rule_set_cmmc_level_2.json

{
  "owner": "AWS",
  "ruleSetName": "cmmc-level-2",
  "version": "1.0.0",
  "description": "AWS Guard rule set for Center for Cybersecurity Maturity Model Certification (CMMC) Level 2",
  "contact": "aws-guard-rules-registry@amazon.com",
  "mappings": [
    {
      "guardFilePath": "rules/aws/aws_dms/dms_replication_not_public.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_ec2/ec2_instance_no_public_ip.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_ec2/ec2_instance_profile_attached.guard",
      "controls": [
        "AC.1.001"
      ]
    },
    {
      "guardFilePath": "rules/aws/opensearch_service/elasticsearch_in_vpc_only.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_emr/emr_kerberos_enabled.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.2.007",
        "AC.2.008",
        "IA.1.076",
        "IA.1.077"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_emr/emr_master_no_public_ip.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062"
      ]
    },
    {
      "guardFilePath": "rules/aws/iam/iam_no_inline_policy_check.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.2.007",
        "AC.2.008"
      ]
    },
    {
      "guardFilePath": "rules/aws/iam/iam_policy_no_statements_with_admin_access.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.2.007",
        "AC.2.008"
      ]
    },
    {
      "guardFilePath": "rules/aws/iam/iam_policy_no_statements_with_full_access.guard",
      "controls": [
        "AC.1.001",
        "AC.2.007",
        "AC.2.008"
      ]
    },
    {
      "guardFilePath": "rules/aws/iam/iam_user_no_policies_check.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.2.007",
        "AC.2.008"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_ec2/restricted_ssh.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_ec2/ec2_instances_in_vpc.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.2.016",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/lambda/lambda_function_public_access_prohibited.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/lambda/lambda_inside_vpc.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.2.016",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_rds/rds_instance_public_access_check.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_redshift/redshift_cluster_public_access_check.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_ec2/restricted_common_ports.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_s3/s3_bucket_level_public_access_prohibited.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_s3/s3_bucket_policy_grantee_check.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.2.007"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_s3/s3_bucket_public_read_prohibited.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_s3/s3_bucket_public_write_prohibited.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_sagemaker/sagemaker_notebook_no_direct_internet_access.guard",
      "controls": [
        "AC.1.001",
        "AC.1.002",
        "AC.1.003",
        "AC.2.007",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/secrets_manager/secretsmanager_rotation_enabled_check.guard",
      "controls": [
        "AC.1.001"
      ]
    },
    {
      "guardFilePath": "rules/aws/elastic_load_balancing_v2/alb_waf_enabled.guard",
      "controls": [
        "AC.1.003",
        "AC.2.016",
        "SC.1.175",
        "SI.2.214",
        "SI.2.216"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_ec2_auto_scaling/autoscaling_launch_config_public_ip_disabled.guard",
      "controls": [
        "AC.1.003",
        "AC.2.016",
        "CM.2.062"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_ec2/no_unrestricted_route_to_igw.guard",
      "controls": [
        "AC.1.003",
        "AC.2.016",
        "CM.2.062",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_ec2/subnet_auto_assign_public_ip_disabled.guard",
      "controls": [
        "AC.1.003",
        "AC.2.016",
        "CM.2.062"
      ]
    },
    {
      "guardFilePath": "rules/aws/cloudwatch/cloudwatch_alarm_action_check.guard",
      "controls": [
        "AC.2.013",
        "IR.2.092",
        "IR.2.093",
        "SC.1.175",
        "SI.1.210",
        "SI.2.214"
      ]
    },
    {
      "guardFilePath": "rules/aws/cloudtrail/cloud_trail_cloud_watch_logs_enabled.guard",
      "controls": [
        "AC.2.013",
        "AU.2.041",
        "AU.2.042",
        "CM.2.065",
        "IA.1.076",
        "SI.2.214",
        "SI.2.216",
        "SI.2.217"
      ]
    },
    {
      "guardFilePath": "rules/aws/api_gateway/api_gw_execution_logging_enabled.guard",
      "controls": [
        "AU.2.041",
        "AU.2.042",
        "CM.2.065",
        "IA.1.076",
        "SI.2.217"
      ]
    },
    {
      "guardFilePath": "rules/aws/cloudtrail/cloudtrail_s3_dataevents_enabled.guard",
      "controls": [
        "AU.2.041",
        "AU.2.042",
        "CM.2.065",
        "IA.1.076",
        "SI.2.217"
      ]
    },
    {
      "guardFilePath": "rules/aws/elastic_load_balancing/elb_logging_enabled.guard",
      "controls": [
        "AU.2.041",
        "AU.2.042",
        "CM.2.065",
        "IA.1.076",
        "SI.2.217"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_rds/rds_logging_enabled.guard",
