Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

How operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable instead

JSON — GET /api/aws-evidenceMD — /collect/remote-access-authorization-and-monitoring.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementcliweeklyAWS Systems Manager Session ManagerAWS Client VPNAWS ConfigAmazon EC2

Fetch

$ aws ssm get-document --name SSM-SessionManagerRunShell --document-version '$LATEST' --query Content --output text
$ aws ssm describe-sessions --state History --query 'Sessions[].{owner:Owner,target:Target,start:StartDate,end:EndDate,document:DocumentName,accessType:AccessType,maxDuration:MaxSessionDuration}'
$ aws ec2 describe-client-vpn-endpoints --query 'ClientVpnEndpoints[].{id:ClientVpnEndpointId,transport:TransportProtocol,auth:AuthenticationOptions[].Type,connectionLog:ConnectionLogOptions,splitTunnel:SplitTunnel,sessionTimeoutHours:SessionTimeoutHours,serverCert:ServerCertificateArn,selfServicePortal:SelfServicePortalUrl}'
$ aws ec2 describe-client-vpn-connections --client-vpn-endpoint-id <CLIENT_VPN_ENDPOINT_ID> --query 'Connections[].{user:Username,commonName:CommonName,clientIp:ClientIp,established:ConnectionEstablishedTime,ended:ConnectionEndTime,status:Status,posture:PostureComplianceStatuses}'
$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-instance-no-public-ip --compliance-types NON_COMPLIANT

Expected output

The Session Manager preferences document as JSON — s3BucketName, s3KeyPrefix, s3EncryptionEnabled, cloudWatchLogGroupName, cloudWatchEncryptionEnabled, cloudWatchStreamingEnabled, kmsKeyId, runAsEnabled, idleSessionTimeout and maxSessionDuration — which is your Region's entire remote-access logging and encryption configuration in one object. Then one row per terminated session from the past 30 days carrying Owner, Target, StartDate, EndDate, DocumentName, MaxSessionDuration and AccessType of Standard or JustInTime. Then per Client VPN endpoint the transport protocol tcp or udp, the authentication types in use (certificate-authentication, directory-service-authentication or federated-authentication), ConnectionLogOptions with Enabled plus CloudwatchLogGroup and CloudwatchLogStream, SplitTunnel, SessionTimeoutHours of 8, 10, 12 or 24 (default 24) and the server certificate ARN. Then per connection Username (Active Directory authentication only), CommonName, ClientIp, ConnectionEstablishedTime, ConnectionEndTime, Status and any PostureComplianceStatuses — active connections plus only those terminated within the last 60 minutes. Finally the EC2 instances AWS Config evaluated NON_COMPLIANT because a publicIp field is present in their configuration item.

Map — what it proves

  • recipe4
Key Security Indicators
KSI-IAM-ELPKSI-MLA-LETKSI-SVC-ASMKSI-CNA-ULN
NIST 800-53 controls
recipe · 1 recipeAC-17recipe · 1 recipeAC-17 (01)recipe · 1 recipeAC-17 (02)recipe · 1 recipeAC-17 (03)
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:AC 16/50 →

Submits toward

MAS-CSO-FLOInformation Flows and Security CategoriesMUST
  • A machine readable output containing all required data of the permitted connections between components of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.
  • A human readable explanation of how the machine readable output is derived.
  • The code for the automated process used to generate the machine readable output.

This recipe’s output is the machine-readable half. The human readable derivation and the collector’s own code are artifacts you still owe — the rule demands all three.

GovCloud

Both access paths exist in AWS GovCloud (US-East) and (US-West). Client VPN endpoints there operate using FIPS 140-3 validated cryptographic modules and a fixed cipher set — TLS 1.3 TLS_AES_256_GCM_SHA384 and TLS_AES_128_GCM_SHA256; TLS 1.2 TLS-ECDHE-RSA/ECDSA-WITH-AES-256-GCM-SHA384 and the AES-128-GCM-SHA256 variants; data channel AES-256-GCM — and AWS advises using the exported client configuration file unmodified rather than configuring other ciphers, which makes AC-17(2) there largely a matter of not breaking the default. Systems Manager runs in both Regions; Change Manager and Incident Manager do not, and State Manager association history cannot be viewed, none of which this recipe touches. ec2-instance-no-public-ip is documented for all supported AWS Regions. Calls to these services must use SSL (HTTPS), and ARNs use partition arn:aws-us-gov

Notes & assertions

The commands split cleanly across the control family, and the gap in the middle is the one to be honest about. AC-17(1) — automated monitoring and control of remote access — is what session history and connection logs deliver, with two documented blind spots. Session Manager does not log sessions that connect through port forwarding or SSH, because SSH encrypts the session data inside the TLS connection and Session Manager is only the tunnel; an operator who port-forwards leaves a session record with no command content behind it. And describe-sessions reaches back 30 days only, so anything longer is an S3 or CloudWatch Logs query against the destinations named in the preferences document, not an SSM call. Client VPN retention is shorter still — terminated connections drop out of the API after 60 minutes, which makes the log group named in ConnectionLogOptions the only durable record, and Username is populated only for Active Directory authentication, so certificate-authenticated users are identified by CommonName or not at all. AC-17(2) is the strongest link in GovCloud, where the endpoints are FIPS 140-3 modules by construction; the Session Manager equivalent is kmsKeyId in the preferences document, and it is empty unless you set it, so an empty kmsKeyId is a finding rather than a default. AC-17(3) — routing remote access through managed network access control points — is the one nothing here proves. Session Manager and a Client VPN endpoint are managed access points, and ec2-instance-no-public-ip is the closest negative check, but that rule applies only to IPv4 and only to AWS::EC2::Instance: an IPv6-reachable instance, a load balancer fronting SSH, or a third-party jump host is invisible to it. Read the result as 'no EC2 instance carries a public IPv4 address', which is a useful sentence and not the control. AC-17 itself — the documented usage restrictions, configuration requirements and per-type authorization — is a record you write, and this telemetry only shows whether the estate matches it. One warning to carry into the evidence package: Session Manager logs the commands entered and their output, so a credential typed into a session lands in the log group you are about to hand an assessor.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Identity and Access Management run (16)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under IAM, in the order the plan works them. The mark says how much of the evidence the command produces on its own.