aws-servicecatalog-prescriptivecompliance/cft/aws-servicecatalog-configremediations-v2.yml [146:288]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ResourceValue:
            Value: "RESOURCE_ID"
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60
    
# -------------------------------------------------------------------------------------------------------------------------------------------------------
# PCI.CloudTrail.3 – Ensure CloudTrail log file validation is enabled
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  CloudTrailLogFileValidationEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: cloud-trail-log-file-validation-enabled
      Description: >-
        PCI.CloudTrail.3 – Ensure CloudTrail log file validation is enabled
      Scope:
        ComplianceResourceTypes:
        - "AWS::CloudTrail::Trail"
      Source:
        Owner: AWS
        SourceIdentifier: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED
      MaximumExecutionFrequency: One_Hour
  CloudTrailLogFileValidationRemediation:
    DependsOn: CloudTrailLogFileValidationEnabled
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: cloud-trail-log-file-validation-enabled
      ResourceType: "AWS::CloudTrail::Trail"
      TargetId: "Custom-SCLogFileValidationCF"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !ImportValue SCAutomationAssumeRoleArn
        SCCloudTrailLogGroupArn:
          StaticValue:
            Values:
              - !ImportValue SCCloudTrailLogGroupArn
        SCCloudWatchRoleArn:
          StaticValue:
            Values:
              - !ImportValue SCCloudWatchRoleArn
        TrailName:
          ResourceValue:
            Value: "RESOURCE_ID"
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.EC2.4] Unused EC2 EIPs should be removed
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  ReleaseElasticIP:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: ReleaseElasticIP
      Description: >-
        [PCI.EC2.4] Unused EC2 EIPs should be removed
      Scope:
        ComplianceResourceTypes:
        - "AWS::EC2::EIP"
      Source:
        Owner: AWS
        SourceIdentifier: EIP_ATTACHED
  ReleaseElasticIPRemediation:
    DependsOn: ReleaseElasticIP
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: ReleaseElasticIP
      ResourceType: "AWS::EC2::EIP"
      TargetId: "AWS-ReleaseElasticIP"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !ImportValue SCAutomationAssumeRoleArn
        AllocationId:
          ResourceValue:
            Value: "RESOURCE_ID"
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 1.5,1.6,1.7.1.8,1.9,1.10,1.11. – IAM Account Settings related to Password Policy
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  IAMPasswordPolicyEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: cis-iam-password-policy
      Description: >-
        CIS 1.5-1.11 – Ensures IAM Account Settings are compliant with CIS
      InputParameters:
        RequireUppercaseCharacters: true
        RequireLowercaseCharacters: true
        RequireSymbols: true
        RequireNumbers: true
        MinimumPasswordLength: 14
        PasswordReusePrevention: 24
        MaxPasswordAge: 90
      Source:
        Owner: AWS
        SourceIdentifier: IAM_PASSWORD_POLICY
      MaximumExecutionFrequency: One_Hour
  IAMPasswordPolicyRemediation:
    DependsOn: IAMPasswordPolicyEnabled
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: cis-iam-password-policy
      TargetId: "Custom-SCIAMPasswordUpdateCF"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !ImportValue SCAutomationAssumeRoleArn
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-servicecatalog-prescriptivecompliance/cft/aws-servicecatalog-configremediations.yml [97:239]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          ResourceValue:
            Value: "RESOURCE_ID"
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# PCI.CloudTrail.3 – Ensure CloudTrail log file validation is enabled
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  CloudTrailLogFileValidationEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: cloud-trail-log-file-validation-enabled
      Description: >-
        PCI.CloudTrail.3 – Ensure CloudTrail log file validation is enabled
      Scope:
        ComplianceResourceTypes:
        - "AWS::CloudTrail::Trail"
      Source:
        Owner: AWS
        SourceIdentifier: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED
      MaximumExecutionFrequency: One_Hour
  CloudTrailLogFileValidationRemediation:
    DependsOn: CloudTrailLogFileValidationEnabled
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: cloud-trail-log-file-validation-enabled
      ResourceType: "AWS::CloudTrail::Trail"
      TargetId: "Custom-SCLogFileValidationCF"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !ImportValue SCAutomationAssumeRoleArn
        SCCloudTrailLogGroupArn:
          StaticValue:
            Values:
              - !ImportValue SCCloudTrailLogGroupArn
        SCCloudWatchRoleArn:
          StaticValue:
            Values:
              - !ImportValue SCCloudWatchRoleArn
        TrailName:
          ResourceValue:
            Value: "RESOURCE_ID"
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# [PCI.EC2.4] Unused EC2 EIPs should be removed
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  ReleaseElasticIP:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: ReleaseElasticIP
      Description: >-
        [PCI.EC2.4] Unused EC2 EIPs should be removed
      Scope:
        ComplianceResourceTypes:
        - "AWS::EC2::EIP"
      Source:
        Owner: AWS
        SourceIdentifier: EIP_ATTACHED
  ReleaseElasticIPRemediation:
    DependsOn: ReleaseElasticIP
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: ReleaseElasticIP
      ResourceType: "AWS::EC2::EIP"
      TargetId: "AWS-ReleaseElasticIP"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !ImportValue SCAutomationAssumeRoleArn
        AllocationId:
          ResourceValue:
            Value: "RESOURCE_ID"
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 1.5,1.6,1.7.1.8,1.9,1.10,1.11. – IAM Account Settings related to Password Policy
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  IAMPasswordPolicyEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: cis-iam-password-policy
      Description: >-
        CIS 1.5-1.11 – Ensures IAM Account Settings are compliant with CIS
      InputParameters:
        RequireUppercaseCharacters: true
        RequireLowercaseCharacters: true
        RequireSymbols: true
        RequireNumbers: true
        MinimumPasswordLength: 14
        PasswordReusePrevention: 24
        MaxPasswordAge: 90
      Source:
        Owner: AWS
        SourceIdentifier: IAM_PASSWORD_POLICY
      MaximumExecutionFrequency: One_Hour
  IAMPasswordPolicyRemediation:
    DependsOn: IAMPasswordPolicyEnabled
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: cis-iam-password-policy
      TargetId: "Custom-SCIAMPasswordUpdateCF"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !ImportValue SCAutomationAssumeRoleArn
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



