config-packs/configpack.hipaa.bestpractices.yaml [654:910]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: AWS::Config::ConfigRule
  RdsSnapshotsPublicProhibited:
    Properties:
      ConfigRuleName: rds-snapshots-public-prohibited
      Scope:
        ComplianceResourceTypes:
        - AWS::RDS::DBSnapshot
        - AWS::RDS::DBClusterSnapshot
      Source:
        Owner: AWS
        SourceIdentifier: RDS_SNAPSHOTS_PUBLIC_PROHIBITED
    Type: AWS::Config::ConfigRule
  RdsStorageEncrypted:
    Properties:
      ConfigRuleName: rds-storage-encrypted
      Scope:
        ComplianceResourceTypes:
        - AWS::RDS::DBInstance
      Source:
        Owner: AWS
        SourceIdentifier: RDS_STORAGE_ENCRYPTED
    Type: AWS::Config::ConfigRule
  RedshiftClusterConfigurationCheck:
    Properties:
      ConfigRuleName: redshift-cluster-configuration-check
      InputParameters:
        clusterDbEncrypted: 'TRUE'
        loggingEnabled: 'TRUE'
      Scope:
        ComplianceResourceTypes:
        - AWS::Redshift::Cluster
      Source:
        Owner: AWS
        SourceIdentifier: REDSHIFT_CLUSTER_CONFIGURATION_CHECK
    Type: AWS::Config::ConfigRule
  RedshiftClusterPublicAccessCheck:
    Properties:
      ConfigRuleName: redshift-cluster-public-access-check
      Scope:
        ComplianceResourceTypes:
        - AWS::Redshift::Cluster
      Source:
        Owner: AWS
        SourceIdentifier: REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK
    Type: AWS::Config::ConfigRule
  RedshiftRequireTlsSsl:
    Properties:
      ConfigRuleName: redshift-require-tls-ssl
      Scope:
        ComplianceResourceTypes:
        - AWS::Redshift::Cluster
      Source:
        Owner: AWS
        SourceIdentifier: REDSHIFT_REQUIRE_TLS_SSL
    Type: AWS::Config::ConfigRule
  RestrictedIncomingTraffic:
    Properties:
      ConfigRuleName: restricted-common-ports
      InputParameters:
        blockedPort1:
          Fn::If:
          - restrictedIncomingTrafficParamBlockedPort1
          - Ref: RestrictedIncomingTrafficParamBlockedPort1
          - Ref: AWS::NoValue
        blockedPort2:
          Fn::If:
          - restrictedIncomingTrafficParamBlockedPort2
          - Ref: RestrictedIncomingTrafficParamBlockedPort2
          - Ref: AWS::NoValue
        blockedPort3:
          Fn::If:
          - restrictedIncomingTrafficParamBlockedPort3
          - Ref: RestrictedIncomingTrafficParamBlockedPort3
          - Ref: AWS::NoValue
        blockedPort4:
          Fn::If:
          - restrictedIncomingTrafficParamBlockedPort4
          - Ref: RestrictedIncomingTrafficParamBlockedPort4
          - Ref: AWS::NoValue
        blockedPort5:
          Fn::If:
          - restrictedIncomingTrafficParamBlockedPort5
          - Ref: RestrictedIncomingTrafficParamBlockedPort5
          - Ref: AWS::NoValue
      Scope:
        ComplianceResourceTypes:
        - AWS::EC2::SecurityGroup
      Source:
        Owner: AWS
        SourceIdentifier: RESTRICTED_INCOMING_TRAFFIC
    Type: AWS::Config::ConfigRule
  RootAccountHardwareMfaEnabled:
    Properties:
      ConfigRuleName: root-account-hardware-mfa-enabled
      Source:
        Owner: AWS
        SourceIdentifier: ROOT_ACCOUNT_HARDWARE_MFA_ENABLED
    Type: AWS::Config::ConfigRule
  RootAccountMfaEnabled:
    Properties:
      ConfigRuleName: root-account-mfa-enabled
      Source:
        Owner: AWS
        SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED
    Type: AWS::Config::ConfigRule
  S3AccountLevelPublicAccessBlocks:
    Properties:
      ConfigRuleName: s3-account-level-public-access-blocks
      InputParameters:
        BlockPublicAcls:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksParamBlockPublicAcls
          - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicAcls
          - Ref: AWS::NoValue
