Question 1

Is associate_public_ip_address enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, Manage access to the AWS Cloud by ensuring AWS Elastic Compute Cloud (AWS EC2) instances cannot be publicly accessed.

Question 2

Is ebs_optimized enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, An optimized instance in AWS Elastic Block Store (AWS EBS) provides additional, dedicated capacity for AWS EBS I/O operations.

Question 3

Is ebs_volumes enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, Because sensitive data can exist and to help protect data at rest, ensure encryption is enabled for your AWS Elastic Block Store (AWS EBS) volumes.

Question 4

Is iam_instance_profile enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, Ensure that an AWS Elastic Compute Cloud (AWS EC2) instance has an Identity and Access Management (IAM) profile attached to it. This rule is non-compliant if no IAM profile is attached to the AWS EC2 instance.

Question 5

Is metadata_options enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, Ensure the Instance Metadata Service Version 2 (IMDSv2) method is enabled to help protect access and control of AWS Elastic Compute Cloud (AWS EC2) instance metadata.

Question 6

Is security_group_ingress_rules enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, This control checks whether the VPC security groups that are in use allow unrestricted incoming traffic. Optionally the rule checks whether the port numbers are listed in the authorizedTcpPorts parameter. The default values for authorizedTcpPorts are 80 and 443.

Question 7

Is subnet_id enforced for NIST SP 800-53 Rev 5?

Accepted Answer

Yes, Deploy AWS Elastic Compute Cloud (AWS EC2) instances within an AWS Virtual Private Cloud (AWS VPC) to enable secure communication between an instance and other services within the amazon VPC, without requiring an internet gateway, NAT device, or VPN connection.

Control	Clause	Change
Attached EBS volumes should have encryption enabledebs_attached_volume_encryption_enabled AU-9(3)	AU-9(3)
EBS volumes should have encryption at rest enabledebs_volume_encryption_at_rest_enabled AU-9(3)	AU-9(3)
EC2 instances should have EBS optimization enabledec2_instance_ebs_optimized None	None
EC2 instances should have IAM profile attachedec2_instance_iam_profile_attached None	None
EC2 instances should be in a VPCec2_instance_in_vpc None	None
EC2 instances should not have a public IP addressec2_instance_not_publicly_accessible AC-2(6)	AC-2(6)
EC2 instances should use IMDSv2ec2_instance_uses_imdsv2 AC-2(6)	AC-2(6)
VPC Security groups should only allow unrestricted incoming traffic for authorized portsvpc_security_group_allows_ingress_authorized_ports SC-7	SC-7

Controls