Skip to content

fedramp-high.md

Latest commit

 

History

History
143 lines (113 loc) · 13.5 KB

fedramp-high.md

File metadata and controls

143 lines (113 loc) · 13.5 KB
Raw

FedRAMP High (fedramp-high)

US federal cloud authorization baseline for high-impact systems (NIST SP 800-53 Rev 5 High).

AWS Config conformance packs

Pinned to awslabs/aws-config-rules commit 3c4879c18c68.

Pack Template Control mapping
FedRAMP-HighPart1 YAML AWS docs
FedRAMP-HighPart2 YAML AWS docs

Profiles and validation

Baseline validation status: Not deployment-validated (sgea verify / sgea check only); baseline flagged scaffold-unverified (sgea export needs --allow-unverified).

Profile Composes How this baseline is used Partition Regions (primary; allowed) Terraform CDK
dod-il5.govcloud dod-il5 settings inherited only (pack not deployed) aws-us-gov us-gov-west-1; us-gov-west-1, us-gov-east-1 not deployed (scaffold) not deployed (scaffold)
fedramp-high.govcloud fedramp-high composed: pack deployed, rules checked aws-us-gov us-gov-west-1; us-gov-west-1, us-gov-east-1 not deployed (scaffold) not deployed (scaffold)

Control coverage

145 AWS Config rules in the composed pack(s). Every rule is checked by sgea check or carries one recorded disposition (sources/inferred/rule-dispositions.yaml). Full list: row fedramp-high of docs/CONTROL-COVERAGE.md; rules by status:

Status Meaning Rules
checked Enclave-implemented, checked by sgea check (Terraform plan and CDK template) 69
implement Enclave-owned, not yet emitted (open gap) 0
tenant Tenant app (service allowed for tenants; the enclave creates none) 1
not-in-enclave Service neither deployed nor allowed (SCP-denied; vacuously compliant) 58
customer-prerequisite Customer prerequisite (landing zone, identity, VPC) 14
process Process (manual evidence, e.g. Audit Manager) 0
runtime-only Runtime-only (observable on the live account; AWS Config evaluates it) 3

Also: 16 documented exception(s) (NON_COMPLIANT by design) and 1 known open finding(s) apply — see Customer responsibilities.

What the enclave deploys

Both engines emit the same resources: see README — What the enclave deploys. Rules of this baseline the enclave implements and sgea check verifies, by service:

Service Checked rules
backup backup-plan-min-frequency-and-min-retention-check, backup-recovery-point-encrypted, backup-recovery-point-manual-deletion-disabled, backup-recovery-point-minimum-retention-check
cloudtrail cloud-trail-cloud-watch-logs-enabled, cloud-trail-encryption-enabled, cloud-trail-log-file-validation-enabled, cloudtrail-enabled, cloudtrail-s3-bucket-public-access-prohibited, cloudtrail-s3-dataevents-enabled, cloudtrail-security-trail-enabled, multi-region-cloudtrail-enabled
cloudwatch cloudwatch-alarm-action-check, cloudwatch-log-group-encrypted
cmk cmk-backing-key-rotation-enabled
cw cw-loggroup-retention-period-check
dynamodb dynamodb-autoscaling-enabled, dynamodb-in-backup-plan, dynamodb-pitr-enabled, dynamodb-resources-protected-by-backup-plan, dynamodb-table-encrypted-kms
ec2 ebs-snapshot-public-restorable-check, ec2-ebs-encryption-by-default, vpc-default-security-group-closed, vpc-flow-logs-enabled
guardduty guardduty-enabled-centralized
iam iam-customer-policy-blocked-kms-actions, iam-inline-policy-blocked-kms-actions, iam-no-inline-policy-check, iam-password-policy, iam-policy-no-statements-with-admin-access, iam-policy-no-statements-with-full-access
inspector inspector-ec2-scan-enabled, inspector-ecr-scan-enabled, inspector-lambda-standard-scan-enabled
kms kms-cmk-not-scheduled-for-deletion
lambda lambda-concurrency-check, lambda-dlq-check, lambda-function-public-access-prohibited, lambda-inside-vpc
rds aurora-resources-protected-by-backup-plan, db-instance-backup-enabled, rds-cluster-multi-az-enabled, rds-enhanced-monitoring-enabled, rds-in-backup-plan, rds-instance-deletion-protection-enabled, rds-instance-public-access-check, rds-logging-enabled, rds-multi-az-support, rds-resources-protected-by-backup-plan, rds-snapshot-encrypted, rds-storage-encrypted
s3 s3-account-level-public-access-blocks-periodic, s3-bucket-cross-region-replication-enabled, s3-bucket-default-lock-enabled, s3-bucket-level-public-access-prohibited, s3-bucket-logging-enabled, s3-bucket-public-read-prohibited, s3-bucket-public-write-prohibited, s3-bucket-replication-enabled, s3-bucket-server-side-encryption-enabled, s3-bucket-ssl-requests-only, s3-bucket-versioning-enabled, s3-default-encryption-kms, s3-resources-protected-by-backup-plan, s3-version-lifecycle-policy-check
secretsmanager secretsmanager-using-cmk
securityhub securityhub-enabled
sns sns-encrypted-kms

