templates/AwsBiotechBlueprint.template.quickstart.yml [865:941]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      DeliveryS3KeyPrefix: Operational-Best-Practices-For-AWS-Identity-And-Access-Management
      TemplateBody: "################################################################################\n\
        #\n#   Conformance Pack:\n#     Operational Best Practices for AWS Identity\
        \ and Access Management\n#\n#   See Parameters section for names and descriptions\
        \ of required parameters.\n#\n################################################################################\n\
        \nParameters:\n    AccessKeysRotatedParameterMaxAccessKeyAge:\n      Description:\
        \ Maximum number of days without rotation. Default 90.\n      Type: String\n\
        \      Default: 90\n    IAMUserUnusedCredentialsCheckParameterMaxCredentialUsageAge:\n\
        \      Description: Maximum number of days a credential cannot be used. The\
        \ default value\n        is 90 days.\n      Type: String\n      Default: 90\n\
        Resources:\n    AccessKeysRotated:\n      Properties:\n        ConfigRuleName:\
        \ AccessKeysRotated\n        Description: Checks whether the active access\
        \ keys are rotated within the number\n          of days specified in maxAccessKeyAge.\
        \ The rule is non-compliant if the access\n          keys have not been rotated\
        \ for more than maxAccessKeyAge number of days.\n        InputParameters:\n\
        \          maxAccessKeyAge:\n            Ref: AccessKeysRotatedParameterMaxAccessKeyAge\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: ACCESS_KEYS_ROTATED\n\
        \      Type: AWS::Config::ConfigRule\n    IAMGroupHasUsersCheck:\n      Properties:\n\
        \        ConfigRuleName: IAMGroupHasUsersCheck\n        Description: Checks\
        \ whether IAM groups have at least one IAM user.\n        Source:\n      \
        \    Owner: AWS\n          SourceIdentifier: IAM_GROUP_HAS_USERS_CHECK\n \
        \     Type: AWS::Config::ConfigRule\n    IAMPasswordPolicy:\n      Properties:\n\
        \        ConfigRuleName: IAMPasswordPolicy\n        Description: Checks whether\
        \ the account password policy for IAM users meets\n          the specified\
        \ requirements.\n        Source:\n          Owner: AWS\n          SourceIdentifier:\
        \ IAM_PASSWORD_POLICY\n      Type: AWS::Config::ConfigRule\n    IAMPolicyNoStatementsWithAdminAccess:\n\
        \      Properties:\n        ConfigRuleName: IAMPolicyNoStatementsWithAdminAccess\n\
        \        Description: 'Checks whether the default version of AWS Identity\
        \ and Access\n          Management (IAM) policies do not have administrator\
        \ access. If any statement\n          has \"Effect\": \"Allow\" with \"Action\"\
        : \"*\" over \"Resource\": \"*\", the rule is\n          non-compliant.'\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS\n\
        \      Type: AWS::Config::ConfigRule\n    IAMRootAccessKeyCheck:\n      Properties:\n\
        \        ConfigRuleName: IAMRootAccessKeyCheck\n        Description: Checks\
        \ whether the root user access key is available. The rule\n          is compliant\
        \ if the user access key does not exist.\n        Source:\n          Owner:\
        \ AWS\n          SourceIdentifier: IAM_ROOT_ACCESS_KEY_CHECK\n      Type:\
        \ AWS::Config::ConfigRule\n    IAMUserGroupMembershipCheck:\n      Properties:\n\
        \        ConfigRuleName: IAMUserGroupMembershipCheck\n        Description:\
        \ Checks whether IAM users are members of at least one IAM group.\n      \
        \  Source:\n          Owner: AWS\n          SourceIdentifier: IAM_USER_GROUP_MEMBERSHIP_CHECK\n\
        \      Type: AWS::Config::ConfigRule\n    IAMUserMFAEnabled:\n      Properties:\n\
        \        ConfigRuleName: IAMUserMFAEnabled\n        Description: Checks whether\
        \ the AWS Identity and Access Management users have\n          multi-factor\
        \ authentication (MFA) enabled.\n        Source:\n          Owner: AWS\n \
        \         SourceIdentifier: IAM_USER_MFA_ENABLED\n      Type: AWS::Config::ConfigRule\n\
        \    IAMUserNoPoliciesCheck:\n      Properties:\n        ConfigRuleName: IAMUserNoPoliciesCheck\n\
        \        Description: Checks that none of your IAM users have policies attached.\
        \ IAM\n          users must inherit permissions from IAM groups or roles.\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: IAM_USER_NO_POLICIES_CHECK\n\
        \      Type: AWS::Config::ConfigRule\n    IAMUserUnusedCredentialsCheck:\n\
