Pre-written Sentinel AWS International Organization for standardization (ISO)/International Electrotechnical Commission (IEC) 27001:2013 Annex A Benchmarking

Pre-written Sentinel policies are ready to use compliance checks for International Organization for standardization (ISO)/International Electrotechnical Commission (IEC) 27001:2013 Annex A AWS Benchmarking to help enable your AWS resources meet industry security standards.

At HashiCorp, we’re committed to making policy management easier for our customers. We understand that developing policies from scratch can be time-consuming and resource-intensive. To address this, we’re introducing our Prewritten Policy Libraries—expertly crafted, ready-to-use policies designed to streamline your compliance processes and enhance security across your infrastructure.

This repository contains several policies designed to accelerate the adoption of the International Organization for standardization (ISO)/International Electrotechnical Commission (IEC) 27001:2013 Annex A AWS Benchmark within HCP Terraform. These policies can be utilized to enforce best practices and security standards across your AWS environment.

For more details on how to work with these policies and to understand the Sentinel language and framework, please refer to the Sentinel documentation or the README documentation included with each of the policy libraries.

Feedback

We aim to validate the effectiveness of our policies by collecting diverse user feedback and understanding real-world use cases. This input will help refine our policies and enhance their overall impact.

1. You can submit your feedback via a public survey.

2. If you have any issues or enhancement suggestions to the library, please create a new GitHub issue.

3. Alternatively, we welcome any contributions that improve the impact of this library! To learn more about contributing and suggesting changes to this library, refer to the contributing guide.

Getting Started

This getting started guide assumes that:

1. You are familiar with core workflows in HCP Terraform and Terraform Enterprise, and you have an existing workspace configured with AWS access credentials.

   Tip: If you do not have these prerequisites, please refer to the Use VCS-Driven Workflow and Create a Variable Set tutorials for guidance.

2. You have a user account that is part of the "owners" team or have "Manage Policies" organization-level permissions to create new policy sets and policies.

3. Ensure you are using HCP Terraform or Terraform Enterprise v202312-1 or a later version.

4. You are using Sentinel version 0.26.x and later version.

By default, the module will enable all policies within the library, and they will be enforced by the HCP Platform with the enforcement_level set to advisory only.

Example:

policy "iam-password-policy-strong-configuration" {
  source = "./policies/iam/iam-password-policy-strong-configuration.sentinel"
  enforcement_level = "advisory"
  params = {
    minimum_password_length_param = 14
  }
}

If you want to enable only a subset of the policies or change the enforcement levels to either soft-mandatory or hard-mandatory, we recommend updating the contents of the sentinel.hcl file in each library before applying the Terraform configuration.

Important: The policies in each library are opinionated and depend on several Sentinel modules. To learn more about modules, please refer to the Sentinel module documentation.

To learn more about how to configure a policy set as a policy evaluation, please review the Terraform Enterprise provider documentation.

Consuming Pre-Written Sentinel Policies for International Organization for standardization (ISO)/International Electrotechnical Commission (IEC) 27001:2013 Annex A AWS Benchmark

Following methods outlines various ways to consume and implement pre-written Sentinel policies for the International Organization for standardization (ISO)/International Electrotechnical Commission (IEC) 27001:2013 Annex A AWS Benchmark. These policies can be used in both Terraform Enterprise (TFE) and HCP Terraform environments. Below are the recommended methods for integrating these policies into your workflows.

Terraform Registry Method:

• Navigate to the Terraform Registry and select the desired Sentinel policy.
• Copy the provided policy snippet from the registry.
• Create a GitHub repository (or use an existing one) to store your policies.
• Add a Sentinel.hcl file to the repository and paste the copied policy snippet(s) into this file.
• Connect the repository to HCP Terraform or Terraform Enterprise using the VCS (Version Control System) workflow.
• Trigger policy execution automatically during the plan stage in HCP Terraform or Terraform Enterprise.

Using the Public GitHub Repository:

• Access the public GitHub repository containing the policy library.
• You can directly use the repository as-is or fork it to customize the policies for your specific requirements.
• If forking, ensure you sync your fork with the upstream repository periodically to stay updated with the latest changes.
• Avoid using the default branch for consumption in HCP Terraform or Terraform Enterprise. Instead, use the release branches for better stability.
• Attach the repository (or your fork) to HCP Terraform or Terraform Enterprise using the VCS workflow.
• Run a Terraform plan to execute the policies during the post-plan stage.

