\n  Ec2InstanceDetailedMonitoringEnabled:\n    Properties:\n\
        \      ConfigRuleName: ec2-instance-detailed-monitoring-enabled\n      Scope:\n\
        \        ComplianceResourceTypes:\n        - AWS::EC2::Instance\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: EC2_INSTANCE_DETAILED_MONITORING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  Ec2InstanceManagedBySsm:\n    Properties:\n\
        \      ConfigRuleName: ec2-instance-managed-by-systems-manager\n      Scope:\n\
        \        ComplianceResourceTypes:\n        - AWS::EC2::Instance\n        -\
        \ AWS::SSM::ManagedInstanceInventory\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: EC2_INSTANCE_MANAGED_BY_SSM\n    Type: AWS::Config::ConfigRule\n\
        \  Ec2InstanceNoPublicIp:\n    Properties:\n      ConfigRuleName: ec2-instance-no-public-ip\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::Instance\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: EC2_INSTANCE_NO_PUBLIC_IP\n\
        \    Type: AWS::Config::ConfigRule\n  Ec2ManagedinstanceAssociationComplianceStatusCheck:\n\
        \    Properties:\n      ConfigRuleName: ec2-managedinstance-association-compliance-status-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SSM::AssociationCompliance\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: EC2_MANAGEDINSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  Ec2ManagedinstancePatchComplianceStatusCheck:\n\
        \    Properties:\n      ConfigRuleName: ec2-managedinstance-patch-compliance-status-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SSM::PatchCompliance\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: EC2_MANAGEDINSTANCE_PATCH_COMPLIANCE_STATUS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  Ec2SecurityGroupAttachedToEni:\n   \
        \ Properties:\n      ConfigRuleName: ec2-security-group-attached-to-eni\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::SecurityGroup\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: EC2_SECURITY_GROUP_ATTACHED_TO_ENI\n\
        \    Type: AWS::Config::ConfigRule\n  Ec2StoppedInstance:\n    Properties:\n\
        \      ConfigRuleName: ec2-stopped-instance\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: EC2_STOPPED_INSTANCE\n    Type: AWS::Config::ConfigRule\n\
        \  Ec2VolumeInuseCheck:\n    Properties:\n      ConfigRuleName: ec2-volume-inuse-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::Volume\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: EC2_VOLUME_INUSE_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  EfsEncryptedCheck:\n    Properties:\n\
        \      ConfigRuleName: efs-encrypted-check\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: EFS_ENCRYPTED_CHECK\n    Type: AWS::Config::ConfigRule\n\
        \  EipAttached:\n    Properties:\n      ConfigRuleName: eip-attached\n   \
        \   Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::EIP\n  \
        \    Source:\n        Owner: AWS\n        SourceIdentifier: EIP_ATTACHED\n\
        \    Type: AWS::Config::ConfigRule\n  ElasticacheRedisClusterAutomaticBackupCheck:\n\
        \    Properties:\n      ConfigRuleName: elasticache-redis-cluster-automatic-backup-check\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: ELASTICACHE_REDIS_CLUSTER_AUTOMATIC_BACKUP_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  ElasticsearchEncryptedAtRest:\n    Properties:\n\
        \      ConfigRuleName: elasticsearch-encrypted-at-rest\n      Source:\n  \
        \      Owner: AWS\n        SourceIdentifier: ELASTICSEARCH_ENCRYPTED_AT_REST\n\
        \    Type: AWS::Config::ConfigRule\n  ElasticsearchInVpcOnly:\n    Properties:\n\
        \      ConfigRuleName: elasticsearch-in-vpc-only\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: ELASTICSEARCH_IN_VPC_ONLY\n    Type: AWS::Config::ConfigRule\n\
        \  ElbAcmCertificateRequired:\n    Properties:\n      ConfigRuleName: elb-acm-certificate-required\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::ElasticLoadBalancing::LoadBalancer\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: ELB_ACM_CERTIFICATE_REQUIRED\n\
        \    Type: AWS::Config::ConfigRule\n  ElbDeletionProtectionEnabled:\n    Properties:\n\
        \      ConfigRuleName: elb-deletion-protection-enabled\n      Scope:\n   \
        \     ComplianceResourceTypes:\n        - AWS::ElasticLoadBalancingV2::LoadBalancer\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: ELB_DELETION_PROTECTION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  ElbLoggingEnabled:\n    Properties:\n\