        \      Properties:\n        ConfigRuleName: IAMUserUnusedCredentialsCheck\n\
        \        Description: Checks whether your AWS Identity and Access Management\
        \ (IAM) users\n          have passwords or active access keys that have not\
        \ been used within the specified\n          number of days you provided.\n\
        \        InputParameters:\n          maxCredentialUsageAge:\n            Ref:\
        \ IAMUserUnusedCredentialsCheckParameterMaxCredentialUsageAge\n        Source:\n\
        \          Owner: AWS\n          SourceIdentifier: IAM_USER_UNUSED_CREDENTIALS_CHECK\n\
        \      Type: AWS::Config::ConfigRule\n    MFAEnabledForIAMConsoleAccess:\n\
        \      Properties:\n        ConfigRuleName: MFAEnabledForIAMConsoleAccess\n\
        \        Description: Checks whether AWS Multi-Factor Authentication (MFA)\
        \ is enabled\n          for all AWS Identity and Access Management (IAM) users\
        \ that use a console\n          password. The rule is compliant if MFA is\
        \ enabled.\n        Source:\n          Owner: AWS\n          SourceIdentifier:\
        \ MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS\n      Type: AWS::Config::ConfigRule\n\
        \    RootAccountHardwareMFAEnabled:\n      Properties:\n        ConfigRuleName:\
        \ RootAccountHardwareMFAEnabled\n        Description: Checks whether your\
        \ AWS account is enabled to use multi-factor\n          authentication (MFA)\
        \ hardware device to sign in with root credentials.\n        Source:\n   \
        \       Owner: AWS\n          SourceIdentifier: ROOT_ACCOUNT_HARDWARE_MFA_ENABLED\n\
        \      Type: AWS::Config::ConfigRule\n    RootAccountMFAEnabled:\n      Properties:\n\
        \        ConfigRuleName: RootAccountMFAEnabled\n        Description: Checks\
        \ whether the root user of your AWS account requires multi-factor\n      \
        \    authentication for console sign-in.\n        Source:\n          Owner:\
        \ AWS\n          SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED\n      Type: AWS::Config::ConfigRule"
    Type: AWS::Config::ConformancePack
  ConfigPacksCPOperationalBestPracticesForAmazonS30892D47D:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/AwsBiotechBlueprint.template.yml [703:779]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      DeliveryS3KeyPrefix: Operational-Best-Practices-For-AWS-Identity-And-Access-Management
      TemplateBody: "################################################################################\n\
        #\n#   Conformance Pack:\n#     Operational Best Practices for AWS Identity\
        \ and Access Management\n#\n#   See Parameters section for names and descriptions\
        \ of required parameters.\n#\n################################################################################\n\
        \nParameters:\n    AccessKeysRotatedParameterMaxAccessKeyAge:\n      Description:\
        \ Maximum number of days without rotation. Default 90.\n      Type: String\n\
        \      Default: 90\n    IAMUserUnusedCredentialsCheckParameterMaxCredentialUsageAge:\n\
        \      Description: Maximum number of days a credential cannot be used. The\
        \ default value\n        is 90 days.\n      Type: String\n      Default: 90\n\
        Resources:\n    AccessKeysRotated:\n      Properties:\n        ConfigRuleName:\
        \ AccessKeysRotated\n        Description: Checks whether the active access\
        \ keys are rotated within the number\n          of days specified in maxAccessKeyAge.\
        \ The rule is non-compliant if the access\n          keys have not been rotated\
        \ for more than maxAccessKeyAge number of days.\n        InputParameters:\n\
        \          maxAccessKeyAge:\n            Ref: AccessKeysRotatedParameterMaxAccessKeyAge\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: ACCESS_KEYS_ROTATED\n\
        \      Type: AWS::Config::ConfigRule\n    IAMGroupHasUsersCheck:\n      Properties:\n\
        \        ConfigRuleName: IAMGroupHasUsersCheck\n        Description: Checks\
        \ whether IAM groups have at least one IAM user.\n        Source:\n      \
        \    Owner: AWS\n          SourceIdentifier: IAM_GROUP_HAS_USERS_CHECK\n \
        \     Type: AWS::Config::ConfigRule\n    IAMPasswordPolicy:\n      Properties:\n\
        \        ConfigRuleName: IAMPasswordPolicy\n        Description: Checks whether\
        \ the account password policy for IAM users meets\n          the specified\