Notes and Best Practices

• These policies are compatible with both HCP Terraform (HCPT) and Terraform Enterprise (TFE). Ensure your workflow is configured accordingly.
• When using the public GitHub repository, it is recommended to use release branches for stability and avoid consuming policies directly from the default branch.
• Regularly update your policies to align with the latest International Organization for standardization (ISO)/International Electrotechnical Commission (IEC) 27001:2013 Annex A AWS Benchmark standards and Terraform best practices.
• Customize policies as needed to meet your organization's specific compliance and security requirements.

Resources

• Get Started - HCP Terraform
• Connecting VCS Providers to HCP Terraform
• Policy Enforcement
• Managing Policy Sets
• Introduction to Sentinel
• Sentinel Documentation
• Sentinel Language
• Sentinel Language Specification
• Policy Libraries

Policies Included

• ECR private repositories should have image scanning configured (docs | code)

• EKS cluster endpoints should not be publicly accessible (docs | code)

• ECS task definitions should have a logging configuration (docs | code)

• Secrets should not be passed as container environment variables (docs | code)

• Amazon ElastiCache for Redis cluster should have automatic backups scheduled (docs | code)

• Amazon ElastiCache for Redis replication groups should have encryption at rest enabled (docs | code)

• Amazon ElastiCache for Redis replication groups should have encryption at transit enabled (docs | code)

• Classic Load Balancers should have cross-zone load balancing enabled (docs | code)

• Application and Classic Load Balancers logging should be enabled (docs | code)

• Application Load Balancer should be configured to redirect all HTTP requests to HTTPS (docs | code)

• Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager (docs | code)

• Application Load Balancer should be configured with defensive or strictest desync mitigation mode (docs | code)

• Classic Load Balancer should be configured with defensive or strictest desync mitigation mode (docs | code)

• AWS RDS instance should be private (docs | code)

• AWS RDS DB instances should have encryption at-rest enabled (docs | code)

• AWS RDS cluster snapshots and database snapshots should be encrypted at rest (docs | code)

• AWS RDS instance should have logging configured (docs | code)

• AWS RDS cluster should be configured for multiple Availability Zones (docs | code)

• AWS RDS DB instances should have automatic backups enabled (docs | code)

• AWS RDS Cluster should have the storage_encrypted attribute set to true (docs | code)

• AWS RDS instance ensure IAM authentication configured (docs | code)

• AWS RDS cluster ensure IAM authentication configured (docs | code)

• S3 general purpose buckets should have block public access settings enabled (docs | code)

• Ensure that S3 Buckets are configured with 'Block public access (bucket settings)' (docs | code)

• Amazon Dynamo DB tables should have point in time recovery enabled (docs | code)

• AWS DocumentDB clusters should have backup_retention_period set between '7 to 35' (docs | code)

• AWS DocumentDB clusters should be encrypted at rest (docs | code)

• Amazon Dynamo DB accelerator clusters should have encryption at rest enabled (docs | code)

• Amazon Dynamo DB accelerator clusters should have encryption in transit enabled (docs | code)

• Amazon Dynamo DB tables should scale its read and write capacity as needed (docs | code)

• Amazon EMR block public access setting should be enabled (docs | code)

• Neptune DB clusters should be encrypted at rest (docs | code)

• Neptune DB clusters should have automated backups enabled (docs | code)

• Neptune DB clusters should have IAM database authentication enabled (docs | code)

• Neptune DB cluster snapshots should be encrypted at rest (docs | code)

• AWS Sagemaker Notebook instance should have the direct_internet_access set to "Disabled" (docs | code)

• AWS Sagemaker Notebook instance should have the root_access set to "Disabled" (docs | code)

• AWS Redshift Cluster should have the publicly_accessible attribute set to false (docs | code)

• AWS Redshift Cluster should have the require_ssl parameter in the AWS Redshift Parameter Group set to true (docs | code)

• AWS Redshift clusters should have automated_snapshot_retention_period set between '7 to 35' (docs | code)