        \      ConfigRuleName: elb-logging-enabled\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::ElasticLoadBalancing::LoadBalancer\n        - AWS::ElasticLoadBalancingV2::LoadBalancer\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: ELB_LOGGING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  EmrKerberosEnabled:\n    Properties:\n\
        \      ConfigRuleName: emr-kerberos-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: EMR_KERBEROS_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  EmrMasterNoPublicIp:\n    Properties:\n      ConfigRuleName: emr-master-no-public-ip\n\
        \      Scope:\n        ComplianceResourceTypes: []\n      Source:\n      \
        \  Owner: AWS\n        SourceIdentifier: EMR_MASTER_NO_PUBLIC_IP\n    Type:\
        \ AWS::Config::ConfigRule\n  EncryptedVolumes:\n    Properties:\n      ConfigRuleName:\
        \ encrypted-volumes\n      Scope:\n        ComplianceResourceTypes:\n    \
        \    - AWS::EC2::Volume\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ ENCRYPTED_VOLUMES\n    Type: AWS::Config::ConfigRule\n  GuarddutyEnabledCentralized:\n\
        \    Properties:\n      ConfigRuleName: guardduty-enabled-centralized\n  \
        \    Source:\n        Owner: AWS\n        SourceIdentifier: GUARDDUTY_ENABLED_CENTRALIZED\n\
        \    Type: AWS::Config::ConfigRule\n  GuarddutyNonArchivedFindings:\n    Properties:\n\
        \      ConfigRuleName: guardduty-non-archived-findings\n      InputParameters:\n\
        \        daysHighSev:\n          Fn::If:\n          - guarddutyNonArchivedFindingsParamDaysHighSev\n\
        \          - Ref: GuarddutyNonArchivedFindingsParamDaysHighSev\n         \
        \ - Ref: AWS::NoValue\n        daysLowSev:\n          Fn::If:\n          -\
        \ guarddutyNonArchivedFindingsParamDaysLowSev\n          - Ref: GuarddutyNonArchivedFindingsParamDaysLowSev\n\
        \          - Ref: AWS::NoValue\n        daysMediumSev:\n          Fn::If:\n\
        \          - guarddutyNonArchivedFindingsParamDaysMediumSev\n          - Ref:\
        \ GuarddutyNonArchivedFindingsParamDaysMediumSev\n          - Ref: AWS::NoValue\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: GUARDDUTY_NON_ARCHIVED_FINDINGS\n\
        \    Type: AWS::Config::ConfigRule\n  IamGroupHasUsersCheck:\n    Properties:\n\
        \      ConfigRuleName: iam-group-has-users-check\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::IAM::Group\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ IAM_GROUP_HAS_USERS_CHECK\n    Type: AWS::Config::ConfigRule\n  IamPasswordPolicy:\n\
        \    Properties:\n      ConfigRuleName: iam-password-policy\n      InputParameters:\n\
        \        MaxPasswordAge:\n          Fn::If:\n          - iamPasswordPolicyParamMaxPasswordAge\n\
        \          - Ref: IamPasswordPolicyParamMaxPasswordAge\n          - Ref: AWS::NoValue\n\
        \        MinimumPasswordLength:\n          Fn::If:\n          - iamPasswordPolicyParamMinimumPasswordLength\n\
        \          - Ref: IamPasswordPolicyParamMinimumPasswordLength\n          -\
        \ Ref: AWS::NoValue\n        PasswordReusePrevention:\n          Fn::If:\n\
        \          - iamPasswordPolicyParamPasswordReusePrevention\n          - Ref:\
        \ IamPasswordPolicyParamPasswordReusePrevention\n          - Ref: AWS::NoValue\n\
        \        RequireLowercaseCharacters:\n          Fn::If:\n          - iamPasswordPolicyParamRequireLowercaseCharacters\n\
        \          - Ref: IamPasswordPolicyParamRequireLowercaseCharacters\n     \
        \     - Ref: AWS::NoValue\n        RequireNumbers:\n          Fn::If:\n  \
        \        - iamPasswordPolicyParamRequireNumbers\n          - Ref: IamPasswordPolicyParamRequireNumbers\n\
        \          - Ref: AWS::NoValue\n        RequireSymbols:\n          Fn::If:\n\
        \          - iamPasswordPolicyParamRequireSymbols\n          - Ref: IamPasswordPolicyParamRequireSymbols\n\
        \          - Ref: AWS::NoValue\n        RequireUppercaseCharacters:\n    \
        \      Fn::If:\n          - iamPasswordPolicyParamRequireUppercaseCharacters\n\
        \          - Ref: IamPasswordPolicyParamRequireUppercaseCharacters\n     \
        \     - Ref: AWS::NoValue\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ IAM_PASSWORD_POLICY\n    Type: AWS::Config::ConfigRule\n  IamPolicyNoStatementsWithAdminAccess:\n\
        \    Properties:\n      ConfigRuleName: iam-policy-no-statements-with-admin-access\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::IAM::Policy\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS\n\
        \    Type: AWS::Config::ConfigRule\n  IamRootAccessKeyCheck:\n    Properties:\n\
        \      ConfigRuleName: iam-root-access-key-check\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: IAM_ROOT_ACCESS_KEY_CHECK\n    Type: AWS::Config::ConfigRule\n\
