Skip to content

hitrust.md

Latest commit

 

History

History
139 lines (106 loc) · 11.5 KB

hitrust.md

File metadata and controls

139 lines (106 loc) · 11.5 KB
Raw

HITRUST CSF (hitrust)

Certifiable control framework that harmonizes HIPAA, NIST and other authorities for healthcare information.

No AWS conformance pack exists for HITRUST CSF. NIST 800-53 Rev5 stands in; HITRUST requirement IDs are NOT mapped.

AWS Config conformance packs

Pinned to awslabs/aws-config-rules commit 3c4879c18c68.

Pack Template Control mapping
NIST-800-53-rev-5 YAML AWS docs

Profiles and validation

Baseline validation status: Sandbox-validated (Terraform, CDK).

Profile Composes How this baseline is used Partition Regions (primary; allowed) Terraform CDK
fedramp-moderate-hitrust.commercial fedramp-moderate + hipaa + hitrust composed: pack deployed, rules checked aws us-east-1; us-east-1, us-east-2, us-west-2 sandbox-validated (2026-10-27) sandbox-validated (2026-10-27)

Control coverage

130 AWS Config rules in the composed pack(s). Every rule is checked by sgea check or carries one recorded disposition (sources/inferred/rule-dispositions.yaml). Full list: row hitrust of docs/CONTROL-COVERAGE.md; rules by status:

Status Meaning Rules
checked Enclave-implemented, checked by sgea check (Terraform plan and CDK template) 52
implement Enclave-owned, not yet emitted (open gap) 0
tenant Tenant app (service allowed for tenants; the enclave creates none) 1
not-in-enclave Service neither deployed nor allowed (SCP-denied; vacuously compliant) 60
customer-prerequisite Customer prerequisite (landing zone, identity, VPC) 15
process Process (manual evidence, e.g. Audit Manager) 0
runtime-only Runtime-only (observable on the live account; AWS Config evaluates it) 2

Also: 8 documented exception(s) (NON_COMPLIANT by design) and 0 known open finding(s) apply — see Customer responsibilities.

Profiles composing this baseline also deploy and check the packs of: fedramp-moderate, hipaa. A deployment's coverage is the union of those pages.

What the enclave deploys

Both engines emit the same resources: see README — What the enclave deploys. Rules of this baseline the enclave implements and sgea check verifies, by service:

Service Checked rules
cloudtrail cloud-trail-cloud-watch-logs-enabled, cloud-trail-encryption-enabled, cloud-trail-log-file-validation-enabled, cloudtrail-enabled, cloudtrail-s3-dataevents-enabled, multi-region-cloudtrail-enabled
cloudwatch cloudwatch-alarm-action-check
cmk cmk-backing-key-rotation-enabled
dynamodb dynamodb-autoscaling-enabled, dynamodb-in-backup-plan, dynamodb-pitr-enabled, dynamodb-table-encrypted-kms
ec2 ebs-snapshot-public-restorable-check, ec2-ebs-encryption-by-default, vpc-default-security-group-closed, vpc-flow-logs-enabled
guardduty guardduty-enabled-centralized
iam iam-customer-policy-blocked-kms-actions, iam-inline-policy-blocked-kms-actions, iam-no-inline-policy-check, iam-password-policy, iam-policy-no-statements-with-admin-access, iam-policy-no-statements-with-full-access
kms kms-cmk-not-scheduled-for-deletion
lambda lambda-dlq-check, lambda-function-public-access-prohibited
rds db-instance-backup-enabled, rds-cluster-multi-az-enabled, rds-enhanced-monitoring-enabled, rds-instance-default-admin-check, rds-instance-deletion-protection-enabled, rds-instance-public-access-check, rds-logging-enabled, rds-multi-az-support, rds-snapshot-encrypted, rds-storage-encrypted
s3 s3-account-level-public-access-blocks-periodic, s3-bucket-level-public-access-prohibited, s3-bucket-logging-enabled, s3-bucket-public-read-prohibited, s3-bucket-public-write-prohibited, s3-bucket-replication-enabled, s3-bucket-server-side-encryption-enabled, s3-bucket-ssl-requests-only, s3-bucket-versioning-enabled, s3-default-encryption-kms, s3-event-notifications-enabled, s3-version-lifecycle-policy-check
secretsmanager secretsmanager-rotation-enabled-check, secretsmanager-using-cmk
securityhub securityhub-enabled
sns sns-encrypted-kms

SGEA's own Bedrock / AgentCore controls (sources/inferred/service-controls.yaml, all checked by sgea check; conditional ones apply only when the profile setting is on — e.g. DoD SCCA only with dod-il4 / dod-il5):

Service SGEA controls Conditional
bedrock 12 7
bedrock-agentcore 27 3
dod-scca 5 5

Customer responsibilities

Customer-prerequisite and process rules (15)

