templates/AwsBiotechBlueprint.template.quickstart.yml [751:855]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      DeliveryS3KeyPrefix: AWS-Control-Tower-Detective-Guardrails-Conformance-Pack
      TemplateBody: "###################################################################################\n\
        #\n#   Conformance Pack:\n#     AWS Control Tower Detective Guardrails Conformance\
        \ Pack\n#\n#    The AWS Control Tower detective guardrails conformance pack\
        \ contains all of the \n#    AWS Config Rules based guardrails from AWS Control\
        \ Tower. Use this conformance \n#    pack to apply AWS Control Tower detective\
        \ guardrails to your existing accounts \n#    prior to enrolling them in AWS\
        \ Control Tower or to manage resources in your \n#    accounts in regions\
        \ not currently supported by AWS Control Tower.\n###################################################################################\n\
        \nResources:\n    CheckForEbsOptimizedInstance:\n      Type: AWS::Config::ConfigRule\n\
        \      Properties:\n        ConfigRuleName: CheckForEbsOptimizedInstance\n\
        \        Description: Disallow launch of EC2 instance types that are not EBS-optimized\
        \ - Checks whether EBS optimization is enabled for your EC2 instances that\
        \ can be EBS-optimized\n        Source:\n          Owner: AWS\n          SourceIdentifier:\
        \ EBS_OPTIMIZED_INSTANCE\n        Scope:\n          ComplianceResourceTypes:\n\
        \            - AWS::EC2::Instance\n    CheckForEc2VolumesInUse:\n      Type:\
        \ AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName: CheckForEc2VolumesInUs\n\
        \        Description: Disallow EBS volumes that are unattached to an EC2 instance\
        \ - Checks whether EBS volumes are attached to EC2 instances\n        InputParameters:\n\
        \          deleteOnTermination: true\n        Source:\n          Owner: AWS\n\
        \          SourceIdentifier: EC2_VOLUME_INUSE_CHECK\n        Scope:\n    \
        \      ComplianceResourceTypes:\n            - AWS::EC2::Volume\n    CheckForEncryptedVolumes:\n\
        \      Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForEncryptedVolumes\n        Description: Enable encryption for EBS\
        \ volumes attached to EC2 instances - Checks whether EBS volumes that are\
        \ in an attached state are encrypted.\n        Source:\n          Owner: AWS\n\
        \          SourceIdentifier: ENCRYPTED_VOLUMES\n        Scope:\n         \
        \ ComplianceResourceTypes:\n            - AWS::EC2::Volume\n    CheckForIAMUserMFA:\n\
        \      Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForIAMUserMFA\n        Description: Disallow access to IAM users without\
        \ MFA - Checks whether the AWS Identity and Access Management users have multi-factor\
        \ authentication (MFA) enabled. The rule is COMPLIANT if MFA is enabled.\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: IAM_USER_MFA_ENABLED\n\
        \        MaximumExecutionFrequency: One_Hour\n    CheckForIAMUserConsoleMFA:\n\
        \      Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForIAMUserConsoleMFA\n        Description: Disallow console access\
        \ to IAM users without MFA - Checks whether AWS Multi-Factor Authentication\
        \ (MFA) is enabled for all AWS Identity and Access Management (IAM) users\
        \ that use a console password. The rule is COMPLIANT if MFA is enabled.\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS\n\
        \        MaximumExecutionFrequency: One_Hour\n    CheckForRdsPublicAccess:\n\
        \      Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForRdsPublicAccess\n        Description: Disallow public access to\
        \ RDS database instances - Checks whether the Amazon Relational Database Service\
        \ (RDS) instances are not publicly accessible. The rule is non-compliant if\
        \ the publiclyAccessible field is true in the instance configuration item.\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: RDS_INSTANCE_PUBLIC_ACCESS_CHECK\n\
        \        Scope:\n          ComplianceResourceTypes:\n            - AWS::RDS::DBInstance\n\
        \    CheckForPublicRdsSnapshots:\n      Type: AWS::Config::ConfigRule\n  \
        \    Properties:\n        ConfigRuleName: CheckForPublicRdsSnapshots\n   \
        \     Description: Disallow public access to RDS database snapshots - Checks\
        \ if Amazon Relational Database Service (Amazon RDS) snapshots are public.\