        \  IamUserGroupMembershipCheck:\n    Properties:\n      ConfigRuleName: iam-user-group-membership-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::IAM::User\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_USER_GROUP_MEMBERSHIP_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  IamUserMfaEnabled:\n    Properties:\n\
        \      ConfigRuleName: iam-user-mfa-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: IAM_USER_MFA_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  IamUserNoPoliciesCheck:\n    Properties:\n      ConfigRuleName: iam-user-no-policies-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::IAM::User\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: IAM_USER_NO_POLICIES_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  IamUserUnusedCredentialsCheck:\n   \
        \ Properties:\n      ConfigRuleName: iam-user-unused-credentials-check\n \
        \     InputParameters:\n        maxCredentialUsageAge:\n          Fn::If:\n\
        \          - iamUserUnusedCredentialsCheckParamMaxCredentialUsageAge\n   \
        \       - Ref: IamUserUnusedCredentialsCheckParamMaxCredentialUsageAge\n \
        \         - Ref: AWS::NoValue\n      Source:\n        Owner: AWS\n       \
        \ SourceIdentifier: IAM_USER_UNUSED_CREDENTIALS_CHECK\n    Type: AWS::Config::ConfigRule\n\
        \  IncomingSshDisabled:\n    Properties:\n      ConfigRuleName: restricted-ssh\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::SecurityGroup\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: INCOMING_SSH_DISABLED\n\
        \    Type: AWS::Config::ConfigRule\n  InstancesInVpc:\n    Properties:\n \
        \     ConfigRuleName: ec2-instances-in-vpc\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::EC2::Instance\n      Source:\n        Owner: AWS\n       \
        \ SourceIdentifier: INSTANCES_IN_VPC\n    Type: AWS::Config::ConfigRule\n\
        \  InternetGatewayAuthorizedVpcOnly:\n    Properties:\n      ConfigRuleName:\
        \ internet-gateway-authorized-vpc-only\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::EC2::InternetGateway\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: INTERNET_GATEWAY_AUTHORIZED_VPC_ONLY\n    Type:\
        \ AWS::Config::ConfigRule\n  KmsCmkNotScheduledForDeletion:\n    Properties:\n\
        \      ConfigRuleName: kms-cmk-not-scheduled-for-deletion\n      Scope:\n\
        \        ComplianceResourceTypes:\n        - AWS::KMS::Key\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: KMS_CMK_NOT_SCHEDULED_FOR_DELETION\n\
        \    Type: AWS::Config::ConfigRule\n  LambdaConcurrencyCheck:\n    Properties:\n\
        \      ConfigRuleName: lambda-concurrency-check\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::Lambda::Function\n      Source:\n        Owner: AWS\n    \
        \    SourceIdentifier: LAMBDA_CONCURRENCY_CHECK\n    Type: AWS::Config::ConfigRule\n\
        \  LambdaDlqCheck:\n    Properties:\n      ConfigRuleName: lambda-dlq-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::Lambda::Function\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: LAMBDA_DLQ_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  LambdaFunctionPublicAccessProhibited:\n\
        \    Properties:\n      ConfigRuleName: lambda-function-public-access-prohibited\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::Lambda::Function\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: LAMBDA_FUNCTION_PUBLIC_ACCESS_PROHIBITED\n\
        \    Type: AWS::Config::ConfigRule\n  LambdaInsideVpc:\n    Properties:\n\
        \      ConfigRuleName: lambda-inside-vpc\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::Lambda::Function\n      Source:\n        Owner: AWS\n    \
        \    SourceIdentifier: LAMBDA_INSIDE_VPC\n    Type: AWS::Config::ConfigRule\n\
        \  MfaEnabledForIamConsoleAccess:\n    Properties:\n      ConfigRuleName:\
        \ mfa-enabled-for-iam-console-access\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS\n    Type: AWS::Config::ConfigRule\n\
        \  MultiRegionCloudTrailEnabled:\n    Properties:\n      ConfigRuleName: multi-region-cloudtrail-enabled\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: MULTI_REGION_CLOUD_TRAIL_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  RdsEnhancedMonitoringEnabled:\n    Properties:\n\
        \      ConfigRuleName: rds-enhanced-monitoring-enabled\n      Scope:\n   \
        \     ComplianceResourceTypes:\n        - AWS::RDS::DBInstance\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: RDS_ENHANCED_MONITORING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  RdsInstancePublicAccessCheck:\n    Properties:\n\
        \      ConfigRuleName: rds-instance-public-access-check\n      Scope:\n  \