SGEA's own Bedrock / AgentCore controls (sources/inferred/service-controls.yaml, all checked by sgea check; conditional ones apply only when the profile setting is on — e.g. DoD SCCA only with dod-il4 / dod-il5):

Service SGEA controls Conditional
bedrock 11 6
bedrock-agentcore 27 3
dod-scca 5 5

Customer responsibilities

Customer-prerequisite and process rules (14)

Rule Disposition Reason
access-keys-rotated customer-prerequisite IAM user access keys; the enclave creates no IAM users (roles only). Landing-zone identity baseline (IAM Identity Center).
iam-group-has-users-check customer-prerequisite IAM groups/users are not created by the enclave; identity via IAM Identity Center.
iam-root-access-key-check customer-prerequisite Root user hygiene is an account baseline (Control Tower / LZA).
iam-user-group-membership-check customer-prerequisite No IAM users in the enclave; identity via IAM Identity Center.
iam-user-mfa-enabled customer-prerequisite No IAM users in the enclave; identity via IAM Identity Center (MFA enforced there).
iam-user-no-policies-check customer-prerequisite No IAM users in the enclave.
iam-user-unused-credentials-check customer-prerequisite No IAM users in the enclave.
mfa-enabled-for-iam-console-access customer-prerequisite No IAM users in the enclave; console access via IAM Identity Center with MFA.
no-unrestricted-route-to-igw customer-prerequisite Customer VPC routing; the enclave requires private subnets without IGW routes.
restricted-common-ports customer-prerequisite Security groups are customer inputs; the sandbox fixture allows only 443/5432 inside the VPC CIDR.
restricted-ssh customer-prerequisite Security groups are customer inputs (endpoint / agent / Aurora SGs); the sandbox fixture opens no SSH.
subnet-auto-assign-public-ip-disabled customer-prerequisite Customer VPC subnets; the enclave requires private subnets (sandbox fixture complies).
vpc-sg-open-only-to-authorized-ports customer-prerequisite Security groups are customer inputs; no 0.0.0.0/0 ingress in the sandbox fixture.
vpc-vpn-2-tunnels-up customer-prerequisite Site-to-site VPN (e.g. DoD BCAP path) is customer network; the enclave creates none.

Tenant, runtime-only and open-gap rules (4)

Rule Disposition Reason
dynamodb-throughput-limit-check runtime-only Account throughput vs. limit at runtime; the ledger is on-demand.
elasticache-redis-cluster-automatic-backup-check tenant ElastiCache is allowed for tenants; the enclave creates no cache.
guardduty-non-archived-findings runtime-only Operational: GuardDuty findings must be triaged within the window; the enclave enables GuardDuty (security-services).
rds-snapshots-public-prohibited runtime-only Snapshots exist only at runtime; Aurora is private, and the snapshot-sharing block is set account-wide (see ebs-snapshot-public-restorable-check for EBS).