• AWS Redshift Cluster should have the encrypted attribute set to true (docs | code)

• AWS DMS Endpoint resource should have the certificate for ssl configured (docs | code)

• AWS DMS Endpoint resource should have the 'ssl_security_protocol' attribute is 'ssl-encryption' in 'redis_settings' for engine of type redis (docs | code)

• AWS DMS Replication Task should have Logging enabled for the attribute 'replication_task_settings' for target db (docs | code)

• AWS DMS Replication Task should have Logging enabled for the attribute 'replication_task_settings' for source db (docs | code)

• Network Firewall logging should be enabled (docs | code)

• Network Firewall policies should have at least one rule group associated (docs | code)

• ActiveMQ brokers should stream audit logs to CloudWatch (docs | code)

• AWS MQ Broker should have the in_cluster attribute set to true for encryption_in_transit of encryption_info attribute (docs | code)

• Kinesis streams should be encrypted at rest (docs | code)

• KMS restrict IAM inline policies decrypt all KMS keys (docs | code)

• Network Firewall policy default action full packets (docs | code)

• The default stateless action for Network Firewall policies should be drop or forward for fragmented packets (docs | code)

• Stateless Network Firewall rule group should not be empty in AWS Network Firewall (docs | code)

• API Gateway REST and WebSocket API execution logging should be enabled (docs | code)

• Access logging should be configured for API Gateway V2 Stages (docs | code)

• API Gateway REST API stages should be configured to use SSL certificates for backend authentication (docs | code)

• CloudFront distributions should encrypt traffic to custom origins (docs | code)

• CloudFront distributions should use custom SSL/TLS certificates (docs | code)

• CloudFront distributions should have logging enabled (docs | code)

• CloudFront distributions should require encryption in transit (docs | code)

• AWS Backup Framework Recovery Point should be encrypted at rest (docs | code)

• EC2 - Network Acls should not allow ingress traffic from 0.0.0.0/0 or ::/0 to ports 22 or 3389 (docs | code)

• AWS EC2 Client VPN endpoints should have client connection logging enabled (docs | code)

• EC2 - AWS EBS volume are encrypted (docs | code)

• Amazon EC2 launch templates should not assign public IPs to network interfaces (docs | code)

• AWS Elasticsearch domain should be encrypted at rest (docs | code)

• AWS Elasticsearch domain should not be publicly accessible (docs | code)

• AWS Elasticsearch domain should be encrypt data between nodes (docs | code)

• CodeBuild project environments should have a logging AWS Configuration (docs | code)

• CodeBuild S3 logs should be encrypted (docs | code)

• AWS OpenSearch Domain should have the enabled in encrypt_at_rest attribute set to true (docs | code)

• AWS OpenSearch should have the enabled in node-to-node-encryption attribute set to true (docs | code)

• AWS OpenSearch domains should have fine-grained access control enabled (docs | code)

• Connections to AWS OpenSearch domains should be encrypted using the latest TLS security policy (docs | code)

• IAM customer managed policies that you create should not allow wildcard actions for services (docs | code)

• IAM users should not have IAM policies attached (docs | code)

• Password policies for IAM users should have strong configurations (docs | code)

• S3 access points should have block public access settings enabled (docs | code)

• S3 general purpose buckets should block public read access (docs | code)

• S3 general purpose buckets should block public write access (docs | code)

• AWS WAF Classic Global Web ACL logging should be enabled (docs | code)

• Amazon EBS snapshots should not be publicly restorable (docs | code)

• Lambda function policies should prohibit public access (docs | code)

• Step Functions state machines should have logging turned on (docs | code)

• Attached Amazon EBS volumes should be encrypted at-rest (docs | code)

• Unused Network Access Control Lists should be removed (docs | code)

• EC2 VPC Flow Logging Enabled (docs | code)

• OpenSearch domains should not be publicly accessible (docs | code)

• Security groups should only allow unrestricted incoming traffic for authorized ports (docs | code)

• IAM policies should not allow full "*" administrative privileges (docs | code)

• DMS endpoints should use SSL (docs | code)

• EventBridge custom event buses should have a resource-based policy attached (docs | code)

• SSM documents should not be public (docs | code)

• Application, Network and Gateway Load Balancers should span multiple Availability Zones (docs | code)

