Guide
CIS AWS Foundations Benchmark v3.0: a guide to the controls
What the CIS benchmark for AWS contains, section by section, where to start and how to track your compliance over time.
What is the CIS AWS Foundations Benchmark?
The Center for Internet Security (CIS) publishes hardening benchmarks built by consensus among practitioners. The CIS AWS Foundations Benchmark describes the baseline configuration expected from an AWS account: identities, storage, logging, monitoring and networking.
- Version 3.0.0 is the current reference; AWS Security Hub offers a CIS v3.0.0 standard that automatically assesses part of its recommendations.
- Each recommendation is either level 1 (a reasonable baseline for everyone) or level 2 (defence in depth, for sensitive environments).
- Some recommendations are automated (checkable through the API), others manual (contact details, security questions, process reviews).
- The benchmark is not a certification: it is an assessment grid, often reused by external auditors.
The five sections of the benchmark
| Section | What it covers |
|---|---|
| 1. Identity and Access Management | Root user, MFA, password policy, access keys, least privilege, IAM Access Analyzer. |
| 2. Storage | S3 (public access, HTTPS, MFA Delete), default EBS encryption, RDS and EFS. |
| 3. Logging | Multi-region CloudTrail, log integrity and encryption, AWS Config, KMS key rotation, VPC flow logs. |
| 4. Monitoring | 15 CloudWatch metric filters and alarms on sensitive events, Security Hub enabled. |
| 5. Networking | NACLs and security groups on administration ports, default security group, VPC peering, IMDSv2. |
Section 1: protect the root user and identities
This is the largest section, and the one where the most serious gaps are found.
- Root user: no access keys, MFA enabled (hardware at level 2), used only for the rare tasks that require it.
- Passwords: at least 14 characters, no reuse of the last 24.
- MFA for every IAM user with console access.
- Unused credentials: disabled after 45 days; a single active key per user, rotated every 90 days.
- Least privilege: permissions granted through groups or roles, no policy granting
*:*, a dedicated AWS Support role, instance roles rather than keys on servers. - IAM Access Analyzer enabled, to spot unintended external access.
Section 2: storage
- S3: unencrypted HTTP requests denied in the bucket policy, Block Public Access at account and bucket level, MFA Delete on critical buckets.
- EBS: default encryption enabled in every region.
- RDS: encryption at rest, automatic minor upgrades, no public access.
- EFS: encrypted file systems.
Section 3: logging
- CloudTrail enabled in all regions, with log file validation and encryption with a customer-managed KMS key.
- Access logging on the S3 bucket receiving CloudTrail, and logging of S3 object reads and writes.
- AWS Config enabled in all regions.
- Rotation enabled on symmetric KMS keys.
- VPC flow logs enabled, at least for rejected traffic.
Section 4: monitoring
Recommendations 4.1 to 4.15 require a metric filter and a CloudWatch alarm on CloudTrail logs, so that you are alerted when:
- API calls are denied, a console sign-in happens without MFA or fails, the root user is used;
- an IAM policy, the CloudTrail or AWS Config configuration, or an S3 bucket policy changes;
- a KMS key is disabled or scheduled for deletion;
- a security group, a NACL, a network gateway, a route table or a VPC is changed;
- the AWS Organizations structure changes.
Recommendation 4.16 requires Security Hub to be enabled. Without these alarms, an incident can go unnoticed for weeks.
Section 5: networking
- No NACL or security group allows
0.0.0.0/0(or::/0) to administration ports such as 22 (SSH) and 3389 (RDP). - The default security group of every VPC blocks all traffic.
- VPC peering routes are limited to what is strictly needed.
- EC2 instances require IMDSv2 for the metadata service.
Where to start
If you are starting from scratch, first address what closes the major risks:
- MFA on the root user, and removal of its access keys.
- Multi-region CloudTrail with log file validation.
- S3 Block Public Access at account level.
- Closing administration ports open to the Internet.
- MFA on every console access.
- Then the section 4 alarms, which warn you if one of these settings is undone.
Tracking compliance over time
- Enable the Security Hub CIS v3.0.0 standard in every region you use: it continuously re-evaluates the automated controls.
- Add AWS Config rules for the controls specific to your context.
- Have the account audited regularly: the Silamir audit computes a CIS v3.0 score separate from the FSBP score, lists the failed controls with the affected resources and prioritises them with the rest of the findings.
Ready to audit your AWS account?
Subscribe on AWS Marketplace, deploy the read-only role and get your reports within the hour.