templates/AwsBiotechBlueprint.template.quickstart.yml [1272:1376]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        \  RdsSnapshotsPublicProhibited:\n    Properties:\n      ConfigRuleName: rds-snapshots-public-prohibited\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::RDS::DBSnapshot\n\
        \        - AWS::RDS::DBClusterSnapshot\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: RDS_SNAPSHOTS_PUBLIC_PROHIBITED\n    Type: AWS::Config::ConfigRule\n\
        \  RdsStorageEncrypted:\n    Properties:\n      ConfigRuleName: rds-storage-encrypted\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::RDS::DBInstance\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: RDS_STORAGE_ENCRYPTED\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftClusterConfigurationCheck:\n\
        \    Properties:\n      ConfigRuleName: redshift-cluster-configuration-check\n\
        \      InputParameters:\n        clusterDbEncrypted: 'TRUE'\n        loggingEnabled:\
        \ 'TRUE'\n      Scope:\n        ComplianceResourceTypes:\n        - AWS::Redshift::Cluster\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: REDSHIFT_CLUSTER_CONFIGURATION_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftClusterPublicAccessCheck:\n\
        \    Properties:\n      ConfigRuleName: redshift-cluster-public-access-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::Redshift::Cluster\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftRequireTlsSsl:\n    Properties:\n\
        \      ConfigRuleName: redshift-require-tls-ssl\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::Redshift::Cluster\n      Source:\n        Owner: AWS\n   \
        \     SourceIdentifier: REDSHIFT_REQUIRE_TLS_SSL\n    Type: AWS::Config::ConfigRule\n\
        \  RestrictedIncomingTraffic:\n    Properties:\n      ConfigRuleName: restricted-common-ports\n\
        \      InputParameters:\n        blockedPort1:\n          Fn::If:\n      \
        \    - restrictedIncomingTrafficParamBlockedPort1\n          - Ref: RestrictedIncomingTrafficParamBlockedPort1\n\
        \          - Ref: AWS::NoValue\n        blockedPort2:\n          Fn::If:\n\
        \          - restrictedIncomingTrafficParamBlockedPort2\n          - Ref:\
        \ RestrictedIncomingTrafficParamBlockedPort2\n          - Ref: AWS::NoValue\n\
        \        blockedPort3:\n          Fn::If:\n          - restrictedIncomingTrafficParamBlockedPort3\n\
        \          - Ref: RestrictedIncomingTrafficParamBlockedPort3\n          -\
        \ Ref: AWS::NoValue\n        blockedPort4:\n          Fn::If:\n          -\
        \ restrictedIncomingTrafficParamBlockedPort4\n          - Ref: RestrictedIncomingTrafficParamBlockedPort4\n\
        \          - Ref: AWS::NoValue\n        blockedPort5:\n          Fn::If:\n\
        \          - restrictedIncomingTrafficParamBlockedPort5\n          - Ref:\
        \ RestrictedIncomingTrafficParamBlockedPort5\n          - Ref: AWS::NoValue\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::SecurityGroup\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: RESTRICTED_INCOMING_TRAFFIC\n\
        \    Type: AWS::Config::ConfigRule\n  RootAccountHardwareMfaEnabled:\n   \
        \ Properties:\n      ConfigRuleName: root-account-hardware-mfa-enabled\n \
        \     Source:\n        Owner: AWS\n        SourceIdentifier: ROOT_ACCOUNT_HARDWARE_MFA_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  RootAccountMfaEnabled:\n    Properties:\n\
        \      ConfigRuleName: root-account-mfa-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  S3AccountLevelPublicAccessBlocks:\n    Properties:\n      ConfigRuleName:\
        \ s3-account-level-public-access-blocks\n      InputParameters:\n        BlockPublicAcls:\n\
        \          Fn::If:\n          - s3AccountLevelPublicAccessBlocksParamBlockPublicAcls\n\
        \          - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicAcls\n \
        \         - Ref: AWS::NoValue\n        BlockPublicPolicy:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamBlockPublicPolicy\n    \
        \      - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicPolicy\n   \
        \       - Ref: AWS::NoValue\n        IgnorePublicAcls:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamIgnorePublicAcls\n     \
        \     - Ref: S3AccountLevelPublicAccessBlocksParamIgnorePublicAcls\n     \
        \     - Ref: AWS::NoValue\n        RestrictPublicBuckets:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets\n\
        \          - Ref: S3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets\n\
        \          - Ref: AWS::NoValue\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::S3::AccountPublicAccessBlock\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS\n \
        \   Type: AWS::Config::ConfigRule\n  S3BucketDefaultLockEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-default-lock-enabled\n      Scope:\n    \
        \    ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: S3_BUCKET_DEFAULT_LOCK_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketLoggingEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-logging-enabled\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::S3::Bucket\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ S3_BUCKET_LOGGING_ENABLED\n    Type: AWS::Config::ConfigRule\n  S3BucketPolicyGranteeCheck:\n\
        \    Properties:\n      ConfigRuleName: s3-bucket-policy-grantee-check\n \
        \     Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_POLICY_GRANTEE_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketPublicReadProhibited:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-public-read-prohibited\n      Scope:\n  \
        \      ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketPublicWriteProhibited:\n   \
        \ Properties:\n      ConfigRuleName: s3-bucket-public-write-prohibited\n \
        \     Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketReplicationEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-replication-enabled\n      Scope:\n     \
        \   ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n \
        \       Owner: AWS\n        SourceIdentifier: S3_BUCKET_REPLICATION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketServerSideEncryptionEnabled:\n\
        \    Properties:\n      ConfigRuleName: s3-bucket-server-side-encryption-enabled\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketSslRequestsOnly:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-ssl-requests-only\n      Scope:\n       \
        \ ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n   \
        \     Owner: AWS\n        SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketVersioningEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-versioning-enabled\n      Scope:\n      \
        \  ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n  \
        \      Owner: AWS\n        SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerEndpointConfigurationKmsKeyConfigured:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-endpoint-configuration-kms-key-configured\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGURED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerNotebookInstanceKmsKeyConfigured:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-notebook-instance-kms-key-configured\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGURED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerNotebookNoDirectInternetAccess:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-notebook-no-direct-internet-access\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS\n\
        \    Type: AWS::Config::ConfigRule\n  SecretsmanagerRotationEnabledCheck:\n\
        \    Properties:\n      ConfigRuleName: secretsmanager-rotation-enabled-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SecretsManager::Secret\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SECRETSMANAGER_ROTATION_ENABLED_CHECK\n\
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/AwsBiotechBlueprint.template.quickstart.yml [1740:1844]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        \  RdsSnapshotsPublicProhibited:\n    Properties:\n      ConfigRuleName: rds-snapshots-public-prohibited\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::RDS::DBSnapshot\n\
        \        - AWS::RDS::DBClusterSnapshot\n      Source:\n        Owner: AWS\n\
        \        SourceIdentifier: RDS_SNAPSHOTS_PUBLIC_PROHIBITED\n    Type: AWS::Config::ConfigRule\n\
        \  RdsStorageEncrypted:\n    Properties:\n      ConfigRuleName: rds-storage-encrypted\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::RDS::DBInstance\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: RDS_STORAGE_ENCRYPTED\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftClusterConfigurationCheck:\n\
        \    Properties:\n      ConfigRuleName: redshift-cluster-configuration-check\n\
        \      InputParameters:\n        clusterDbEncrypted: 'TRUE'\n        loggingEnabled:\
        \ 'TRUE'\n      Scope:\n        ComplianceResourceTypes:\n        - AWS::Redshift::Cluster\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: REDSHIFT_CLUSTER_CONFIGURATION_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftClusterPublicAccessCheck:\n\
        \    Properties:\n      ConfigRuleName: redshift-cluster-public-access-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::Redshift::Cluster\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  RedshiftRequireTlsSsl:\n    Properties:\n\
        \      ConfigRuleName: redshift-require-tls-ssl\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::Redshift::Cluster\n      Source:\n        Owner: AWS\n   \
        \     SourceIdentifier: REDSHIFT_REQUIRE_TLS_SSL\n    Type: AWS::Config::ConfigRule\n\
        \  RestrictedIncomingTraffic:\n    Properties:\n      ConfigRuleName: restricted-common-ports\n\
        \      InputParameters:\n        blockedPort1:\n          Fn::If:\n      \
        \    - restrictedIncomingTrafficParamBlockedPort1\n          - Ref: RestrictedIncomingTrafficParamBlockedPort1\n\
        \          - Ref: AWS::NoValue\n        blockedPort2:\n          Fn::If:\n\
        \          - restrictedIncomingTrafficParamBlockedPort2\n          - Ref:\
        \ RestrictedIncomingTrafficParamBlockedPort2\n          - Ref: AWS::NoValue\n\
        \        blockedPort3:\n          Fn::If:\n          - restrictedIncomingTrafficParamBlockedPort3\n\
        \          - Ref: RestrictedIncomingTrafficParamBlockedPort3\n          -\
        \ Ref: AWS::NoValue\n        blockedPort4:\n          Fn::If:\n          -\
        \ restrictedIncomingTrafficParamBlockedPort4\n          - Ref: RestrictedIncomingTrafficParamBlockedPort4\n\
        \          - Ref: AWS::NoValue\n        blockedPort5:\n          Fn::If:\n\
        \          - restrictedIncomingTrafficParamBlockedPort5\n          - Ref:\
        \ RestrictedIncomingTrafficParamBlockedPort5\n          - Ref: AWS::NoValue\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::EC2::SecurityGroup\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: RESTRICTED_INCOMING_TRAFFIC\n\
        \    Type: AWS::Config::ConfigRule\n  RootAccountHardwareMfaEnabled:\n   \
        \ Properties:\n      ConfigRuleName: root-account-hardware-mfa-enabled\n \
        \     Source:\n        Owner: AWS\n        SourceIdentifier: ROOT_ACCOUNT_HARDWARE_MFA_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  RootAccountMfaEnabled:\n    Properties:\n\
        \      ConfigRuleName: root-account-mfa-enabled\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED\n    Type: AWS::Config::ConfigRule\n\
        \  S3AccountLevelPublicAccessBlocks:\n    Properties:\n      ConfigRuleName:\
        \ s3-account-level-public-access-blocks\n      InputParameters:\n        BlockPublicAcls:\n\
        \          Fn::If:\n          - s3AccountLevelPublicAccessBlocksParamBlockPublicAcls\n\
        \          - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicAcls\n \
        \         - Ref: AWS::NoValue\n        BlockPublicPolicy:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamBlockPublicPolicy\n    \
        \      - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicPolicy\n   \
        \       - Ref: AWS::NoValue\n        IgnorePublicAcls:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamIgnorePublicAcls\n     \
        \     - Ref: S3AccountLevelPublicAccessBlocksParamIgnorePublicAcls\n     \
        \     - Ref: AWS::NoValue\n        RestrictPublicBuckets:\n          Fn::If:\n\
        \          - s3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets\n\
        \          - Ref: S3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets\n\
        \          - Ref: AWS::NoValue\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::S3::AccountPublicAccessBlock\n      Source:\n        Owner:\
        \ AWS\n        SourceIdentifier: S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS\n \
        \   Type: AWS::Config::ConfigRule\n  S3BucketDefaultLockEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-default-lock-enabled\n      Scope:\n    \
        \    ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: S3_BUCKET_DEFAULT_LOCK_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketLoggingEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-logging-enabled\n      Scope:\n        ComplianceResourceTypes:\n\
        \        - AWS::S3::Bucket\n      Source:\n        Owner: AWS\n        SourceIdentifier:\
        \ S3_BUCKET_LOGGING_ENABLED\n    Type: AWS::Config::ConfigRule\n  S3BucketPolicyGranteeCheck:\n\
        \    Properties:\n      ConfigRuleName: s3-bucket-policy-grantee-check\n \
        \     Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_POLICY_GRANTEE_CHECK\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketPublicReadProhibited:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-public-read-prohibited\n      Scope:\n  \
        \      ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n\
        \        Owner: AWS\n        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketPublicWriteProhibited:\n   \
        \ Properties:\n      ConfigRuleName: s3-bucket-public-write-prohibited\n \
        \     Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketReplicationEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-replication-enabled\n      Scope:\n     \
        \   ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n \
        \       Owner: AWS\n        SourceIdentifier: S3_BUCKET_REPLICATION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketServerSideEncryptionEnabled:\n\
        \    Properties:\n      ConfigRuleName: s3-bucket-server-side-encryption-enabled\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::S3::Bucket\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketSslRequestsOnly:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-ssl-requests-only\n      Scope:\n       \
        \ ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n   \
        \     Owner: AWS\n        SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY\n\
        \    Type: AWS::Config::ConfigRule\n  S3BucketVersioningEnabled:\n    Properties:\n\
        \      ConfigRuleName: s3-bucket-versioning-enabled\n      Scope:\n      \
        \  ComplianceResourceTypes:\n        - AWS::S3::Bucket\n      Source:\n  \
        \      Owner: AWS\n        SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerEndpointConfigurationKmsKeyConfigured:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-endpoint-configuration-kms-key-configured\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGURED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerNotebookInstanceKmsKeyConfigured:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-notebook-instance-kms-key-configured\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGURED\n\
        \    Type: AWS::Config::ConfigRule\n  SagemakerNotebookNoDirectInternetAccess:\n\
        \    Properties:\n      ConfigRuleName: sagemaker-notebook-no-direct-internet-access\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS\n\
        \    Type: AWS::Config::ConfigRule\n  SecretsmanagerRotationEnabledCheck:\n\
        \    Properties:\n      ConfigRuleName: secretsmanager-rotation-enabled-check\n\
        \      Scope:\n        ComplianceResourceTypes:\n        - AWS::SecretsManager::Secret\n\
        \      Source:\n        Owner: AWS\n        SourceIdentifier: SECRETSMANAGER_ROTATION_ENABLED_CHECK\n\
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