        BlockPublicPolicy:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksParamBlockPublicPolicy
          - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicPolicy
          - Ref: AWS::NoValue
        IgnorePublicAcls:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksParamIgnorePublicAcls
          - Ref: S3AccountLevelPublicAccessBlocksParamIgnorePublicAcls
          - Ref: AWS::NoValue
        RestrictPublicBuckets:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets
          - Ref: S3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets
          - Ref: AWS::NoValue
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::AccountPublicAccessBlock
      Source:
        Owner: AWS
        SourceIdentifier: S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS
    Type: AWS::Config::ConfigRule
  S3BucketDefaultLockEnabled:
    Properties:
      ConfigRuleName: s3-bucket-default-lock-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_DEFAULT_LOCK_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketLoggingEnabled:
    Properties:
      ConfigRuleName: s3-bucket-logging-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_LOGGING_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketPolicyGranteeCheck:
    Properties:
      ConfigRuleName: s3-bucket-policy-grantee-check
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_POLICY_GRANTEE_CHECK
    Type: AWS::Config::ConfigRule
  S3BucketPublicReadProhibited:
    Properties:
      ConfigRuleName: s3-bucket-public-read-prohibited
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
    Type: AWS::Config::ConfigRule
  S3BucketPublicWriteProhibited:
    Properties:
      ConfigRuleName: s3-bucket-public-write-prohibited
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
    Type: AWS::Config::ConfigRule
  S3BucketReplicationEnabled:
    Properties:
      ConfigRuleName: s3-bucket-replication-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_REPLICATION_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketServerSideEncryptionEnabled:
    Properties:
      ConfigRuleName: s3-bucket-server-side-encryption-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketSslRequestsOnly:
    Properties:
      ConfigRuleName: s3-bucket-ssl-requests-only
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY
    Type: AWS::Config::ConfigRule
  S3BucketVersioningEnabled:
    Properties:
      ConfigRuleName: s3-bucket-versioning-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED
    Type: AWS::Config::ConfigRule
  SagemakerEndpointConfigurationKmsKeyConfigured:
    Properties:
      ConfigRuleName: sagemaker-endpoint-configuration-kms-key-configured
      Source:
        Owner: AWS
        SourceIdentifier: SAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGURED
    Type: AWS::Config::ConfigRule
  SagemakerNotebookInstanceKmsKeyConfigured:
    Properties:
      ConfigRuleName: sagemaker-notebook-instance-kms-key-configured
      Source:
        Owner: AWS
        SourceIdentifier: SAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGURED
    Type: AWS::Config::ConfigRule
  SagemakerNotebookNoDirectInternetAccess:
    Properties:
      ConfigRuleName: sagemaker-notebook-no-direct-internet-access
      Source:
        Owner: AWS
        SourceIdentifier: SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS
    Type: AWS::Config::ConfigRule
  SecretsmanagerRotationEnabledCheck:
    Properties:
      ConfigRuleName: secretsmanager-rotation-enabled-check
      Scope:
        ComplianceResourceTypes:
        - AWS::SecretsManager::Secret
      Source:
        Owner: AWS
        SourceIdentifier: SECRETSMANAGER_ROTATION_ENABLED_CHECK
    Type: AWS::Config::ConfigRule
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



