Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

AWS Config compliance results proving the network boundary is controlled — no security group exposes SSH to the internet, groups open to 0.0.0.0/0 only allow authorized ports, and every VPC's default security group denies all traffic

JSON — GET /api/aws-evidenceMD — /collect/config-network-boundary-protection.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementconfig-rulecontinuousAWS ConfigAmazon VPCAmazon EC2

Fetch

$ aws configservice get-compliance-details-by-config-rule --config-rule-name restricted-ssh --compliance-types NON_COMPLIANT
$ aws configservice get-compliance-details-by-config-rule --config-rule-name vpc-sg-open-only-to-authorized-ports --compliance-types NON_COMPLIANT
$ aws configservice get-compliance-details-by-config-rule --config-rule-name vpc-default-security-group-closed --compliance-types NON_COMPLIANT
$ aws configservice describe-configuration-recorder-status
$ aws configservice describe-config-rule-evaluation-status --config-rule-names restricted-ssh
$ aws configservice describe-config-rule-evaluation-status --config-rule-names vpc-sg-open-only-to-authorized-ports
$ aws configservice describe-config-rule-evaluation-status --config-rule-names vpc-default-security-group-closed
$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text
$ aws organizations list-accounts --query 'Accounts[].Id' --output text

Expected output

Three EvaluationResults arrays; empty NON_COMPLIANT sets mean no security group leaves SSH (port 22) open to 0.0.0.0/0 or ::/0, any internet-open group is limited to the authorizedTcpPorts/authorizedUdpPorts you set, and every default security group is closed. Managed rule identifiers: INCOMING_SSH_DISABLED (rule name restricted-ssh), VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS, VPC_DEFAULT_SECURITY_GROUP_CLOSED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

Assertions — what makes it a pass

Assertions for AWS Config compliance results proving the network boundary is controlled — no security group exposes SSH to the internet, groups open to 0.0.0.0/0 only allow authorized ports, and every VPC's default security group denies all traffic: the field checked, the condition it must satisfy, the rows it applies to, and the controls a pass proves.
FieldMust beForProves
restricted-ssh.EvaluationResultscount_eq 0No security group exposes port 22 to 0.0.0.0/0 or ::/0.every rowSC-07
vpc-sg-open-only-to-authorized-ports.EvaluationResultscount_eq 0Any internet-open security group is limited to the ports you declared authorized.every rowSC-07
vpc-default-security-group-closed.EvaluationResultscount_eq 0Every VPC default security group denies all inbound and outbound traffic.every rowSC-07
configuration-recorder-status.ConfigurationRecordersStatus[].recordingeq trueThe configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran.every rowSC-07
restricted-ssh-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStartedeq truerestricted-ssh has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result.every rowSC-07
restricted-ssh-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTimeexistsrestricted-ssh has a successful evaluation on record.every rowSC-07
vpc-sg-open-only-to-authorized-ports-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStartedeq truevpc-sg-open-only-to-authorized-ports has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result.every rowSC-07
vpc-sg-open-only-to-authorized-ports-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTimeexistsvpc-sg-open-only-to-authorized-ports has a successful evaluation on record.every rowSC-07
vpc-default-security-group-closed-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStartedeq truevpc-default-security-group-closed has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result.every rowSC-07
vpc-default-security-group-closed-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTimeexistsvpc-default-security-group-closed has a successful evaluation on record.every rowSC-07

Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.

Map — what it proves

  • recipe1
Key Security Indicators
KSI-CNA-ULNKSI-SVC-EIS
NIST 800-53 controls
recipe · 1 recipeSC-07
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:SC 13/35 →

GovCloud

AWS Config and all three managed rules are available in AWS GovCloud (US); VPC and security-group ARNs use partition arn:aws-us-gov

Notes & assertions

Set VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS parameters (authorizedTcpPorts/authorizedUdpPorts) to your documented ingress allow-list, otherwise any 0.0.0.0/0 rule is NON_COMPLIANT. These three cover security-group ingress; for full SC-07 boundary evidence also collect NACL and subnet routing posture and, where used, restricted-common-ports and vpc-flow-logs-enabled. Note VPC_DEFAULT_SECURITY_GROUP_CLOSED may lag on deleted VPCs until the next baselining pass. These three rules read security-group ingress and nothing else; SC-07(b) — the logical separation FedRAMP's own guidance singles out — plus NACLs, route tables, gateways and VPC endpoints are a human's architecture assertion against this output. MAS-CSO-FLO is not claimed: its artifact is the enumeration of permitted connections, and a NON_COMPLIANT filter is empty on a compliant estate.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Cloud Native Architecture run (7)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under CNA, in the order the plan works them. The mark says how much of the evidence the command produces on its own.