SVC — Service Configuration
7 indicators, 37 controls in scope for class C; 26 of them have an authored recipe.
Class C vulnerability-response floor
VDR floor3 days
- tightest MUST
- 3 days — VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
A response floor, not a collection interval — why
This is a class-widefloor on responding to a vulnerability, quoted in the dataset’s own units and never converted. It is not a per-check collection interval — the rules author none. Schedule against the MUST; the tightest entry may be a SHOULD.
- automatable
- partial — needs judgement
- narrative — no API proves this
partialAWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMS
continuousconfig-rule
$ aws configservice get-compliance-details-by-config-rule --config-rule-name encrypted-volumes --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name rds-storage-encrypted --compliance-types NON_COMPLIANT$ aws configservice describe-configuration-recorder-status$ aws configservice describe-config-rule-evaluation-status --config-rule-names encrypted-volumes$ aws configservice describe-config-rule-evaluation-status --config-rule-names rds-storage-encrypted$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text$ aws organizations list-accounts --query 'Accounts[].Id' --output textprovesKSI-SVC-SIN→SC-28
partialAWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSL
continuousconfig-rule
$ aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-ssl-requests-only --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name elb-tls-https-listeners-only --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name redshift-require-tls-ssl --compliance-types NON_COMPLIANT$ aws configservice describe-configuration-recorder-status$ aws configservice describe-config-rule-evaluation-status --config-rule-names s3-bucket-ssl-requests-only$ aws configservice describe-config-rule-evaluation-status --config-rule-names elb-tls-https-listeners-only$ aws configservice describe-config-rule-evaluation-status --config-rule-names redshift-require-tls-ssl$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text$ aws organizations list-accounts --query 'Accounts[].Id' --output textprovesKSI-SVC-SIN→SC-08
partialAWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection control
continuousconfig-rule
$ aws configservice get-compliance-details-by-config-rule --config-rule-name cmk-backing-key-rotation-enabled --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name kms-cmk-not-scheduled-for-deletion --compliance-types NON_COMPLIANTprovesKSI-SVC-SINKSI-SVC-VRI→SC-13
partialAWS Config compliance results proving the network boundary is controlled — no security group exposes SSH to the internet, groups open to 0.0.0.0/0 only allow authorized ports, and every VPC's default security group denies all traffic
continuousconfig-rule
$ aws configservice get-compliance-details-by-config-rule --config-rule-name restricted-ssh --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name vpc-sg-open-only-to-authorized-ports --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name vpc-default-security-group-closed --compliance-types NON_COMPLIANT$ aws configservice describe-configuration-recorder-status$ aws configservice describe-config-rule-evaluation-status --config-rule-names restricted-ssh$ aws configservice describe-config-rule-evaluation-status --config-rule-names vpc-sg-open-only-to-authorized-ports$ aws configservice describe-config-rule-evaluation-status --config-rule-names vpc-default-security-group-closed$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text$ aws organizations list-accounts --query 'Accounts[].Id' --output textprovesKSI-CNA-ULNKSI-SVC-EIS→SC-07
partialAWS Config compliance results proving continuous security monitoring is switched on account-wide — GuardDuty threat detection enabled (optionally centralized to a delegated admin) and Security Hub aggregating control findings
continuousconfig-rule
$ aws configservice get-compliance-details-by-config-rule --config-rule-name guardduty-enabled-centralized --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name securityhub-enabled --compliance-types NON_COMPLIANT$ aws configservice describe-configuration-recorder-status$ aws configservice describe-config-rule-evaluation-status --config-rule-names guardduty-enabled-centralized$ aws configservice describe-config-rule-evaluation-status --config-rule-names securityhub-enabled$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text$ aws organizations list-accounts --query 'Accounts[].Id' --output textprovesKSI-MLA-RVLKSI-SVC-EIS→SI-04
partialAWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than drifting
