Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

AWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMS

JSON — GET /api/aws-evidenceMD — /collect/config-encryption-at-rest.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementconfig-rulecontinuousAWS ConfigAmazon S3Amazon EBSAmazon RDSAWS KMS

Fetch

$ aws configservice get-compliance-details-by-config-rule --config-rule-name encrypted-volumes --compliance-types NON_COMPLIANT
$ aws configservice get-compliance-details-by-config-rule --config-rule-name rds-storage-encrypted --compliance-types NON_COMPLIANT
$ aws configservice describe-configuration-recorder-status
$ aws configservice describe-config-rule-evaluation-status --config-rule-names encrypted-volumes
$ aws configservice describe-config-rule-evaluation-status --config-rule-names rds-storage-encrypted
$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text
$ aws organizations list-accounts --query 'Accounts[].Id' --output text

Expected output

Two EvaluationResults arrays; an empty NON_COMPLIANT set from each rule means every evaluated S3 bucket, attached EBS volume, and RDS instance is encrypted at rest. Managed rule identifiers: ENCRYPTED_VOLUMES, RDS_STORAGE_ENCRYPTED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

Assertions — what makes it a pass

Assertions for AWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMS: the field checked, the condition it must satisfy, the rows it applies to, and the controls a pass proves.
FieldMust beForProves
encrypted-volumes.EvaluationResultscount_eq 0Every attached EBS volume is encrypted.every rowSC-28
rds-storage-encrypted.EvaluationResultscount_eq 0Every RDS instance has encrypted storage.every rowSC-28
configuration-recorder-status.ConfigurationRecordersStatus[].recordingeq trueThe configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran.every rowSC-28
encrypted-volumes-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStartedeq trueencrypted-volumes has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result.every rowSC-28
encrypted-volumes-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTimeexistsencrypted-volumes has a successful evaluation on record.every rowSC-28
rds-storage-encrypted-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStartedeq truerds-storage-encrypted has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result.every rowSC-28
rds-storage-encrypted-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTimeexistsrds-storage-encrypted has a successful evaluation on record.every rowSC-28

Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.

Map — what it proves

  • recipe1
Key Security Indicators
KSI-SVC-SIN
NIST 800-53 controls
recipe · 1 recipeSC-28
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:SC 13/35 →

GovCloud

AWS Config and all three managed rules are available in AWS GovCloud (US); bucket, volume, DB, and KMS key ARNs use partition arn:aws-us-gov

Notes & assertions

These rules prove encryption is present, not which key backs it. Pass ENCRYPTED_VOLUMES and RDS_STORAGE_ENCRYPTED a kmsId/kmsKeyId parameter to additionally assert a specific CMK rather than any key. These three cover the dominant data stores; extend with the analogous rules for DynamoDB (dynamodb-table-encrypted-kms), EFS (efs-encrypted-check), SNS (sns-encrypted-kms), and other services you actually run — the recipe is the pattern, not the exhaustive list. The S3 rule was removed from this recipe: S3 has applied SSE-S3 to every bucket since 5 January 2023 and it cannot be disabled, so s3-bucket-server-side-encryption-enabled cannot fail and proved nothing. ENCRYPTED_VOLUMES sees attached volumes only, leaving detached volumes and every snapshot unproven, and no CMK is asserted — a human names the data stores in scope, confirms each has a rule, and reads key ownership for SC-28 (01), which is not claimed.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Service Configuration run (10)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under SVC, in the order the plan works them. The mark says how much of the evidence the command produces on its own.