Question 1

Is block_public_acls enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Ensure that AWS Simple Storage Service (AWS S3) buckets are publicly accessible. This rule is non-compliant if an AWS S3 bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.

Question 2

Is block_public_policy enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Ensure that AWS Simple Storage Service (AWS S3) buckets are publicly accessible. This rule is non-compliant if an AWS S3 bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.

Question 3

Is ignore_public_acls enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Ensure that AWS Simple Storage Service (AWS S3) buckets are publicly accessible. This rule is non-compliant if an AWS S3 bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.

Question 4

Is lifecycle_rule enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, This control checks if AWS Simple Storage Service (AWS S3) version enabled buckets have lifecycle policy configured. This rule fails if AWS S3 lifecycle policy is not enabled.

Question 5

Is logging enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, AWS Simple Storage Service (AWS S3) server access logging provides a method to monitor the network for potential cybersecurity events.

Question 6

Is object_lock_enabled enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Ensure that your AWS Simple Storage Service (AWS S3) bucket has lock enabled, by default.

Question 7

Is object_ownership enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, This control checks whether AWS S3 bucket ACL allow access to all authenticated users.

Question 8

Is replication_configuration enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, AWS Simple Storage Service (AWS S3) Cross-Region Replication (CRR) supports maintaining adequate capacity and availability.

Question 9

Is restrict_public_buckets enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Ensure that AWS Simple Storage Service (AWS S3) buckets are publicly accessible. This rule is non-compliant if an AWS S3 bucket is not listed in the excludedPublicBuckets parameter and bucket level settings are public.

Question 10

Is server_side_encryption_configuration enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, To help protect data at rest, ensure encryption is enabled for your AWS Simple Storage Service (AWS S3) buckets.

Question 11

Is versioning enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, AWS Simple Storage Service (AWS S3) bucket versioning helps keep multiple variants of an object in the same AWS S3 bucket.

Control	Clause	Change
S3 buckets should have cross-region replication enableds3_bucket_cross_region_replication_enabled None	None
S3 buckets should have default encryption enabled using KMSs3_bucket_default_encryption_enabled_kms SC-28	SC-28
S3 buckets should have logging enableds3_bucket_logging_enabled AC-2(4)	AC-2(4)
S3 buckets should not be accessible to all authenticated userss3_bucket_not_accessible_to_all_authenticated_user AC-17(1)	AC-17(1)
S3 buckets should have object lock enableds3_bucket_object_lock_enabled None	None
S3 buckets with versioning enabled should have lifecycle policies configureds3_bucket_versioning_and_lifecycle_policy_enabled AU-11	AU-11
S3 buckets should have versioning enableds3_bucket_versioning_enabled AU-9(2)	AU-9(2)
S3 public access should be blocked at account levels3_public_access_block_account AC-17(1)	AC-17(1)
S3 public access should be blocked at bucket levels3_public_access_block_bucket None	None
VPC Security groups should only allow unrestricted incoming traffic for authorized portsvpc_security_group_allows_ingress_authorized_ports SC-7	SC-7

Controls