Documented exceptions that apply (16)

Rule Resource Reason
s3-bucket-default-lock-enabled sgea-<env>-config-* AWS Config delivery bucket: S3 rejects writes to Object Lock buckets without a checksum header and the AWS Config writer sends none (verified: InsufficientDeliveryPolicyException). Otherwise identical hardening.
s3-bucket-default-lock-enabled sgea-<env>-access-logs-* S3 server-access-log target: log delivery does not support Object Lock targets reliably; access logs are not the system of record.
s3-bucket-replication-enabled sgea-<env>-config-* AWS Config retains configuration history itself; the delivery bucket is not replicated.
s3-bucket-replication-enabled sgea-<env>-access-logs-* Access-log sink (and its replica-region twin) is not replicated: it records access to the replicated log store.
s3-bucket-replication-enabled sgea-<env>-logs-replica-* Cross-region replica of the log store: it is the replication destination.
s3-bucket-logging-enabled sgea-<env>-access-logs-* S3 server-access-log target cannot log to itself.
aurora-resources-protected-by-backup-plan * Time-dependent: AWS Backup counts a resource as protected once its first recovery point exists (daily plan, 05:00 UTC). The enclave Aurora cluster is in the backup selection from deploy.
rds-resources-protected-by-backup-plan * Time-dependent (first recovery point); see aurora-resources-protected-by-backup-plan.
dynamodb-resources-protected-by-backup-plan * Time-dependent (first recovery point); the token ledger is in the backup selection from deploy.
s3-resources-protected-by-backup-plan * Time-dependent (first recovery point); the log / config stores are in the backup selection from deploy.
s3-default-encryption-kms sgea-<env>-access-logs-* S3 server-access logging supports only SSE-S3 (AES256) destination buckets, not SSE-KMS (AWS S3 User Guide); the access-log sink uses SSE-S3 with versioning, TLS-only policy and Block Public Access.
lambda-concurrency-check * (cdk-deploy-helper) CDK deploy helpers (AwsCustomResource provider, PropagationWait) run for seconds per deployment; reserving the pack's 500-1000 for each would exhaust account concurrency. Their log groups are CMK-encrypted with pack retention.
lambda-inside-vpc * (cdk-deploy-helper) CDK deploy helpers call AWS control-plane APIs during deployment only; they handle no enclave data.
lambda-dlq-check * (cdk-deploy-helper) CDK deploy helpers are invoked synchronously by CloudFormation; failures surface as stack events, not dead letters.
cloudtrail-s3-dataevents-enabled * The enclave trail records S3 data events for every bucket except its own log store (resources.ARN NotStartsWith the log store): logging the trail's destination would record the trail's own writes in a feedback loop. Object-level access to the log store is recorded by its S3 server access logs (access-log sink), and the store is Object Lock / versioned, CMK-encrypted, replicated.
dynamodb-in-backup-plan * Time-dependent: AWS Config can evaluate the new token-ledger table before the backup plan that selects it exists ('No backup plans are available for evaluation'); the periodic re-evaluation (24 h), or start-config-rules-evaluation after deploy (MANUAL-STEPS), turns it COMPLIANT.

Known findings that apply (1)

Finding Rule Owner Status What to do / fix
SGEA-KF-02 lambda-concurrency-check tenant open Choose one with your ISSO: (a) set reserved concurrency >= 500 on tenant functions and size the Lambda concurrency quota for them, or (b) deploy the conformance packs with a ConcurrencyLimitLow / High range that fits your workloads (the control — every function has a concurrency limit — is unchanged), or (c) record the tenant deviation as accepted.

Evidence

No sandbox evidence: no profile composing this baseline has been deployed. Verification is sgea verify and sgea check on the exported IaC only.

Operations