Question 1

Is cloudwatch_log_group_kms_key_id enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, This control checks whether a CloudWatch Logs log group is associated with an AWS KMS key. CloudWatch Logs always encrypts log data at rest with a service-owned key; the control passes only if the log group has a KMS key configured and fails otherwise.

Question 2

Is cloudwatch_log_group_retention_in_days enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 3

Is cluster_monitoring_interval enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Enable AWS Relational Database Service (AWS RDS) to help monitor AWS RDS availability. This provides detailed visibility into the health of your AWS RDS database instances.

Question 4

Is deletion_protection enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, This control checks whether RDS clusters have deletion protection enabled. This control is intended for RDS DB instances. However, it can also generate findings for Aurora DB instances, Neptune DB instances, and AWS DocumentDB clusters. If these findings are not useful,then you can suppress them.

Control	Clause	Change
CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 AU-6(1)(3)	AU-6(1)(3)
Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled None	None
RDS clusters should have deletion protection enabledrds_db_cluster_deletion_protection_enabled None	None
RDS DB instances and clusters should have enhanced monitoring enabledrds_db_instance_and_cluster_enhanced_monitoring_enabled CA-7(a)(b)	CA-7(a)(b)
VPC Security groups should only allow unrestricted incoming traffic for authorized portsvpc_security_group_allows_ingress_authorized_ports AC-4	AC-4
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888vpc_security_group_allows_ingress_to_cassandra_ports AC-4	AC-4
VPC security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports (IPv4)vpc_security_group_remote_administration_ipv4 AC-4	AC-4

Controls