      "controls": [
        "AU.2.041",
        "AU.2.042",
        "CM.2.065",
        "IA.1.076",
        "SI.2.217"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_s3/s3_bucket_logging_enabled.guard",
      "controls": [
        "AU.2.041",
        "AU.2.042",
        "CM.2.065",
        "IA.1.076",
        "SI.2.217"
      ]
    },
    {
      "guardFilePath": "rules/aws/aws_waf_v2/wafv2_logging_enabled.guard",
      "controls": [
        "AU.2.041",
        "AU.2.042",
        "CM.2.065",
        "IA.1.076",
        "SI.2.216",
        "SI.2.217"
      ]
    },
    {
      "guardFilePath": "rules/aws/cloudwatch/cw_loggroup_retention_period_check.guard",
      "controls": [
        "AU.2.042"
      ]
    },
    {
      "guardFilePath": "rules/aws/cloudtrail/cloud_trail_log_file_validation_enabled.guard",
      "controls": [
        "CM.2.064"
      ]
    },
    {
      "guardFilePath": "rules/aws/elastic_beanstalk/elastic_beanstalk_managed_updates_enabled.guard",
      "controls": [
        "CM.2.064"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_rds/rds_automatic_minor_version_upgrade_enabled.guard",
      "controls": [
        "CM.2.064"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_redshift/redshift_cluster_maintenancesettings_check.guard",
      "controls": [
        "CM.2.064"
      ]
    },
    {
      "guardFilePath": "rules/aws/elastic_load_balancing_v2/alb_http_drop_invalid_header_enabled.guard",
      "controls": [
        "IA.2.081",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/elastic_load_balancing_v2/alb_http_to_https_redirection_check.guard",
      "controls": [
        "IA.2.081",
        "SC.1.175",
        "SC.2.179"
      ]
    },
    {
      "guardFilePath": "rules/aws/api_gateway/api_gw_cache_enabled_and_encrypted.guard",
      "controls": [
        "IA.2.081"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_efs/efs_encrypted_check.guard",
      "controls": [
        "IA.2.081"
      ]
    },
    {
      "guardFilePath": "rules/aws/opensearch_service/elasticsearch_encrypted_at_rest.guard",
      "controls": [
        "IA.2.081"
      ]
    },
    {
      "guardFilePath": "rules/aws/opensearch_service/elasticsearch_node_to_node_encryption_check.guard",
      "controls": [
        "IA.2.081",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/elastic_load_balancing_v2/elbv2_acm_certificate_required.guard",
      "controls": [
        "IA.2.081",
        "SC.2.179"
      ]
    },
    {
      "guardFilePath": "rules/aws/elastic_load_balancing/elb_acm_certificate_required.guard",
      "controls": [
        "IA.2.081",
        "SC.1.175",
        "SC.2.179"
      ]
    },
    {
      "guardFilePath": "rules/aws/elastic_load_balancing/elb_tls_https_listeners_only.guard",
      "controls": [
        "IA.2.081",
        "SC.1.175",
        "SC.2.179"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_ec2/encrypted_volumes.guard",
      "controls": [
        "IA.2.081"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_rds/rds_storage_encrypted.guard",
      "controls": [
        "IA.2.081"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_s3/s3_bucket_server_side_encryption_enabled.guard",
      "controls": [
        "IA.2.081"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_s3/s3_bucket_ssl_requests_only.guard",
      "controls": [
        "IA.2.081",
        "SC.1.175"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_s3/s3_default_encryption_kms.guard",
      "controls": [
        "IA.2.081"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_sagemaker/sagemaker_endpoint_configuration_kms_key_configured.guard",
      "controls": [
        "IA.2.081"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_sagemaker/sagemaker_notebook_instance_kms_key_configured.guard",
      "controls": [
        "IA.2.081"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_sns/sns_encrypted_kms.guard",
      "controls": [
        "IA.2.081"
      ]
    },
    {
      "guardFilePath": "rules/aws/lambda/lambda_dlq_check.guard",
      "controls": [
        "IR.2.092",
        "IR.2.093"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_ec2_auto_scaling/autoscaling_group_elb_healthcheck_required.guard",
      "controls": [
        "IR.2.093"
      ]
    },
    {
      "guardFilePath": "rules/aws/aws_backup/backup_plan_min_frequency_and_min_retention_check.guard",
      "controls": [
        "RE.2.137"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_rds/db_instance_backup_enabled.guard",
      "controls": [
        "RE.2.137"
      ]
    },
    {
      "guardFilePath": "rules/aws/dynamodb/dynamodb_in_backup_plan.guard",
      "controls": [
        "RE.2.137"
      ]
    },
    {
      "guardFilePath": "rules/aws/dynamodb/dynamodb_pitr_enabled.guard",
      "controls": [
        "RE.2.137"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_redshift/redshift_backup_enabled.guard",
      "controls": [
        "RE.2.137"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_s3/s3_bucket_replication_enabled.guard",
      "controls": [
        "RE.2.137"
      ]
    },
    {
      "guardFilePath": "rules/aws/amazon_s3/s3_bucket_versioning_enabled.guard",
      "controls": [
        "RE.2.137",
        "RE.2.139"
      ]
    }
  ]
}