continuouscli
$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-instance-managed-by-systems-manager --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-association-compliance-status-check --compliance-types NON_COMPLIANT$ aws ssm list-associations --query 'Associations[].{Name:Name,AssociationId:AssociationId,Schedule:ScheduleExpression,Targets:Targets,Status:Overview.Status,LastRun:LastExecutionDate}'partialThe machine-maintained component inventory — Config's recorder status and discovered-resource counts proving supported resources are tracked continuously and the list stays current without anyone editing a spreadsheet, plus Systems Manager Inventory's node and installed-application metadata for what runs inside them
dailycli
$ aws configservice describe-configuration-recorder-status --query 'ConfigurationRecordersStatus[].{Name:name,Recording:recording,LastStatus:lastStatus,LastStart:lastStartTime,Error:lastErrorMessage}'$ aws configservice get-discovered-resource-counts$ aws configservice select-resource-config --expression "SELECT resourceId, resourceType, awsRegion WHERE resourceType = 'AWS::EC2::Instance'"$ aws ssm get-inventory --aggregators Expression=AWS:InstanceInformation.PlatformType$ aws ssm list-inventory-entries --instance-id i-0123456789abcdef0 --type-name AWS:ApplicationpartialConfig compliance results proving the ports you declared unnecessary are not reachable from the internet and the software you declared prohibited is not installed, plus the actual installed-application set a periodic review has to read
monthlycli
$ aws configservice get-compliance-details-by-config-rule --config-rule-name restricted-common-ports --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-applications-blacklisted --compliance-types NON_COMPLIANT$ aws ssm list-inventory-entries --instance-id i-0123456789abcdef0 --type-name AWS:ApplicationpartialCryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evident
weeklycli
$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-log-file-validation-enabled --compliance-types NON_COMPLIANT$ aws cloudtrail validate-logs --trail-arn <TRAIL_ARN> --start-time <START_TIME> --verbose$ aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-default-lock-enabled --compliance-types NON_COMPLIANT$ aws backup describe-backup-vault --backup-vault-name evidence-vault --query '{Locked:Locked,LockDate:LockDate,MinRetentionDays:MinRetentionDays,MaxRetentionDays:MaxRetentionDays}'$ aws configservice get-compliance-details-by-config-rule --config-rule-name ecr-private-tag-immutability-enabled --compliance-types NON_COMPLIANTpartialEvery running instance built from an image you never approved and every node carrying denylisted software, together with proof that an automated action was configured for those findings and a record of what it did when one fired
continuouscli
$ aws configservice get-compliance-details-by-config-rule --config-rule-name approved-amis-by-tag --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-applications-blacklisted --compliance-types NON_COMPLIANT$ aws configservice describe-remediation-configurations --config-rule-names approved-amis-by-tag ec2-managedinstance-applications-blacklisted$ aws configservice describe-remediation-execution-status --config-rule-name approved-amis-by-tagpartialA Region-by-Region inventory of the resources that can hold information, the classification tags you asserted on them, and — where Macie exists — a sampled machine judgement about which S3 buckets actually contain sensitive data
monthlycli
$ aws configservice select-aggregate-resource-config --configuration-aggregator-name <ORG_AGGREGATOR> --expression "SELECT awsRegion, resourceType, COUNT(*) WHERE resourceType IN ('AWS::S3::Bucket', 'AWS::RDS::DBInstance', 'AWS::DynamoDB::Table', 'AWS::EFS::FileSystem') GROUP BY awsRegion, resourceType"$ aws resourcegroupstaggingapi get-resources --tag-filters Key=DataClassification --region us-gov-west-1$ aws macie2 get-automated-discovery-configuration$ aws macie2 describe-buckets --query 'buckets[].{bucket:bucketName,region:region,score:sensitivityScore,monitored:automatedDiscoveryMonitoringStatus,lastAnalyzed:lastAutomatedDiscoveryTime,unclassifiable:unclassifiableObjectCount.total}'partialHow operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable instead
weeklycli