        \ The rule is non-compliant if any existing and new Amazon RDS snapshots are\
        \ public.\n        Source:\n          Owner: AWS\n          SourceIdentifier:\
        \ RDS_SNAPSHOTS_PUBLIC_PROHIBITED\n        Scope:\n          ComplianceResourceTypes:\n\
        \            - AWS::RDS::DBSnapshot\n    CheckForRdsStorageEncryption:\n \
        \     Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForRdsStorageEncryption\n        Description: Disallow RDS database\
        \ instances that are not storage encrypted - Checks whether storage encryption\
        \ is enabled for your RDS DB instances.\n        Source:\n          Owner:\
        \ AWS\n          SourceIdentifier: RDS_STORAGE_ENCRYPTED\n        Scope:\n\
        \          ComplianceResourceTypes:\n            - AWS::RDS::DBInstance\n\
        \    CheckForRestrictedCommonPortsPolicy:\n      Type: AWS::Config::ConfigRule\n\
        \      Properties:\n        ConfigRuleName: CheckForRestrictedCommonPortsPolicy\n\
        \        Description: Disallow internet connection through RDP - Checks whether\
        \ security groups that are in use disallow unrestricted incoming TCP traffic\
        \ to the specified ports.\n        InputParameters:\n          blockedPort1:\
        \ 20\n          blockedPort2: 21\n          blockedPort3: 3389\n         \
        \ blockedPort4: 3306\n          blockedPort5: 4333\n        Scope:\n     \
        \     ComplianceResourceTypes:\n          - AWS::EC2::SecurityGroup\n    \
        \    Source:\n          Owner: AWS\n          SourceIdentifier: RESTRICTED_INCOMING_TRAFFIC\n\
        \    CheckForRestrictedSshPolicy:\n      Type: AWS::Config::ConfigRule\n \
        \     Properties:\n        ConfigRuleName: CheckForRestrictedSshPolicy\n \
        \       Description: Disallow internet connection through SSH - Checks whether\
        \ security groups that are in use disallow unrestricted incoming SSH traffic.\n\
        \        Scope:\n          ComplianceResourceTypes:\n          - AWS::EC2::SecurityGroup\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: INCOMING_SSH_DISABLED\n\
        \    CheckForRootMfa:\n      Type: AWS::Config::ConfigRule\n      Properties:\n\
        \        ConfigRuleName: CheckForRootMfa\n        Description: Enable MFA\
        \ for the root user - Checks whether the root user of your AWS account requires\
        \ multi-factor authentication for console sign-in.\n        Source:\n    \
        \      Owner: AWS\n          SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED\n\
        \        MaximumExecutionFrequency: One_Hour\n    CheckForS3PublicRead:\n\
        \      Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForS3PublicRead\n        Description: Disallow public read access to\
        \ S3 buckets - Checks that your S3 buckets do not allow public read access.\
        \ If an S3 bucket policy or bucket ACL allows public read access, the bucket\
        \ is noncompliant.\n        Source:\n          Owner: AWS\n          SourceIdentifier:\
        \ S3_BUCKET_PUBLIC_READ_PROHIBITED\n        Scope:\n          ComplianceResourceTypes:\n\
        \            - AWS::S3::Bucket\n    CheckForS3PublicWrite:\n      Type: AWS::Config::ConfigRule\n\
        \      Properties:\n        ConfigRuleName: CheckForS3PublicWrite\n      \
        \  Description: Disallow public write access to S3 buckets - Checks that your\
        \ S3 buckets do not allow public write access. If an S3 bucket policy or bucket\
        \ ACL allows public write access, the bucket is noncompliant.\n        Source:\n\
        \          Owner: AWS\n          SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED\n\
        \        Scope:\n          ComplianceResourceTypes:\n            - AWS::S3::Bucket\n\
        \    CheckForS3VersioningEnabled:\n      Type: AWS::Config::ConfigRule\n \
        \     Properties:\n        ConfigRuleName: CheckForS3VersioningEnabled\n \
        \       Description: Disallow S3 buckets that are not versioning enabled -\
        \ Checks whether versioning is enabled for your S3 buckets.\n        Source:\n\
        \          Owner: AWS\n          SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED\n\
        \        Scope:\n          ComplianceResourceTypes:\n            - AWS::S3::Bucket\
        \  "
    Type: AWS::Config::ConformancePack
