Add AWS benchmark cis_v600 #941

khushboo9024 · 2025-09-28T12:36:41Z

Checklist

Issue(s) linked

Copilot

Pull Request Overview

This PR adds the AWS CIS (Center for Internet Security) v6.0.0 benchmark implementation, establishing a comprehensive security compliance framework for AWS services. The benchmark provides prescriptive guidance for configuring security options across various AWS services with emphasis on foundational, testable, and architecture-agnostic settings.

Key Changes:

Implements CIS v6.0.0 benchmark structure with 5 main sections (Identity & Access Management, Storage, Logging, Monitoring, Networking)
Adds 96 individual security controls across AWS services including IAM, S3, RDS, EFS, EC2, VPC, CloudTrail, CloudWatch, and Security Hub
Provides comprehensive documentation with remediation steps for each control

Reviewed Changes

Copilot reviewed 79 out of 80 changed files in this pull request and generated 6 comments.

File	Description
cis_v600/cis.pp	Main benchmark definition and structure
cis_v600/section_*.pp	Section implementations for Identity & Access Management, Storage, Logging, Monitoring, and Networking
cis_v600/docs/*.md	Comprehensive documentation including remediation procedures and default value explanations for all controls

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

cis_v600/section_3.pp

cis_v600/section_6.pp

cis_v600/docs/cis_v600_6_3.md

cis_v600/docs/cis_v600_5_11.md

Copilot · 2025-09-29T08:09:12Z

cis_v600/docs/cis_v600_5_13.md

+If you are using CloudTrail trails and CloudWatch, perform the following steps to set up the metric filter, alarm, SNS topic, and subscription:
+
+1. Create a metric filter based on the provided filter pattern that checks for route table changes and uses the `<trail-log-group-name>` taken from audit step 1:
+2. aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-pattern '{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }'


Command is missing required parameters --filter-name and --metric-transformations that are present in other similar commands in the codebase.

misraved

@khushboo9024 please take a look at the review comments, thanks!!

cis_v600/section_2.pp

cis_v600/section_3.pp

cis_v600/section_4.pp

CIS_Amazon_Web_Services_Foundations_Benchmark_v6.0.0.md

Copilot

Pull Request Overview

Copilot reviewed 80 out of 80 changed files in this pull request and generated 6 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

cis_v600/docs/cis_v600_5_7.md

cis_v600/docs/cis_v600_5_13.md

cis_v600/docs/cis_v600_5_11.md

cis_v600/docs/cis_v600_5_15.md

cis_v600/docs/cis_v600_5_10.md

Copilot · 2025-09-30T11:37:40Z

cis_v600/docs/cis_v600_4_4.md

+aws cloudtrail describe-trails --region <region-name> --query trailList[*].S3BucketName
+```
+
+2. Copy and add the target bucket name at `<bucket-name>`, the prefix for the log file at `<log-file-prefix>, `and optionally add an email address in the following template, then save it as` <file-name>.json:`


The sentence has inconsistent backtick usage and formatting. The backticks around text should be consistent and there's an extra backtick before '.json:'.

Suggested change

2. Copy and add the target bucket name at `<bucket-name>`, the prefix for the log file at `<log-file-prefix>, `and optionally add an email address in the following template, then save it as` <file-name>.json:`

2. Copy and add the target bucket name at `<bucket-name>`, the prefix for the log file at `<log-file-prefix>`, and optionally add an email address in the following template, then save it as `<file-name>.json`:

Copilot

Pull Request Overview

Copilot reviewed 79 out of 80 changed files in this pull request and generated 8 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

cis_v600/docs/cis_v600_6.md

Copilot · 2025-10-06T06:31:42Z

cis_v600/docs/cis_v600_5_2.md

+
+**Note**: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2.
+
+2. Create an SNS subscription for the topic created in step 2:


Step numbering is incorrect. The second instance of step '2' should be step '4' to maintain proper sequence in the remediation instructions.