        \      ComplianceResourceTypes:\n        - AWS::RDS::DBInstance\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: RDS_INSTANCE_PUBLIC_ACCESS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  RdsMultiAzSupport:\n    Properties:\n\
        \      ConfigRuleName: rds-multi-az-support\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::RDS::DBInstance\n      Source:\n        Owner: AWS\n     \
        \   SourceIdentifier: RDS_MULTI_AZ_SUPPORT\n    Type: AWS::Config::ConfigRule\n\
        \  RdsSnapshotsPublicProhibited:\n    Properties:\n      ConfigRuleName: rds-snapshots-public-prohibited\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::RDS::DBSnapshot\n\
        \        - AWS::RDS::DBClusterSnapshot\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: RDS_SNAPSHOTS_PUBLIC_PROHIBITED\n    Type: AWS::Config::ConfigRule\n\
        \  RdsStorageEncrypted:\n    Properties:\n      ConfigRuleName: rds-storage-encrypted\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::RDS::DBInstance\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: RDS_STORAGE_ENCRYPTED\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftClusterConfigurationCheck:\n\
        \    Properties:\n      ConfigRuleName: redshift-cluster-configuration-check\n\
        \      InputParameters:\n        clusterDbEncrypted: 'TRUE'\n        loggingEnabled:\
        \ 'TRUE'\n      Scope:\n        ComplianceResourceTypes:\n        - AWS::Redshift::Cluster\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: REDSHIFT_CLUSTER_CONFIGURATION_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftClusterPublicAccessCheck:\n\
        \    Properties:\n      ConfigRuleName: redshift-cluster-public-access-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::Redshift::Cluster\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftRequireTlsSsl:\n    Properties:\n\
        \      ConfigRuleName: redshift-require-tls-ssl\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::Redshift::Cluster\n      Source:\n        Owner: AWS\n   \
        \     SourceIdentifier: REDSHIFT_REQUIRE_TLS_SSL\n    Type: AWS::Config::ConfigRule\n\
        \  RestrictedIncomingTraffic:\n    Properties:\n      ConfigRuleName: restricted-common-ports\n\
        \      InputParameters:\n        blockedPort1:\n          Fn::If:\n      \
        \    - restrictedIncomingTrafficParamBlockedPort1\n          - Ref: RestrictedIncomingTrafficParamBlockedPort1\n\
        \          - Ref: AWS::NoValue\n        blockedPort2:\n          Fn::If:\n\
        \          - restrictedIncomingTrafficParamBlockedPort2\n          - Ref:\
        \ RestrictedIncomingTrafficParamBlockedPort2\n          - Ref: AWS::NoValue\n\
        \        blockedPort3:\n          Fn::If:\n          - restrictedIncomingTrafficParamBlockedPort3\n\
        \          - Ref: RestrictedIncomingTrafficParamBlockedPort3\n          -\
        \ Ref: AWS::NoValue\n        blockedPort4:\n          Fn::If:\n          -\
        \ restrictedIncomingTrafficParamBlockedPort4\n          - Ref: RestrictedIncomingTrafficParamBlockedPort4\n\
        \          - Ref: AWS::NoValue\n        blockedPort5:\n          Fn::If:\n\
        \          - restrictedIncomingTrafficParamBlockedPort5\n          - Ref:\
        \ RestrictedIncomingTrafficParamBlockedPort5\n          - Ref: AWS::NoValue\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::SecurityGroup\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: RESTRICTED_INCOMING_TRAFFIC\n\
        \    Type: AWS::Config::ConfigRule\n  RootAccountHardwareMfaEnabled:\n   \
        \ Properties:\n      ConfigRuleName: root-account-hardware-mfa-enabled\n \
        \     Source:\n        Owner: AWS\n        SourceIdentifier: ROOT_ACCOUNT_HARDWARE_MFA_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  RootAccountMfaEnabled:\n    Properties:\n\
        \      ConfigRuleName: root-account-mfa-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  S3AccountLevelPublicAccessBlocks:\n    Properties:\n      ConfigRuleName:\
        \ s3-account-level-public-access-blocks\n      InputParameters:\n        BlockPublicAcls:\n\
        \          Fn::If:\n          - s3AccountLevelPublicAccessBlocksParamBlockPublicAcls\n\
        \          - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicAcls\n \
        \         - Ref: AWS::NoValue\n        BlockPublicPolicy:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamBlockPublicPolicy\n    \
        \      - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicPolicy\n   \
        \       - Ref: AWS::NoValue\n        IgnorePublicAcls:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamIgnorePublicAcls\n     \
