5.10 Ensure an AWS Managed Config Rule for encrypted volumes is applied to Web Tier - KMS ID

Information

AWS Config provides you with a detailed inventory of your AWS resources and their current configuration, and continuously records configuration changes to these resources.

You can evaluate these configurations and changes for compliance with ideal configurations as defined by AWS Config Rules.
Evaluation of Elastic Block Storage volume configuration to ensure encryption at rest is enabled which have been tagged as Web-Tier

Solution

Using the Amazon unified command line interface:

* Create locally a json file (similar with the below sample) with the configuration of the Config Rule, and save it as /tmp/ConfigRule.json:

{
"Description": "Checks whether Web Tier EBS volumes that are in an attached state are encrypted.",
"ConfigRuleName": "encrypted-volumes-web-tier",
"Source": {
"Owner": "AWS",
"SourceIdentifier": "ENCRYPTED_VOLUMES"
},
"InputParameters": "{\"kmsId\":\"<_web_tier_kms_key>_\"}",
"Scope": {
"TagKey": "_<web_tier_tag_>",
"TagValue": "_<web_tier_tag_value>_"
}
}

* Create a Config Rule using the configuration saved earlier:

aws configservice put-config-rule --config-rule file:///tmp/ConfigRule.json

See Also

https://workbench.cisecurity.org/files/260

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-28

Plugin: amazon_aws

Control ID: 289aba7b0bd261fac1fc1ac4ac6f17695781893911b02a9689ea897aecf42713