Interpretation of the Columns in Benchmark Compliance Rules:
Rule ID: A unique identifier for the specific security rule or check
Title: A brief description of the security issue or misconfiguration
Severity — Low to High: Determines the risk of being exposed to attacks
Service Type: The AWS service affected or evaluated by the rule
Resource Type: The specific AWS resource being audited
| Rule ID | Title | Severity | Service Type | Resource Type |
|---|---|---|---|---|
| CSPM-AWS-2024-0012 | CloudTrail Log File Validation is Disabled | Low | CloudTrail | Trails |
| CSPM-AWS-2024-0023 | Unencrypted EBS Volume irrespective of its state | Medium | EC2 | Volumes |
| CSPM-AWS-2024-0092 | Rotation disabled for KMS Symmetric Customer Master Keys (CMKs) | High | KMS | Keys |
| CSPM-AWS-2024-0104 | No CloudWatch Alarm for “Console Logins without MFA” | Low | CloudWatchLogs | MetricFilter |
| CSPM-AWS-2024-0152 | Ensure that only IMDSv2 is permitted by EC2 Metadata Service | Medium | EC2 | Instances |
| CSPM-AWS-2024-0160 | IAM instance roles are used for AWS resource access from instances | Medium | EC2 | Instances |
| CSPM-AWS-2024-0167 | In every VPC flow logging must be enabled | High | VPC | FlowLog |
| CSPM-AWS-2024-0166 | Ensure AWS Security Hub is enabled | Medium | SecurityHub | Hub |
| CSPM-AWS-2024-0113 | RDS Instance Storage Not Encrypted | Medium | RDS | DBInstances |
| CSPM-AWS-2024-0109 | Auto Minor Version Upgrade Disabled in the RDS Instance | Medium | RDS | DBInstances |
| CSPM-AWS-2024-0110 | The RDS Instance is publicly accessible | Medium | RDS | DBInstances |
| CSPM-AWS-2024-0128 | S3 bucket access logging is not enabled on the CloudTrail S3 bucket | Low | CloudTrail | Trails |
| CSPM-AWS-2024-0147 | S3 bucket access logging is not enabled on the CloudTrail S3 bucket | Low | CloudTrail | Trails |
| CSPM-AWS-2024-0017 | AWS Config Recorders Not Enabled | High | ConfigService | ConfigurationRecorders |
| CSPM-AWS-2024-0020 | Non-empty Default Security Group Rulesets | High | EC2 | SecurityGroups |
| CSPM-AWS-2024-0083 | IAM Credentials that have been inactive for 45 Days or more are not disabled | Medium | IAM | CredentialReport |
| CSPM-AWS-2024-0009 | CloudTrail Data Events Logging Not Configured | Low | CloudTrail | Trails |
| CSPM-AWS-2024-0162 | Ensure AWS Organizations changes are monitored using CloudWatchLogs | Low | CloudWatchLogs | MetricFilter |