        \     - Ref: S3AccountLevelPublicAccessBlocksParamIgnorePublicAcls\n     \
        \     - Ref: AWS::NoValue\n        RestrictPublicBuckets:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets\n\
        \          - Ref: S3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets\n\
        \          - Ref: AWS::NoValue\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::S3::AccountPublicAccessBlock\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS\n \
        \   Type: AWS::Config::ConfigRule\n  S3BucketDefaultLockEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-default-lock-enabled\n      Scope:\n    \
        \    ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: S3_BUCKET_DEFAULT_LOCK_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketLoggingEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-logging-enabled\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::S3::Bucket\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ S3_BUCKET_LOGGING_ENABLED\n    Type: AWS::Config::ConfigRule\n  S3BucketPolicyGranteeCheck:\n\
        \    Properties:\n      ConfigRuleName: s3-bucket-policy-grantee-check\n \
        \     Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_POLICY_GRANTEE_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketPublicReadProhibited:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-public-read-prohibited\n      Scope:\n  \
        \      ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketPublicWriteProhibited:\n   \
        \ Properties:\n      ConfigRuleName: s3-bucket-public-write-prohibited\n \
        \     Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketReplicationEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-replication-enabled\n      Scope:\n     \
        \   ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n \
        \       Owner: AWS\n        SourceIdentifier: S3_BUCKET_REPLICATION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketServerSideEncryptionEnabled:\n\
        \    Properties:\n      ConfigRuleName: s3-bucket-server-side-encryption-enabled\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketSslRequestsOnly:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-ssl-requests-only\n      Scope:\n       \
        \ ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n   \
        \     Owner: AWS\n        SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketVersioningEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-versioning-enabled\n      Scope:\n      \
        \  ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n  \
        \      Owner: AWS\n        SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerEndpointConfigurationKmsKeyConfigured:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-endpoint-configuration-kms-key-configured\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGURED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerNotebookInstanceKmsKeyConfigured:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-notebook-instance-kms-key-configured\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGURED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerNotebookNoDirectInternetAccess:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-notebook-no-direct-internet-access\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS\n\
        \    Type: AWS::Config::ConfigRule\n  SecretsmanagerRotationEnabledCheck:\n\
        \    Properties:\n      ConfigRuleName: secretsmanager-rotation-enabled-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SecretsManager::Secret\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SECRETSMANAGER_ROTATION_ENABLED_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  SecretsmanagerScheduledRotationSuccessCheck:\n\
        \    Properties:\n      ConfigRuleName: secretsmanager-scheduled-rotation-success-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SecretsManager::Secret\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SECRETSMANAGER_SCHEDULED_ROTATION_SUCCESS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  SecurityhubEnabled:\n    Properties:\n\
        \      ConfigRuleName: securityhub-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: SECURITYHUB_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  SnsEncryptedKms:\n    Properties:\n      ConfigRuleName: sns-encrypted-kms\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SNS::Topic\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SNS_ENCRYPTED_KMS\n\
        \    Type: AWS::Config::ConfigRule\n  VpcDefaultSecurityGroupClosed:\n   \
        \ Properties:\n      ConfigRuleName: vpc-default-security-group-closed\n \
