Add AWS GDPR compliance framework. Closes #266 #267

c0d3r-arnab · 2021-09-02T15:42:56Z

Checklist

Issue(s) linked

khushboo9024 · 2021-09-13T11:19:45Z

conformance_pack/config.sp

+  description = "This control checks whether AWS Config is enabled in the account for the local Region and is recording all resources."
+  sql         = query.config_enabled_all_regions.sql
+
+  tags = merge(local.conformance_pack_codebuild_common_tags, {


Suggested change

tags = merge(local.conformance_pack_codebuild_common_tags, {

tags = merge(local. conformance_pack_config_common_tags, {

khushboo9024 · 2021-09-21T12:03:11Z

conformance_pack/cloudtrail.sp

+
+control "cloudtrail_bucket_not_public" {
+  title       = "Ensure the S3 bucket CloudTrail logs to is not publicly accessible"
+  description = "CloudTrail logs a record of every API call made in your account. These log files are stored in an S3 bucket. Security Hub recommends that the S3 bucket policy,or access control list (ACL), applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs.."


Suggested change

description = "CloudTrail logs a record of every API call made in your account. These log files are stored in an S3 bucket. Security Hub recommends that the S3 bucket policy,or access control list (ACL), applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs.."

description = "CloudTrail logs a record of every API call made in your account. These log files are stored in an S3 bucket. Security Hub recommends that the S3 bucket policy,or access control list (ACL), applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs."

cbruno10

@c0d3r-arnab Please see comments, thanks!

cbruno10 · 2021-09-21T21:03:42Z

gdpr/gdpr.sp

+}
+
+benchmark "gdpr" {
+  title         = "AWS General Data Protection Regulation (GDPR)"


I don't think we need the word "AWS" in here since we're already in the AWS Compliance mod.

Suggested change

title = "AWS General Data Protection Regulation (GDPR)"

title = "General Data Protection Regulation (GDPR)"

In the UI, ideally it'd be great if GDPR is visible on the sidebar too, right now it's cut off, but can you please check if it's visible entirely on the sidebar once we remove "AWS"?

cbruno10 · 2021-09-21T21:04:39Z

gdpr/article_32_security_of_processing.sp

@@ -0,0 +1,40 @@
+benchmark "article_32_security_of_processing" {


Suggested change

benchmark "article_32_security_of_processing" {

benchmark "article_32" {

Do we need the full article name in here too? I think we can shorten to just the number instead

cbruno10 · 2021-09-21T21:05:48Z

gdpr/article_32_security_of_processing.sp

@@ -0,0 +1,40 @@
+benchmark "article_32_security_of_processing" {
+  title       = "Article 32 Security of processing"
+  documentation = file("./gdpr/docs/article_32_security_of_processing.md")


Suggested change

documentation = file("./gdpr/docs/article_32_security_of_processing.md")

documentation = file("./gdpr/docs/article_32.md")

cbruno10 · 2021-09-21T21:06:22Z

gdpr/article_32_security_of_processing.sp

+    control.wafv2_web_acl_logging_enabled
+  ]
+
+  tags = local.gdpr_common_tags


Can we add a tag here, maybe gdpr_article = 32?

cbruno10 · 2021-09-21T21:06:33Z

gdpr/article_30_records_of_processing_activities.sp

@@ -0,0 +1,18 @@
+benchmark "article_30_records_of_processing_activities" {


Suggested change

benchmark "article_30_records_of_processing_activities" {

benchmark "article_30" {

cbruno10 · 2021-09-21T21:07:44Z

docs/index.md

@@ -4,7 +4,7 @@ repository: "https://github.com/turbot/steampipe-mod-aws-compliance"

 # AWS Compliance Mod

-Run individual configuration, compliance and security controls or full compliance benchmarks for `AWS Foundational Security Best Practices`, `CIS`, `HIPAA`, `NIST 800-53`, `NIST CSF`, `PCI DSS`, and `RBI Cyber Security Framework` across all your AWS accounts.
+Run individual configuration, compliance and security controls or full compliance benchmarks for `AWS Foundational Security Best Practices`, `CIS`, `HIPAA`, `NIST 800-53`, `NIST CSF`, `PCI DSS`, `RBI Cyber Security Framework` and `GDPR` across all your AWS accounts.


Suggested change

Run individual configuration, compliance and security controls or full compliance benchmarks for `AWS Foundational Security Best Practices`, `CIS`, `HIPAA`, `NIST 800-53`, `NIST CSF`, `PCI DSS`, `RBI Cyber Security Framework` and `GDPR` across all your AWS accounts.

Run individual configuration, compliance and security controls or full compliance benchmarks for `AWS Foundational Security Best Practices`, `CIS`, `GDPR`, `HIPAA`, `NIST 800-53`, `NIST CSF`, `PCI DSS`, `RBI Cyber Security Framework` across all your AWS accounts.

cbruno10 · 2021-09-21T21:08:19Z

conformance_pack/vpc.sp

-    nist_800_53_rev_4  = "true"
-    nist_csf           = "true"
-    rbi_cyber_security = "true"
+    cis_foundational_item_id = "2.9"


Why is this tag being added here? I'd only expect to see gdpr being added in this PR

cbruno10 · 2021-09-21T21:09:47Z

conformance_pack/kms.sp

@@ -23,7 +23,9 @@ control "kms_cmk_rotation_enabled" {
  sql         = query.kms_cmk_rotation_enabled.sql

  tags = merge(local.conformance_pack_kms_common_tags, {
-    nist_800_53_rev_4  = "true"
-    rbi_cyber_security = "true"
+    cis_foundational_item_id = "2.8"


why are we adding this tag in this PR?

