| 1.1.1 Ensure NGINX is installed | CIS NGINX v3.0.0 L1 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 1.2.1 Ensure package manager repositories are properly configured | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 1.2.1 Ensure package manager repositories are properly configured | CIS NGINX v3.0.0 L1 Webserver | Unix | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 2.2.1 Ensure that NGINX is run using a non-privileged, dedicated service account | CIS NGINX v3.0.0 L1 Webserver | Unix | ACCESS CONTROL |
| 2.2.3 Ensure the NGINX service account has an invalid shell | CIS NGINX v3.0.0 L1 Proxy | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 2.3.2 Ensure access to NGINX directories and files is restricted | CIS NGINX v3.0.0 L1 Webserver | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 2.5.2 Ensure default error and index.html pages do not reference NGINX | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.5.2 Ensure default error and index.html pages do not reference NGINX | CIS NGINX v3.0.0 L1 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 2.5.4 Ensure the NGINX reverse proxy does not enable information disclosure | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | SYSTEM AND SERVICES ACQUISITION |
| 3.2 Ensure access logging is enabled | CIS NGINX v3.0.0 L1 Webserver | Unix | AUDIT AND ACCOUNTABILITY |
| 3.3 Ensure error logging is enabled and set to the info logging level | CIS NGINX v3.0.0 L1 Proxy | Unix | AUDIT AND ACCOUNTABILITY |
| 3.3 Ensure error logging is enabled and set to the info logging level | CIS NGINX v3.0.0 L1 Webserver | Unix | AUDIT AND ACCOUNTABILITY |
| 3.4 Ensure proxies pass source IP information | CIS NGINX v3.0.0 L1 Proxy | Unix | AUDIT AND ACCOUNTABILITY |
| 3.4.3 Ensure /etc/hosts.deny is configured | CIS Amazon Linux v2.1.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.1 Ensure iptables is installed | CIS Amazon Linux v2.1.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.2 Ensure default deny firewall policy - Chain FORWARD | CIS Amazon Linux v2.1.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 3.6.2 Ensure default deny firewall policy - Chain INPUT | CIS Amazon Linux v2.1.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.1 Ensure HTTP is redirected to HTTPS | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.2 Ensure a trusted certificate and trust chain is installed | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.3 Ensure private key permissions are restricted | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.4 Ensure only modern TLS protocols are used | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.9 Ensure upstream server traffic is authenticated with a client certificate | CIS NGINX v3.0.0 L1 Proxy | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.1.5 Ensure remote rsyslog messages are only accepted on designated log hosts. - $ModLoad imtcp | CIS Amazon Linux v2.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 4.2.2.3 Ensure syslog-ng default file permissions configured | CIS Amazon Linux v2.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.2.3 Ensure rsyslog or syslog-ng is installed | CIS Amazon Linux v2.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 4.3 Ensure logrotate is configured | CIS Amazon Linux v2.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.1.1 Ensure allow and deny filters limit access to specific IP addresses | CIS NGINX v3.0.0 L2 Webserver | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.2 Ensure only approved HTTP methods are allowed | CIS NGINX v3.0.0 L1 Proxy | Unix | PLANNING, SYSTEM AND SERVICES ACQUISITION |
| 5.1.6 Ensure permissions on /etc/cron.monthly are configured | CIS Amazon Linux v2.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 5.2.1 Ensure timeout values for reading the client header and body are set correctly | CIS NGINX v3.0.0 L1 Proxy | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.2 Ensure the maximum request body size is set correctly | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.3 Ensure SSH LogLevel is set to INFO | CIS Amazon Linux v2.1.0 L1 | Unix | AUDIT AND ACCOUNTABILITY |
| 5.2.3 Ensure the maximum buffer size for URIs is defined | CIS NGINX v3.0.0 L1 Loadbalancer | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.3 Ensure the maximum buffer size for URIs is defined | CIS NGINX v3.0.0 L1 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.5 Ensure rate limits by IP address are set | CIS NGINX v3.0.0 L2 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.2.5 Ensure SSH MaxAuthTries is set to 4 or less | CIS Amazon Linux v2.1.0 L1 | Unix | ACCESS CONTROL |
| 5.2.11 Ensure only approved MAC algorithms are used | CIS Amazon Linux v2.1.0 L1 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.2.14 Ensure SSH access is limited | CIS Amazon Linux v2.1.0 L1 | Unix | ACCESS CONTROL |
| 5.3.1 Ensure password creation requirements are configured - password-auth ocredit | CIS Amazon Linux v2.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.3.1 Ensure X-Content-Type-Options header is configured and enabled | CIS NGINX v3.0.0 L1 Webserver | Unix | SYSTEM AND SERVICES ACQUISITION |
| 5.3.2 Ensure lockout for failed password attempts is configured - password-auth 'auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900' | CIS Amazon Linux v2.1.0 L1 | Unix | ACCESS CONTROL |
| 5.3.2 Ensure lockout for failed password attempts is configured - system-auth 'auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900' | CIS Amazon Linux v2.1.0 L1 | Unix | ACCESS CONTROL |
| 5.4.1.2 Ensure minimum days between password changes is 7 or more - users | CIS Amazon Linux v2.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 5.4.4 Ensure default user umask is 027 or more restrictive - /etc/profile | CIS Amazon Linux v2.1.0 L1 | Unix | ACCESS CONTROL |
| 6.1.6 Ensure permissions on /etc/passwd- are configured | CIS Amazon Linux v2.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 6.1.13 Audit SUID executables | CIS Amazon Linux v2.1.0 L1 | Unix | ACCESS CONTROL |
| 6.2.1 Ensure password fields are not empty | CIS Amazon Linux v2.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
| 6.2.10 Ensure users' dot files are not group or world writable | CIS Amazon Linux v2.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 6.2.14 Ensure no users have .rhosts files | CIS Amazon Linux v2.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 6.2.18 Ensure no duplicate user names exist | CIS Amazon Linux v2.1.0 L1 | Unix | IDENTIFICATION AND AUTHENTICATION |