  ConfigPacksCPOperationalBestPracticesForAWSIdentityAndAccessManagement7100FE82:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/AwsBiotechBlueprint.template.yml [592:696]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      DeliveryS3KeyPrefix: AWS-Control-Tower-Detective-Guardrails-Conformance-Pack
      TemplateBody: "###################################################################################\n\
        #\n#   Conformance Pack:\n#     AWS Control Tower Detective Guardrails Conformance\
        \ Pack\n#\n#    The AWS Control Tower detective guardrails conformance pack\
        \ contains all of the \n#    AWS Config Rules based guardrails from AWS Control\
        \ Tower. Use this conformance \n#    pack to apply AWS Control Tower detective\
        \ guardrails to your existing accounts \n#    prior to enrolling them in AWS\
        \ Control Tower or to manage resources in your \n#    accounts in regions\
        \ not currently supported by AWS Control Tower.\n###################################################################################\n\
        \nResources:\n    CheckForEbsOptimizedInstance:\n      Type: AWS::Config::ConfigRule\n\
        \      Properties:\n        ConfigRuleName: CheckForEbsOptimizedInstance\n\
        \        Description: Disallow launch of EC2 instance types that are not EBS-optimized\
        \ - Checks whether EBS optimization is enabled for your EC2 instances that\
        \ can be EBS-optimized\n        Source:\n          Owner: AWS\n          SourceIdentifier:\
        \ EBS_OPTIMIZED_INSTANCE\n        Scope:\n          ComplianceResourceTypes:\n\
        \            - AWS::EC2::Instance\n    CheckForEc2VolumesInUse:\n      Type:\
        \ AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName: CheckForEc2VolumesInUs\n\
        \        Description: Disallow EBS volumes that are unattached to an EC2 instance\
        \ - Checks whether EBS volumes are attached to EC2 instances\n        InputParameters:\n\
        \          deleteOnTermination: true\n        Source:\n          Owner: AWS\n\
        \          SourceIdentifier: EC2_VOLUME_INUSE_CHECK\n        Scope:\n    \
        \      ComplianceResourceTypes:\n            - AWS::EC2::Volume\n    CheckForEncryptedVolumes:\n\
        \      Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForEncryptedVolumes\n        Description: Enable encryption for EBS\
        \ volumes attached to EC2 instances - Checks whether EBS volumes that are\
        \ in an attached state are encrypted.\n        Source:\n          Owner: AWS\n\
        \          SourceIdentifier: ENCRYPTED_VOLUMES\n        Scope:\n         \
        \ ComplianceResourceTypes:\n            - AWS::EC2::Volume\n    CheckForIAMUserMFA:\n\
        \      Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForIAMUserMFA\n        Description: Disallow access to IAM users without\
        \ MFA - Checks whether the AWS Identity and Access Management users have multi-factor\
        \ authentication (MFA) enabled. The rule is COMPLIANT if MFA is enabled.\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: IAM_USER_MFA_ENABLED\n\
        \        MaximumExecutionFrequency: One_Hour\n    CheckForIAMUserConsoleMFA:\n\
        \      Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForIAMUserConsoleMFA\n        Description: Disallow console access\
        \ to IAM users without MFA - Checks whether AWS Multi-Factor Authentication\
        \ (MFA) is enabled for all AWS Identity and Access Management (IAM) users\
        \ that use a console password. The rule is COMPLIANT if MFA is enabled.\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS\n\
        \        MaximumExecutionFrequency: One_Hour\n    CheckForRdsPublicAccess:\n\
        \      Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForRdsPublicAccess\n        Description: Disallow public access to\
        \ RDS database instances - Checks whether the Amazon Relational Database Service\
        \ (RDS) instances are not publicly accessible. The rule is non-compliant if\
        \ the publiclyAccessible field is true in the instance configuration item.\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: RDS_INSTANCE_PUBLIC_ACCESS_CHECK\n\
        \        Scope:\n          ComplianceResourceTypes:\n            - AWS::RDS::DBInstance\n\
        \    CheckForPublicRdsSnapshots:\n      Type: AWS::Config::ConfigRule\n  \
        \    Properties:\n        ConfigRuleName: CheckForPublicRdsSnapshots\n   \
        \     Description: Disallow public access to RDS database snapshots - Checks\
        \ if Amazon Relational Database Service (Amazon RDS) snapshots are public.\