• EFS access points should enforce a user identity (docs | code)

• Elastic File System should be configured to encrypt file data at-rest using AWS KMS (docs | code)

• Cloudtrail LogFile Validation is enabled (docs | code)

• CloudTrail should have encryption at-rest enabled (docs | code)

• AWS AppSync should have field-level logging enabled (docs | code)

• Route 53 public hosted zones should log DNS queries (docs | code)

• CloudWatch log groups should be retained for a specified time period (docs | code)

• S3 general purpose buckets should be encrypted at rest with AWS KMS keys (docs | code)

• SNS topics should be encrypted at-rest using AWS KMS (docs | code)

• CloudWatch alarms should have specified actions configured (docs | code)

• AWS WAF web ACL logging should be enabled (docs | code)

• EBS volumes should be covered by a backup plan (docs | code)

• Network Firewall firewalls should be deployed across multiple Availability Zones (docs | code)

• EventBridge global endpoints should have event replication enabled (docs | code)

• CloudTrail should follow security best practices (docs | code)

• CloudTrail should have S3 data events enabled (docs | code)

• Cache should be enabled and encrypted for API Gateway REST API stages (docs | code)

• Athena workgroups should be encrypted at rest (docs | code)

• Aurora DB clusters should have recovery points created (docs | code)

• CloudWatch log groups should be encrypted with KMS (docs | code)

• CodeBuild project artifacts should be encrypted (docs | code)

• CodeBuild projects should have privileged mode disabled (docs | code)

• DynamoDB tables should have recovery points created (docs | code)

• DynamoDB tables should have encryption enabled (docs | code)

• DynamoDB tables should be encrypted with KMS (docs | code)

• ECS task definitions should run containers as non-root users (docs | code)

• EFS file systems should be covered by compliant backup plans (docs | code)

• EKS clusters should have control plane logging enabled (docs | code)

• EventBridge schema registries should have resource policies attached (docs | code)

• EBS volumes should have recovery points created (docs | code)

• EBS volumes should be protected by backup plans (docs | code)

• EC2 Auto Scaling groups should have capacity rebalancing enabled (docs | code)

• EBS volumes should have recovery points created within specified time period (docs | code)

• EC2 instances should have IAM instance profiles attached (docs | code)

• EC2 security groups should be attached to network interfaces (docs | code)

• EC2 security groups should be attached to network interfaces (docs | code)

• Manual deletion should be disabled for AWS Backup recovery points (docs | code)

• Kerberos Authentication Should Be Enabled for Amazon EMR Clusters (docs | code)

• IAM Resources Should Not Have Blacklisted Policy ARNs Attached (docs | code)

• IAM Roles Should Have Required Managed Policies Attached (docs | code)

• Incoming SSH Traffic Should Be Restricted (docs | code)

• EC2 Instances Should Belong to a VPC (docs | code)

• Internet Gateways Should Be Attached to Authorized VPCs Only (docs | code)

• Amazon MQ Brokers Should Have Audit Logging Enabled (docs | code)

• Network Load Balancer Cross-Zone Load Balancing Should Be Enabled (docs | code)

• No Unrestricted Routes to Internet Gateway Should Exist (docs | code)

• RDS Aurora Databases Should Be Included in Backup Plans (docs | code)

• RDS Recovery Points Should Be Created Within Required Time Period (docs | code)

• Redshift Clusters Should Have Audit Logging Enabled (docs | code)

• Redshift Clusters Should Have Encryption and Audit Logging Enabled (docs | code)

• S3 Account-Level Public Access Block Should Be Configured (docs | code)

• S3 Bucket Policies Should Not Allow Blacklisted Actions (docs | code)

• S3 Bucket Policy Principals Should Be Validated (docs | code)

• S3 Bucket Policies Should Not Grant More Permissive Inter-Account Access (docs | code)

• S3 Buckets Should Have Replication Enabled (docs | code)

• S3 Buckets Should Have Server-Side Encryption Enabled (docs | code)

• SageMaker Endpoint Configurations Should Have KMS Key Configured (docs | code)

• SageMaker Notebook Instances Should Have KMS Key Configured (docs | code)

• Secrets in AWS Secrets Manager should be encrypted using customer managed keys (docs | code)