        \ requirements.\n        Source:\n          Owner: AWS\n          SourceIdentifier:\
        \ IAM_PASSWORD_POLICY\n      Type: AWS::Config::ConfigRule\n    IAMPolicyNoStatementsWithAdminAccess:\n\
        \      Properties:\n        ConfigRuleName: IAMPolicyNoStatementsWithAdminAccess\n\
        \        Description: 'Checks whether the default version of AWS Identity\
        \ and Access\n          Management (IAM) policies do not have administrator\
        \ access. If any statement\n          has \"Effect\": \"Allow\" with \"Action\"\
        : \"*\" over \"Resource\": \"*\", the rule is\n          non-compliant.'\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS\n\
        \      Type: AWS::Config::ConfigRule\n    IAMRootAccessKeyCheck:\n      Properties:\n\
        \        ConfigRuleName: IAMRootAccessKeyCheck\n        Description: Checks\
        \ whether the root user access key is available. The rule\n          is compliant\
        \ if the user access key does not exist.\n        Source:\n          Owner:\
        \ AWS\n          SourceIdentifier: IAM_ROOT_ACCESS_KEY_CHECK\n      Type:\
        \ AWS::Config::ConfigRule\n    IAMUserGroupMembershipCheck:\n      Properties:\n\
        \        ConfigRuleName: IAMUserGroupMembershipCheck\n        Description:\
        \ Checks whether IAM users are members of at least one IAM group.\n      \
        \  Source:\n          Owner: AWS\n          SourceIdentifier: IAM_USER_GROUP_MEMBERSHIP_CHECK\n\
        \      Type: AWS::Config::ConfigRule\n    IAMUserMFAEnabled:\n      Properties:\n\
        \        ConfigRuleName: IAMUserMFAEnabled\n        Description: Checks whether\
        \ the AWS Identity and Access Management users have\n          multi-factor\
        \ authentication (MFA) enabled.\n        Source:\n          Owner: AWS\n \
        \         SourceIdentifier: IAM_USER_MFA_ENABLED\n      Type: AWS::Config::ConfigRule\n\
        \    IAMUserNoPoliciesCheck:\n      Properties:\n        ConfigRuleName: IAMUserNoPoliciesCheck\n\
        \        Description: Checks that none of your IAM users have policies attached.\
        \ IAM\n          users must inherit permissions from IAM groups or roles.\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: IAM_USER_NO_POLICIES_CHECK\n\
        \      Type: AWS::Config::ConfigRule\n    IAMUserUnusedCredentialsCheck:\n\
        \      Properties:\n        ConfigRuleName: IAMUserUnusedCredentialsCheck\n\
        \        Description: Checks whether your AWS Identity and Access Management\
        \ (IAM) users\n          have passwords or active access keys that have not\
        \ been used within the specified\n          number of days you provided.\n\
        \        InputParameters:\n          maxCredentialUsageAge:\n            Ref:\
        \ IAMUserUnusedCredentialsCheckParameterMaxCredentialUsageAge\n        Source:\n\
        \          Owner: AWS\n          SourceIdentifier: IAM_USER_UNUSED_CREDENTIALS_CHECK\n\
        \      Type: AWS::Config::ConfigRule\n    MFAEnabledForIAMConsoleAccess:\n\
        \      Properties:\n        ConfigRuleName: MFAEnabledForIAMConsoleAccess\n\
        \        Description: Checks whether AWS Multi-Factor Authentication (MFA)\
        \ is enabled\n          for all AWS Identity and Access Management (IAM) users\
        \ that use a console\n          password. The rule is compliant if MFA is\
        \ enabled.\n        Source:\n          Owner: AWS\n          SourceIdentifier:\
        \ MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS\n      Type: AWS::Config::ConfigRule\n\
        \    RootAccountHardwareMFAEnabled:\n      Properties:\n        ConfigRuleName:\
        \ RootAccountHardwareMFAEnabled\n        Description: Checks whether your\
        \ AWS account is enabled to use multi-factor\n          authentication (MFA)\
        \ hardware device to sign in with root credentials.\n        Source:\n   \
        \       Owner: AWS\n          SourceIdentifier: ROOT_ACCOUNT_HARDWARE_MFA_ENABLED\n\
        \      Type: AWS::Config::ConfigRule\n    RootAccountMFAEnabled:\n      Properties:\n\
        \        ConfigRuleName: RootAccountMFAEnabled\n        Description: Checks\
        \ whether the root user of your AWS account requires multi-factor\n      \
        \    authentication for console sign-in.\n        Source:\n          Owner:\
        \ AWS\n          SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED\n      Type: AWS::Config::ConfigRule"
    Type: AWS::Config::ConformancePack
  ConfigPacksCPOperationalBestPracticesForAmazonS30892D47D:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