config-packs/configpack.nist.csf.bestpractices.yaml [727:983]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: AWS::Config::ConfigRule
  RdsSnapshotsPublicProhibited:
    Properties:
      ConfigRuleName: rds-snapshots-public-prohibited
      Scope:
        ComplianceResourceTypes:
        - AWS::RDS::DBSnapshot
        - AWS::RDS::DBClusterSnapshot
      Source:
        Owner: AWS
        SourceIdentifier: RDS_SNAPSHOTS_PUBLIC_PROHIBITED
    Type: AWS::Config::ConfigRule
  RdsStorageEncrypted:
    Properties:
      ConfigRuleName: rds-storage-encrypted
      Scope:
        ComplianceResourceTypes:
        - AWS::RDS::DBInstance
      Source:
        Owner: AWS
        SourceIdentifier: RDS_STORAGE_ENCRYPTED
    Type: AWS::Config::ConfigRule
  RedshiftClusterConfigurationCheck:
    Properties:
      ConfigRuleName: redshift-cluster-configuration-check
      InputParameters:
        clusterDbEncrypted: 'TRUE'
        loggingEnabled: 'TRUE'
      Scope:
        ComplianceResourceTypes:
        - AWS::Redshift::Cluster
      Source:
        Owner: AWS
        SourceIdentifier: REDSHIFT_CLUSTER_CONFIGURATION_CHECK
    Type: AWS::Config::ConfigRule
  RedshiftClusterPublicAccessCheck:
    Properties:
      ConfigRuleName: redshift-cluster-public-access-check
      Scope:
        ComplianceResourceTypes:
        - AWS::Redshift::Cluster
      Source:
        Owner: AWS
        SourceIdentifier: REDSHIFT_CLUSTER_PUBLIC_ACCESS_CHECK
    Type: AWS::Config::ConfigRule
  RedshiftRequireTlsSsl:
    Properties:
      ConfigRuleName: redshift-require-tls-ssl
      Scope:
        ComplianceResourceTypes:
        - AWS::Redshift::Cluster
      Source:
        Owner: AWS
        SourceIdentifier: REDSHIFT_REQUIRE_TLS_SSL
    Type: AWS::Config::ConfigRule
  RestrictedIncomingTraffic:
    Properties:
      ConfigRuleName: restricted-common-ports
      InputParameters:
        blockedPort1:
          Fn::If:
          - restrictedIncomingTrafficParamBlockedPort1
          - Ref: RestrictedIncomingTrafficParamBlockedPort1
          - Ref: AWS::NoValue
        blockedPort2:
          Fn::If:
          - restrictedIncomingTrafficParamBlockedPort2
          - Ref: RestrictedIncomingTrafficParamBlockedPort2
          - Ref: AWS::NoValue
        blockedPort3:
          Fn::If:
          - restrictedIncomingTrafficParamBlockedPort3
          - Ref: RestrictedIncomingTrafficParamBlockedPort3
          - Ref: AWS::NoValue
        blockedPort4:
          Fn::If:
          - restrictedIncomingTrafficParamBlockedPort4
          - Ref: RestrictedIncomingTrafficParamBlockedPort4
          - Ref: AWS::NoValue
        blockedPort5:
          Fn::If:
          - restrictedIncomingTrafficParamBlockedPort5
          - Ref: RestrictedIncomingTrafficParamBlockedPort5
          - Ref: AWS::NoValue
      Scope:
        ComplianceResourceTypes:
        - AWS::EC2::SecurityGroup
      Source:
        Owner: AWS
        SourceIdentifier: RESTRICTED_INCOMING_TRAFFIC
    Type: AWS::Config::ConfigRule
  RootAccountHardwareMfaEnabled:
    Properties:
      ConfigRuleName: root-account-hardware-mfa-enabled
      Source:
        Owner: AWS
        SourceIdentifier: ROOT_ACCOUNT_HARDWARE_MFA_ENABLED
    Type: AWS::Config::ConfigRule
  RootAccountMfaEnabled:
    Properties:
      ConfigRuleName: root-account-mfa-enabled
      Source:
        Owner: AWS
        SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED
    Type: AWS::Config::ConfigRule
  S3AccountLevelPublicAccessBlocks:
    Properties:
      ConfigRuleName: s3-account-level-public-access-blocks
      InputParameters:
        BlockPublicAcls:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksParamBlockPublicAcls
          - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicAcls
          - Ref: AWS::NoValue
        BlockPublicPolicy:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksParamBlockPublicPolicy
          - Ref: S3AccountLevelPublicAccessBlocksParamBlockPublicPolicy
          - Ref: AWS::NoValue
        IgnorePublicAcls:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksParamIgnorePublicAcls
          - Ref: S3AccountLevelPublicAccessBlocksParamIgnorePublicAcls
          - Ref: AWS::NoValue
        RestrictPublicBuckets:
          Fn::If:
          - s3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets
          - Ref: S3AccountLevelPublicAccessBlocksParamRestrictPublicBuckets
          - Ref: AWS::NoValue
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::AccountPublicAccessBlock
      Source:
        Owner: AWS
        SourceIdentifier: S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS
    Type: AWS::Config::ConfigRule
  S3BucketDefaultLockEnabled:
    Properties:
      ConfigRuleName: s3-bucket-default-lock-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_DEFAULT_LOCK_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketLoggingEnabled:
    Properties:
      ConfigRuleName: s3-bucket-logging-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_LOGGING_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketPolicyGranteeCheck:
    Properties:
      ConfigRuleName: s3-bucket-policy-grantee-check
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_POLICY_GRANTEE_CHECK
    Type: AWS::Config::ConfigRule
  S3BucketPublicReadProhibited:
    Properties:
      ConfigRuleName: s3-bucket-public-read-prohibited
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
    Type: AWS::Config::ConfigRule
  S3BucketPublicWriteProhibited:
    Properties:
      ConfigRuleName: s3-bucket-public-write-prohibited
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
    Type: AWS::Config::ConfigRule
  S3BucketReplicationEnabled:
    Properties:
      ConfigRuleName: s3-bucket-replication-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_REPLICATION_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketServerSideEncryptionEnabled:
    Properties:
      ConfigRuleName: s3-bucket-server-side-encryption-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
    Type: AWS::Config::ConfigRule
  S3BucketSslRequestsOnly:
    Properties:
      ConfigRuleName: s3-bucket-ssl-requests-only
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY
    Type: AWS::Config::ConfigRule
  S3BucketVersioningEnabled:
    Properties:
      ConfigRuleName: s3-bucket-versioning-enabled
      Scope:
        ComplianceResourceTypes:
        - AWS::S3::Bucket
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED
    Type: AWS::Config::ConfigRule
  SagemakerEndpointConfigurationKmsKeyConfigured:
    Properties:
      ConfigRuleName: sagemaker-endpoint-configuration-kms-key-configured
      Source:
        Owner: AWS
        SourceIdentifier: SAGEMAKER_ENDPOINT_CONFIGURATION_KMS_KEY_CONFIGURED
    Type: AWS::Config::ConfigRule
  SagemakerNotebookInstanceKmsKeyConfigured:
    Properties:
      ConfigRuleName: sagemaker-notebook-instance-kms-key-configured
      Source:
        Owner: AWS
        SourceIdentifier: SAGEMAKER_NOTEBOOK_INSTANCE_KMS_KEY_CONFIGURED
    Type: AWS::Config::ConfigRule
  SagemakerNotebookNoDirectInternetAccess:
    Properties:
      ConfigRuleName: sagemaker-notebook-no-direct-internet-access
      Source:
        Owner: AWS
        SourceIdentifier: SAGEMAKER_NOTEBOOK_NO_DIRECT_INTERNET_ACCESS
    Type: AWS::Config::ConfigRule
  SecretsmanagerRotationEnabledCheck:
    Properties:
      ConfigRuleName: secretsmanager-rotation-enabled-check
      Scope:
        ComplianceResourceTypes:
        - AWS::SecretsManager::Secret
      Source:
        Owner: AWS
        SourceIdentifier: SECRETSMANAGER_ROTATION_ENABLED_CHECK
    Type: AWS::Config::ConfigRule
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