        \     Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::SecurityGroup\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: VPC_DEFAULT_SECURITY_GROUP_CLOSED\n\
        \    Type: AWS::Config::ConfigRule\n  VpcFlowLogsEnabled:\n    Properties:\n\
        \      ConfigRuleName: vpc-flow-logs-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: VPC_FLOW_LOGS_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  VpcSgOpenOnlyToAuthorizedPorts:\n    Properties:\n      ConfigRuleName:\
        \ vpc-sg-open-only-to-authorized-ports\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::EC2::SecurityGroup\n      Source:\n        Owner: AWS\n  \
        \      SourceIdentifier: VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS\n    Type: AWS::Config::ConfigRule\n\
        \  VpcVpn2TunnelsUp:\n    Properties:\n      ConfigRuleName: vpc-vpn-2-tunnels-up\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::VPNConnection\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: VPC_VPN_2_TUNNELS_UP\n\
        \    Type: AWS::Config::ConfigRule\nConditions:\n  accessKeysRotatedParamMaxAccessKeyAge:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: AccessKeysRotatedParamMaxAccessKeyAge\n\
        \  acmCertificateExpirationCheckParamDaysToExpiration:\n    Fn::Not:\n   \
        \ - Fn::Equals:\n      - ''\n      - Ref: AcmCertificateExpirationCheckParamDaysToExpiration\n\
        \  guarddutyNonArchivedFindingsParamDaysHighSev:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: GuarddutyNonArchivedFindingsParamDaysHighSev\n \
        \ guarddutyNonArchivedFindingsParamDaysLowSev:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: GuarddutyNonArchivedFindingsParamDaysLowSev\n  guarddutyNonArchivedFindingsParamDaysMediumSev:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: GuarddutyNonArchivedFindingsParamDaysMediumSev\n\
        \  iamPasswordPolicyParamMaxPasswordAge:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: IamPasswordPolicyParamMaxPasswordAge\n  iamPasswordPolicyParamMinimumPasswordLength:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: IamPasswordPolicyParamMinimumPasswordLength\n\
        \  iamPasswordPolicyParamPasswordReusePrevention:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: IamPasswordPolicyParamPasswordReusePrevention\n\
        \  iamPasswordPolicyParamRequireLowercaseCharacters:\n    Fn::Not:\n    -\
        \ Fn::Equals:\n      - ''\n      - Ref: IamPasswordPolicyParamRequireLowercaseCharacters\n\
        \  iamPasswordPolicyParamRequireNumbers:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: IamPasswordPolicyParamRequireNumbers\n  iamPasswordPolicyParamRequireSymbols:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: IamPasswordPolicyParamRequireSymbols\n\
        \  iamPasswordPolicyParamRequireUppercaseCharacters:\n    Fn::Not:\n    -\
        \ Fn::Equals:\n      - ''\n      - Ref: IamPasswordPolicyParamRequireUppercaseCharacters\n\
        \  iamUserUnusedCredentialsCheckParamMaxCredentialUsageAge:\n    Fn::Not:\n\
        \    - Fn::Equals:\n      - ''\n      - Ref: IamUserUnusedCredentialsCheckParamMaxCredentialUsageAge\n\
        \  restrictedIncomingTrafficParamBlockedPort1:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: RestrictedIncomingTrafficParamBlockedPort1\n  restrictedIncomingTrafficParamBlockedPort2:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: RestrictedIncomingTrafficParamBlockedPort2\n\
        \  restrictedIncomingTrafficParamBlockedPort3:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: RestrictedIncomingTrafficParamBlockedPort3\n  restrictedIncomingTrafficParamBlockedPort4:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: RestrictedIncomingTrafficParamBlockedPort4\n\
        \  restrictedIncomingTrafficParamBlockedPort5:\n    Fn::Not:\n    - Fn::Equals:\n\
        \      - ''\n      - Ref: RestrictedIncomingTrafficParamBlockedPort5\n  s3AccountLevelPublicAccessBlocksParamBlockPublicAcls:\n\
        \    Fn::Not:\n    - Fn::Equals:\n      - ''\n      - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicAcls\n\
        \  s3AccountLevelPublicAccessBlocksParamBlockPublicPolicy:\n    Fn::Not:\n\
        \    - Fn::Equals:\n      - ''\n      - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicPolicy\n\
        \  s3AccountLevelPublicAccessBlocksParamIgnorePublicAcls:\n    Fn::Not:\n\
        \    - Fn::Equals:\n      - ''\n      - Ref: S3AccountLevelPublicAccessBlocksParamIgnorePublicAcls\n\
        \  s3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets:\n    Fn::Not:\n\
        \    - Fn::Equals:\n      - ''\n      - Ref: S3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets"
    Type: AWS::Config::ConformancePack
  DnsHostedZone9A2A44DA:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