        \ The rule is non-compliant if any existing and new Amazon RDS snapshots are\
        \ public.\n        Source:\n          Owner: AWS\n          SourceIdentifier:\
        \ RDS_SNAPSHOTS_PUBLIC_PROHIBITED\n        Scope:\n          ComplianceResourceTypes:\n\
        \            - AWS::RDS::DBSnapshot\n    CheckForRdsStorageEncryption:\n \
        \     Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForRdsStorageEncryption\n        Description: Disallow RDS database\
        \ instances that are not storage encrypted - Checks whether storage encryption\
        \ is enabled for your RDS DB instances.\n        Source:\n          Owner:\
        \ AWS\n          SourceIdentifier: RDS_STORAGE_ENCRYPTED\n        Scope:\n\
        \          ComplianceResourceTypes:\n            - AWS::RDS::DBInstance\n\
        \    CheckForRestrictedCommonPortsPolicy:\n      Type: AWS::Config::ConfigRule\n\
        \      Properties:\n        ConfigRuleName: CheckForRestrictedCommonPortsPolicy\n\
        \        Description: Disallow internet connection through RDP - Checks whether\
        \ security groups that are in use disallow unrestricted incoming TCP traffic\
        \ to the specified ports.\n        InputParameters:\n          blockedPort1:\
        \ 20\n          blockedPort2: 21\n          blockedPort3: 3389\n         \
        \ blockedPort4: 3306\n          blockedPort5: 4333\n        Scope:\n     \
        \     ComplianceResourceTypes:\n          - AWS::EC2::SecurityGroup\n    \
        \    Source:\n          Owner: AWS\n          SourceIdentifier: RESTRICTED_INCOMING_TRAFFIC\n\
        \    CheckForRestrictedSshPolicy:\n      Type: AWS::Config::ConfigRule\n \
        \     Properties:\n        ConfigRuleName: CheckForRestrictedSshPolicy\n \
        \       Description: Disallow internet connection through SSH - Checks whether\
        \ security groups that are in use disallow unrestricted incoming SSH traffic.\n\
        \        Scope:\n          ComplianceResourceTypes:\n          - AWS::EC2::SecurityGroup\n\
        \        Source:\n          Owner: AWS\n          SourceIdentifier: INCOMING_SSH_DISABLED\n\
        \    CheckForRootMfa:\n      Type: AWS::Config::ConfigRule\n      Properties:\n\
        \        ConfigRuleName: CheckForRootMfa\n        Description: Enable MFA\
        \ for the root user - Checks whether the root user of your AWS account requires\
        \ multi-factor authentication for console sign-in.\n        Source:\n    \
        \      Owner: AWS\n          SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED\n\
        \        MaximumExecutionFrequency: One_Hour\n    CheckForS3PublicRead:\n\
        \      Type: AWS::Config::ConfigRule\n      Properties:\n        ConfigRuleName:\
        \ CheckForS3PublicRead\n        Description: Disallow public read access to\
        \ S3 buckets - Checks that your S3 buckets do not allow public read access.\
        \ If an S3 bucket policy or bucket ACL allows public read access, the bucket\
        \ is noncompliant.\n        Source:\n          Owner: AWS\n          SourceIdentifier:\
        \ S3_BUCKET_PUBLIC_READ_PROHIBITED\n        Scope:\n          ComplianceResourceTypes:\n\
        \            - AWS::S3::Bucket\n    CheckForS3PublicWrite:\n      Type: AWS::Config::ConfigRule\n\
        \      Properties:\n        ConfigRuleName: CheckForS3PublicWrite\n      \
        \  Description: Disallow public write access to S3 buckets - Checks that your\
        \ S3 buckets do not allow public write access. If an S3 bucket policy or bucket\
        \ ACL allows public write access, the bucket is noncompliant.\n        Source:\n\
        \          Owner: AWS\n          SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED\n\
        \        Scope:\n          ComplianceResourceTypes:\n            - AWS::S3::Bucket\n\
        \    CheckForS3VersioningEnabled:\n      Type: AWS::Config::ConfigRule\n \
        \     Properties:\n        ConfigRuleName: CheckForS3VersioningEnabled\n \
        \       Description: Disallow S3 buckets that are not versioning enabled -\
        \ Checks whether versioning is enabled for your S3 buckets.\n        Source:\n\
        \          Owner: AWS\n          SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED\n\
        \        Scope:\n          ComplianceResourceTypes:\n            - AWS::S3::Bucket\
        \  "
    Type: AWS::Config::ConformancePack
  ConfigPacksCPOperationalBestPracticesForAWSIdentityAndAccessManagement7100FE82:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