cbruno10 · 2021-09-21T21:09:54Z

conformance_pack/iam.sp

+  })
+}
+


Cleanup trailing newlines

cbruno10 · 2021-09-21T21:11:25Z

README.md

 * [PCI DSS v3.2.1](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.pci_v321)
 * [AWS Foundational Security Best Practices](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.foundational_security)
-* [Reserve Bank of India (RBI) Cyber Security Framework](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.rbi_cyber_security) 🚀 New!
+* [Reserve Bank of India (RBI) Cyber Security Framework](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.rbi_cyber_security)
+* [General Data Protection Regulation (GDPR)](https://hub.steampipe.io/mods/turbot/aws_compliance/controls/benchmark.gdpr)


We should add the "New!" text at the end here

Also, I think we should move this one up to just below HIPAA (I'd consider it more important than those below that mark)

khushboo9024 and others added 3 commits September 1, 2021 16:34

initial commit

ecc7b4b

Add Article 30 Records of processing activities

d26f8ec

Add Article 32 Security of processing controls

615569e

c0d3r-arnab self-assigned this Sep 2, 2021

c0d3r-arnab added 5 commits September 3, 2021 17:41

add s3 bucket default kns encruption control

ba7e08b

update documentation

e8a5490

add new control, improve docs, add proper tags

27ab865

update docs

cc3d405

update docs

504b66e

rajlearner17 self-requested a review September 8, 2021 12:00

khushboo9024 reviewed Sep 13, 2021

View reviewed changes

khushboo9024 added 5 commits September 13, 2021 16:54

updated description

e1dd9dc

updated tags

b4090ff

made changes in description

cbcdc71

removed rocket icon from the description

343b375

added GDPR in index.md file

07cdf88

rajlearner17 linked an issue Sep 15, 2021 that may be closed by this pull request

Add AWS GDPR compliance framework #266

Closed

updated description

946494c

khushboo9024 marked this pull request as ready for review September 16, 2021 10:52

khushboo9024 reviewed Sep 21, 2021

View reviewed changes

khushboo9024 and others added 4 commits September 21, 2021 17:42

removed extra period

6ae2976

added missing controls

ee9c899

removed extra comma

31787bd

added CIS item id tag

414d5f1

cbruno10 requested changes Sep 21, 2021

View reviewed changes

khushboo9024 changed the base branch from main to release/v0.14 September 22, 2021 05:44

khushboo9024 changed the base branch from release/v0.14 to main September 22, 2021 05:44

khushboo9024 changed the base branch from main to release/v0.14 September 22, 2021 05:45

changed as per review commnets

201bc61

khushboo9024 self-requested a review September 22, 2021 11:47

khushboo9024 removed their request for review September 22, 2021 11:47

rajlearner17 assigned khushboo9024 and rajlearner17 and unassigned c0d3r-arnab Sep 22, 2021

cbruno10 approved these changes Sep 22, 2021

View reviewed changes

rajlearner17 merged commit f46bd7a into release/v0.14 Sep 23, 2021

rajlearner17 deleted the issue-266 branch September 23, 2021 09:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add AWS GDPR compliance framework. Closes #266 #267

Add AWS GDPR compliance framework. Closes #266 #267

c0d3r-arnab commented Sep 2, 2021

khushboo9024 Sep 13, 2021

khushboo9024 Sep 21, 2021

cbruno10 left a comment

cbruno10 Sep 21, 2021

cbruno10 Sep 21, 2021

cbruno10 Sep 21, 2021

cbruno10 Sep 21, 2021

cbruno10 Sep 21, 2021

cbruno10 Sep 21, 2021

cbruno10 Sep 21, 2021

cbruno10 Sep 21, 2021

cbruno10 Sep 21, 2021

cbruno10 Sep 21, 2021

	tags = merge(local.conformance_pack_codebuild_common_tags, {
	tags = merge(local. conformance_pack_config_common_tags, {

	description = "CloudTrail logs a record of every API call made in your account. These log files are stored in an S3 bucket. Security Hub recommends that the S3 bucket policy,or access control list (ACL), applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs.."
	description = "CloudTrail logs a record of every API call made in your account. These log files are stored in an S3 bucket. Security Hub recommends that the S3 bucket policy,or access control list (ACL), applied to the S3 bucket that CloudTrail logs to prevents public access to the CloudTrail logs."

	title = "AWS General Data Protection Regulation (GDPR)"
	title = "General Data Protection Regulation (GDPR)"

		@@ -0,0 +1,40 @@
		benchmark "article_32_security_of_processing" {

	benchmark "article_32_security_of_processing" {
	benchmark "article_32" {

	documentation = file("./gdpr/docs/article_32_security_of_processing.md")
	documentation = file("./gdpr/docs/article_32.md")

		@@ -0,0 +1,18 @@
		benchmark "article_30_records_of_processing_activities" {

	benchmark "article_30_records_of_processing_activities" {
	benchmark "article_30" {

	Run individual configuration, compliance and security controls or full compliance benchmarks for `AWS Foundational Security Best Practices`, `CIS`, `HIPAA`, `NIST 800-53`, `NIST CSF`, `PCI DSS`, `RBI Cyber Security Framework` and `GDPR` across all your AWS accounts.
	Run individual configuration, compliance and security controls or full compliance benchmarks for `AWS Foundational Security Best Practices`, `CIS`, `GDPR`, `HIPAA`, `NIST 800-53`, `NIST CSF`, `PCI DSS`, `RBI Cyber Security Framework` across all your AWS accounts.

Add AWS GDPR compliance framework. Closes #266 #267

Add AWS GDPR compliance framework. Closes #266 #267

Conversation

c0d3r-arnab commented Sep 2, 2021

Checklist

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cbruno10 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment