AWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSL
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-ssl-requests-only --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name elb-tls-https-listeners-only --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name redshift-require-tls-ssl --compliance-types NON_COMPLIANT$ aws configservice describe-configuration-recorder-status$ aws configservice describe-config-rule-evaluation-status --config-rule-names s3-bucket-ssl-requests-only$ aws configservice describe-config-rule-evaluation-status --config-rule-names elb-tls-https-listeners-only$ aws configservice describe-config-rule-evaluation-status --config-rule-names redshift-require-tls-ssl$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text$ aws organizations list-accounts --query 'Accounts[].Id' --output textExpected output
Three EvaluationResults arrays; an empty NON_COMPLIANT set from each rule means every evaluated S3 bucket enforces aws:SecureTransport, every Classic Load Balancer listener is SSL/HTTPS, and every Redshift cluster sets require_SSL=true. Managed rule identifiers: S3_BUCKET_SSL_REQUESTS_ONLY, ELB_TLS_HTTPS_LISTENERS_ONLY, REDSHIFT_REQUIRE_TLS_SSL Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.
Assertions — what makes it a pass
| Field | Must be | For | Proves |
|---|---|---|---|
| s3-bucket-ssl-requests-only.EvaluationResults | count_eq 0Every evaluated S3 bucket policy denies requests without aws:SecureTransport. | every row | SC-08 |
| elb-tls-https-listeners-only.EvaluationResults | count_eq 0Every Classic Load Balancer listener terminates SSL/HTTPS. | every row | SC-08 |
| redshift-require-tls-ssl.EvaluationResults | count_eq 0Every Redshift cluster requires SSL. | every row | SC-08 |
| configuration-recorder-status.ConfigurationRecordersStatus[].recording | eq trueThe configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran. | every row | SC-08 |
| s3-bucket-ssl-requests-only-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted | eq trues3-bucket-ssl-requests-only has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result. | every row | SC-08 |
| s3-bucket-ssl-requests-only-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime | existss3-bucket-ssl-requests-only has a successful evaluation on record. | every row | SC-08 |
| elb-tls-https-listeners-only-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted | eq trueelb-tls-https-listeners-only has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result. | every row | SC-08 |
| elb-tls-https-listeners-only-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime | existselb-tls-https-listeners-only has a successful evaluation on record. | every row | SC-08 |
| redshift-require-tls-ssl-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted | eq trueredshift-require-tls-ssl has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result. | every row | SC-08 |
| redshift-require-tls-ssl-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime | existsredshift-require-tls-ssl has a successful evaluation on record. | every row | SC-08 |
Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.
Map — what it proves
- recipe1
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:SC 13/35 →
GovCloud
AWS Config and all three managed rules are available in AWS GovCloud (US); bucket, load-balancer, and cluster ARNs use partition arn:aws-us-gov
Notes & assertions
The SC-08.01 enhancement (cryptographic protection in transit) is the TLS requirement these rules assert. ELB_TLS_HTTPS_LISTENERS_ONLY covers Classic Load Balancers only — for Application/Network Load Balancers add elbv2-acm-certificate-required and alb-http-to-https-redirection-check, and pair with acm-certificate-expiration-check so the certs terminating TLS are valid. These three cover the dominant public data paths; extend to the services you actually run (e.g. api-gw-ssl-enabled, elasticsearch-node-to-node-encryption-check). ELB_TLS_HTTPS_LISTENERS_ONLY evaluates Classic Load Balancers only and returns NOT_APPLICABLE where there is no listener, so on an ALB/NLB estate that assertion passes having examined nothing; whether the TLS that terminates is FIPS-validated is carried by the listener's SslPolicy, which no command here reads, and a human confirms it — SC-08 (01) is not claimed.
References
- AWS Config managed rule: s3-bucket-ssl-requests-only https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-ssl-requests-only.html
- AWS Config managed rule: elb-tls-https-listeners-only https://docs.aws.amazon.com/config/latest/developerguide/elb-tls-https-listeners-only.html
- AWS Config managed rule: redshift-require-tls-ssl https://docs.aws.amazon.com/config/latest/developerguide/redshift-require-tls-ssl.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Service Configuration run (10)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under SVC, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMScontinuousconfig-encryption-at-restAWS Config · Amazon S3 · Amazon EBS · Amazon RDS · AWS KMS
- partialAWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSLyou are herecontinuousconfig-encryption-in-transitAWS Config · Amazon S3 · Elastic Load Balancing · Amazon Redshift
- partialAWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection controlcontinuousconfig-kms-key-managementAWS Config · AWS KMS
- partialAWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than driftingcontinuousssm-configuration-baseline-enforcedAWS Config · AWS Systems Manager
- partialCryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evidentweeklyintegrity-verification-and-immutabilityAWS CloudTrail · AWS Config · Amazon S3 · AWS Backup · Amazon ECR
- partialDNSSEC signing status of every public hosted zone, with the key-signing key state and the DS record that carries the chain of trust to the parentweeklyroute53-dnssec-signingAmazon Route 53 · AWS KMS
- partialPer-VPC DNSSEC validation status of the Route 53 Resolver, joined against the full VPC inventory so that a VPC which never enabled validation is visible rather than absentweeklyroute53-resolver-dnssec-validationAmazon Route 53 · Amazon VPC
- partialEvery place a client session terminates, with the protocol and negotiated policy it terminates under: listener protocol and SslPolicy on each load balancer, HTTP listeners that redirect rather than serve, an ACM certificate behind each one, and CloudFront viewer policies that refuse plain HTTPquarterlysession-authenticity-tls-terminationElastic Load Balancing · Amazon CloudFront · AWS Certificate Manager · AWS Config
- partialThe hosted zones that serve name resolution, each marked private or public so internal and external resolution can be shown to be served by separate zones, and the Resolver endpoints that carry queries across the VPC boundary with their direction and operational statuscontinuousname-resolution-role-separationAmazon Route 53 · Amazon Route 53 Resolver
- partialWhether secret scanning, push protection and validity checking are switched on in this organization and which repositories those settings actually reach, together with the alerts themselves — each carrying the kind of credential found, whether the credential was confirmed to still work, how it was closed and by whom, and whether a push containing it was blocked or waved through. The settings are the population; the alerts are what was found in it, and an alert list read without the settings beside it cannot be told apart from a list produced by scanning nothing.continuoussecret-exposure-detection-and-push-protectionGitHub secret scanning · GitHub code security configurations