cis_v600/docs/cis_v600_5_2.md

cis_v600/docs/cis_v600_5_13.md

cis_v600/docs/cis_v600_5_12.md

Copilot · 2025-10-06T06:31:43Z

cis_v600/docs/cis_v600_5_12.md

+5. Implement logging and alerting mechanisms:
+
+```bash
+aws sns create-topic --name NetworkGatewayChangesAlerts
+```
+
+```bash
+aws sns subscribe --topic-arn <sns-topic-arn> --protocol email --notification-endpoint <email-address>
+```
+
+```bash
+aws cloudwatch put-metric-alarm --alarm-name NetworkGatewayChangesAlarm --metric-name GatewayChanges --namespace AWS/EC2 --statistic Sum --period 300 --threshold 1 --comparisonoperator GreaterThanOrEqualToThreshold --evaluation-periods 1 --alarmactions <sns-topic-arn>
+```
+


This section appears to be duplicated content that doesn't match the established pattern of the document. The step numbering continues from 4 to 5, and the commands seem to be additional examples rather than part of the main remediation flow.

Suggested change

5. Implement logging and alerting mechanisms:

```bash

aws sns create-topic --name NetworkGatewayChangesAlerts

```

```bash

aws sns subscribe --topic-arn <sns-topic-arn> --protocol email --notification-endpoint <email-address>

```

```bash

aws cloudwatch put-metric-alarm --alarm-name NetworkGatewayChangesAlarm --metric-name GatewayChanges --namespace AWS/EC2 --statistic Sum --period 300 --threshold 1 --comparisonoperator GreaterThanOrEqualToThreshold --evaluation-periods 1 --alarmactions <sns-topic-arn>

```

cis_v600/docs/cis_v600_5_7.md

Copilot · 2025-10-06T06:31:43Z

cis_v600/docs/cis_v600_5_14.md

+aws logs put-metric-filter --log-group-name <trail-log-group-name> --filter-name <vpc-changes-metric> --metric-transformations metricName=<vpc-changesmetric>,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }'
+```
+
+**Note**:: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together.


Corrected double colon after 'Note' to single colon.

Suggested change

**Note**:: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together.

**Note**: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together.

khushboo9024 added 3 commits September 26, 2025 15:18

initial commit

bcb59ec

add docs

d4a9c9e

update

2b44f8d

khushboo9024 self-assigned this Sep 28, 2025

khushboo9024 requested a review from misraved September 28, 2025 13:32

misraved changed the base branch from main to release/v1.10.0 September 29, 2025 08:03

misraved requested a review from Copilot September 29, 2025 08:07

Copilot AI reviewed Sep 29, 2025

View reviewed changes

misraved reviewed Sep 29, 2025

View reviewed changes

khushboo9024 added 7 commits September 29, 2025 15:12

resolve review comments

a967f5a

update docs

812f873

update

7e97588

update

de47974

update docs

7993d9e

update

3c876a8

update

a4a7875

misraved requested a review from Copilot September 30, 2025 11:36

Copilot AI reviewed Sep 30, 2025

View reviewed changes

Fix formatting of the CIS docs

af25331

misraved requested a review from Copilot October 6, 2025 06:30

Copilot AI reviewed Oct 6, 2025

View reviewed changes

khushboo9024 added 2 commits October 6, 2025 12:36

addressed review comments

f08b659

update

144f8f9

	2. Copy and add the target bucket name at `<bucket-name>`, the prefix for the log file at `<log-file-prefix>, `and optionally add an email address in the following template, then save it as` <file-name>.json:`
	2. Copy and add the target bucket name at `<bucket-name>`, the prefix for the log file at `<log-file-prefix>`, and optionally add an email address in the following template, then save it as `<file-name>.json`:


		Note: Capture the `TopicArn` that is displayed when creating the SNS topic in step 2.

		2. Create an SNS subscription for the topic created in step 2:

	Note:: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together.
	Note: You can choose your own `metricName` and `metricNamespace` strings. Using the same `metricNamespace` for all Foundations Benchmark metrics will group them together.

Add AWS benchmark cis_v600 #941

Are you sure you want to change the base?

Add AWS benchmark cis_v600 #941

Uh oh!

Conversation

khushboo9024 commented Sep 28, 2025

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Key Changes:

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Sep 29, 2025

Choose a reason for hiding this comment

Uh oh!

misraved left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Sep 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Copilot AI Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!