Rule Disposition Reason
access-keys-rotated customer-prerequisite IAM user access keys; the enclave creates no IAM users (roles only). Landing-zone identity baseline (IAM Identity Center).
account-part-of-organizations customer-prerequisite The enclave account must be an Organizations member (required for the SCP/RCP layer). Landing zone.
iam-root-access-key-check customer-prerequisite Root user hygiene is an account baseline (Control Tower / LZA).
iam-user-group-membership-check customer-prerequisite No IAM users in the enclave; identity via IAM Identity Center.
iam-user-mfa-enabled customer-prerequisite No IAM users in the enclave; identity via IAM Identity Center (MFA enforced there).
iam-user-unused-credentials-check customer-prerequisite No IAM users in the enclave.
mfa-enabled-for-iam-console-access customer-prerequisite No IAM users in the enclave; console access via IAM Identity Center with MFA.
no-unrestricted-route-to-igw customer-prerequisite Customer VPC routing; the enclave requires private subnets without IGW routes.
restricted-common-ports customer-prerequisite Security groups are customer inputs; the sandbox fixture allows only 443/5432 inside the VPC CIDR.
restricted-ssh customer-prerequisite Security groups are customer inputs (endpoint / agent / Aurora SGs); the sandbox fixture opens no SSH.
root-account-hardware-mfa-enabled customer-prerequisite Root user MFA is an account baseline (Control Tower / LZA); cannot be set by IaC.
root-account-mfa-enabled customer-prerequisite Root user MFA is an account baseline; cannot be set by IaC.
subnet-auto-assign-public-ip-disabled customer-prerequisite Customer VPC subnets; the enclave requires private subnets (sandbox fixture complies).
vpc-sg-open-only-to-authorized-ports customer-prerequisite Security groups are customer inputs; no 0.0.0.0/0 ingress in the sandbox fixture.
vpc-vpn-2-tunnels-up customer-prerequisite Site-to-site VPN (e.g. DoD BCAP path) is customer network; the enclave creates none.

Tenant, runtime-only and open-gap rules (3)

Rule Disposition Reason
dynamodb-throughput-limit-check runtime-only Account throughput vs. limit at runtime; the ledger is on-demand.
elasticache-redis-cluster-automatic-backup-check tenant ElastiCache is allowed for tenants; the enclave creates no cache.
rds-snapshots-public-prohibited runtime-only Snapshots exist only at runtime; Aurora is private, and the snapshot-sharing block is set account-wide (see ebs-snapshot-public-restorable-check for EBS).

Documented exceptions that apply (8)

Rule Resource Reason
s3-bucket-replication-enabled sgea-<env>-config-* AWS Config retains configuration history itself; the delivery bucket is not replicated.
s3-bucket-replication-enabled sgea-<env>-access-logs-* Access-log sink (and its replica-region twin) is not replicated: it records access to the replicated log store.
s3-bucket-replication-enabled sgea-<env>-logs-replica-* Cross-region replica of the log store: it is the replication destination.
s3-bucket-logging-enabled sgea-<env>-access-logs-* S3 server-access-log target cannot log to itself.
s3-default-encryption-kms sgea-<env>-access-logs-* S3 server-access logging supports only SSE-S3 (AES256) destination buckets, not SSE-KMS (AWS S3 User Guide); the access-log sink uses SSE-S3 with versioning, TLS-only policy and Block Public Access.
lambda-dlq-check * (cdk-deploy-helper) CDK deploy helpers are invoked synchronously by CloudFormation; failures surface as stack events, not dead letters.
cloudtrail-s3-dataevents-enabled * The enclave trail records S3 data events for every bucket except its own log store (resources.ARN NotStartsWith the log store): logging the trail's destination would record the trail's own writes in a feedback loop. Object-level access to the log store is recorded by its S3 server access logs (access-log sink), and the store is Object Lock / versioned, CMK-encrypted, replicated.
dynamodb-in-backup-plan * Time-dependent: AWS Config can evaluate the new token-ledger table before the backup plan that selects it exists ('No backup plans are available for evaluation'); the periodic re-evaluation (24 h), or start-config-rules-evaluation after deploy (MANUAL-STEPS), turns it COMPLIANT.

Known findings that apply (1)

Finding Rule Owner Status What to do / fix
SGEA-KF-01 s3-event-notifications-enabled enclave fixed The log store, the AWS Config delivery bucket and the access-log sink publish s3:ObjectRemoved:* to a CMK-encrypted SNS topic (sgea--log-store-events; topic policy limited to s3.amazonaws.com from this account and the enclave buckets; key policy statement S3EventNotificationsToEncryptedSns), in both engines. The cross-region replica buckets are exempt (tag sgea:region=replica), as in sgea check.

Evidence

Sandbox deployments of profiles composing this baseline, with the as-deployed configuration recorded (read-only) and compared to the profile. The reports are not part of this distribution; tools/collect_evidence.py produces them for your own deployment.

Profile Engine Collected (UTC) Settings observed Checked vs profile Meet
fedramp-moderate-hipaa-hitrust-commercial CDK 2026-10-27 14:44 UTC 186 103 100
fedramp-moderate-hipaa-hitrust-commercial Terraform 2026-10-27 15:43 UTC 183 99 97

Operations