$ aws ssm get-document --name SSM-SessionManagerRunShell --document-version '$LATEST' --query Content --output text$ aws ssm describe-sessions --state History --query 'Sessions[].{owner:Owner,target:Target,start:StartDate,end:EndDate,document:DocumentName,accessType:AccessType,maxDuration:MaxSessionDuration}'$ aws ec2 describe-client-vpn-endpoints --query 'ClientVpnEndpoints[].{id:ClientVpnEndpointId,transport:TransportProtocol,auth:AuthenticationOptions[].Type,connectionLog:ConnectionLogOptions,splitTunnel:SplitTunnel,sessionTimeoutHours:SessionTimeoutHours,serverCert:ServerCertificateArn,selfServicePortal:SelfServicePortalUrl}'$ aws ec2 describe-client-vpn-connections --client-vpn-endpoint-id <CLIENT_VPN_ENDPOINT_ID> --query 'Connections[].{user:Username,commonName:CommonName,clientIp:ClientIp,established:ConnectionEstablishedTime,ended:ConnectionEndTime,status:Status,posture:PostureComplianceStatuses}'$ aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-instance-no-public-ip --compliance-types NON_COMPLIANTpartialDNSSEC signing status of every public hosted zone, with the key-signing key state and the DS record that carries the chain of trust to the parent
weeklycli
$ aws route53 list-hosted-zones --query 'HostedZones[?Config.PrivateZone==`false`].{Id:Id,Name:Name}'$ aws route53 get-dnssec --hosted-zone-id <PUBLIC_ZONE_ID>$ aws route53domains get-domain-detail --region us-east-1 --domain-name <DOMAIN> --query 'DnssecKeys'provesKSI-SVC-SIN→SC-20
partialPer-VPC DNSSEC validation status of the Route 53 Resolver, joined against the full VPC inventory so that a VPC which never enabled validation is visible rather than absent
weeklycli
$ aws ec2 describe-vpcs --query 'Vpcs[].VpcId'$ aws route53resolver list-resolver-dnssec-configsprovesKSI-SVC-SIN→SC-21
partialEvery place a client session terminates, with the protocol and negotiated policy it terminates under: listener protocol and SslPolicy on each load balancer, HTTP listeners that redirect rather than serve, an ACM certificate behind each one, and CloudFront viewer policies that refuse plain HTTP
quarterlycli
$ aws elbv2 describe-load-balancers --query 'LoadBalancers[].{LB:LoadBalancerName,Arn:LoadBalancerArn,Type:Type,Scheme:Scheme}'$ aws elbv2 describe-listeners --load-balancer-arn <LOAD_BALANCER_ARN> --query 'Listeners[].{Port:Port,Protocol:Protocol,SslPolicy:SslPolicy,Certificates:Certificates[].CertificateArn,Action:DefaultActions[0].Type,Redirect:DefaultActions[0].RedirectConfig}'$ aws elbv2 describe-ssl-policies --query "SslPolicies[?contains(Name,'FIPS')].Name"$ aws configservice get-compliance-details-by-config-rule --config-rule-name alb-http-to-https-redirection-check --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloudfront-viewer-policy-https --compliance-types NON_COMPLIANTprovesKSI-SVC-SINKSI-SVC-VCM→SC-23
partialThe hosted zones that serve name resolution, each marked private or public so internal and external resolution can be shown to be served by separate zones, and the Resolver endpoints that carry queries across the VPC boundary with their direction and operational status
continuouscli
$ aws route53 list-hosted-zones$ aws route53resolver list-resolver-endpointsprovesKSI-SVC-SIN→SC-22
partialWhether secret scanning, push protection and validity checking are switched on in this organization and which repositories those settings actually reach, together with the alerts themselves — each carrying the kind of credential found, whether the credential was confirmed to still work, how it was closed and by whom, and whether a push containing it was blocked or waved through. The settings are the population; the alerts are what was found in it, and an alert list read without the settings beside it cannot be told apart from a list produced by scanning nothing.
continuousapi
$ gh api --paginate "/orgs/<ORG>/code-security/configurations"$ gh api --paginate "/orgs/<ORG>/code-security/configurations/<CONFIGURATION_ID>/repositories?per_page=100"$ gh api --paginate "/orgs/<ORG>/secret-scanning/alerts?state=open&per_page=100"$ gh api --paginate "/orgs/<ORG>/secret-scanning/alerts?state=resolved&per_page=100"provesKSI-SVC-ASM→IA-05 (06)
Indicators in this theme
- KSI-SVC-ACM11 controlsAutomating Configuration Management
The configuration of machine-based information resources is managed using automation and persistently reviewed for drift.
- KSI-SVC-ASM5 controlsAutomating Secret Management
Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed.
- KSI-SVC-EIS9 controlsEvaluating and Improving Security
Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made.
- KSI-SVC-PRR1 controlsPreventing Residual Risk
- KSI-SVC-SIN12 controlsSecuring Information
Information is encrypted or otherwise secured from unwanted access or modification.
- KSI-SVC-VCM2 controlsValidating Communications
- KSI-SVC-VRI7 controlsValidating Resource Integrity
Use cryptographic methods to validate the integrity of machine-based information resources.
No accounts — your progress ticks never leave this browser.