Question 1

Is flow_log_cloudwatch_log_group_kms_key_id enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, To help protect sensitive data at rest, ensure encryption is enabled for your AWS CloudWatch Log Group.

Question 2

Is flow_log_cloudwatch_log_group_retention_in_days enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 3

Is map_public_ip_on_launch enforced for FedRAMP Moderate Baseline Rev 4?

Accepted Answer

Yes, Ensure that AWS Virtual Private Cloud (AWS VPC) subnets are assigned a public IP address. The control is compliant if AWS VPC does not have subnets that are assigned a public IP address. The control is non-compliant if AWS VPC has subnets that are assigned a public IP address.

Control	Clause	Change
CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 AU-6(1)(3)	AU-6(1)(3)
Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled None	None
VPC subnet auto assign public IP should be disabledvpc_subnet_auto_assign_public_ip_disabled None	None

Controls