Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

AWS Config compliance results proving continuous security monitoring is switched on account-wide — GuardDuty threat detection enabled (optionally centralized to a delegated admin) and Security Hub aggregating control findings

JSON — GET /api/aws-evidenceMD — /collect/config-threat-monitoring-enabled.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementconfig-rulecontinuousAWS ConfigAmazon GuardDutyAWS Security Hub

Fetch

$ aws configservice get-compliance-details-by-config-rule --config-rule-name guardduty-enabled-centralized --compliance-types NON_COMPLIANT
$ aws configservice get-compliance-details-by-config-rule --config-rule-name securityhub-enabled --compliance-types NON_COMPLIANT
$ aws configservice describe-configuration-recorder-status
$ aws configservice describe-config-rule-evaluation-status --config-rule-names guardduty-enabled-centralized
$ aws configservice describe-config-rule-evaluation-status --config-rule-names securityhub-enabled
$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text
$ aws organizations list-accounts --query 'Accounts[].Id' --output text

Expected output

Two EvaluationResults arrays; empty NON_COMPLIANT sets mean GuardDuty is enabled in the account/Region (and results land in the CentralMonitoringAccount if you set one) and Security Hub is enabled. Managed rule identifiers: GUARDDUTY_ENABLED_CENTRALIZED, SECURITYHUB_ENABLED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

Assertions — what makes it a pass

Assertions for AWS Config compliance results proving continuous security monitoring is switched on account-wide — GuardDuty threat detection enabled (optionally centralized to a delegated admin) and Security Hub aggregating control findings: the field checked, the condition it must satisfy, the rows it applies to, and the controls a pass proves.
FieldMust beForProves
guardduty-enabled-centralized.EvaluationResultscount_eq 0GuardDuty is enabled in the account and Region, or in the CentralMonitoringAccount when one is named — the parameter moves where the rule looks; it does not prove this account reports anywhere.every rowSI-04
securityhub-enabled.EvaluationResultscount_eq 0Security Hub is enabled and aggregating control findings.every rowSI-04
configuration-recorder-status.ConfigurationRecordersStatus[].recordingeq trueThe configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran.every rowSI-04
guardduty-enabled-centralized-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStartedeq trueguardduty-enabled-centralized has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result.every rowSI-04
guardduty-enabled-centralized-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTimeexistsguardduty-enabled-centralized has a successful evaluation on record.every rowSI-04
securityhub-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStartedeq truesecurityhub-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result.every rowSI-04
securityhub-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTimeexistssecurityhub-enabled has a successful evaluation on record.every rowSI-04

Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.

Map — what it proves

  • recipe1
Key Security Indicators
KSI-MLA-RVLKSI-SVC-EIS
NIST 800-53 controls
recipe · 1 recipeSI-04
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:SI 10/35 →

GovCloud

AWS Config, GuardDuty, and Security Hub are available in AWS GovCloud (US); detector and hub ARNs use partition arn:aws-us-gov

Notes & assertions

This proves the monitoring capability is ON, which is the automatable half of SI-04. Whether findings are triaged and acted on within your SLA is the review workflow — surface that with the GuardDuty finding-plus-response recipe (see guardduty-suspicious-iam-activity-response) and AU-06 log review. Set CentralMonitoringAccount to your delegated-administrator account id in a multi-account org so member accounts are evaluated against the aggregation point. Both rules are evaluated per Region, so GuardDuty disabled in any Region other than the one queried is invisible; and whether findings are analyzed and acted on — SI-04(a), (b), (d) — is a human workflow. Partial for both reasons.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Monitoring, Logging, and Auditing run (7)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under MLA, in the order the plan works them. The mark says how much of the evidence the command produces on its own.