Tools & platforms
You already run some of these. This is what each one proves — every tool the authored recipeThis product’s unit of collection, and its own coinage: an authored command, plus what one pass of it proves and how often to re-run it. call, on AWS and pipeline, which are this product’s evidence planeA kind of question, not a vendor. The AWS plane asks a running account what it is doing; the pipeline plane asks the code and the build., with the controlOne numbered security requirement — AC-02, “account management” — from NIST SP 800-53, the catalogue FedRAMP draws its baselines from. its output is evidence for. Start from the console you have open rather than from a baselineThe set of controls one impact level requires. FedRAMP Rev5 publishes three, and which one binds you is the whole question of scope. you have not read.
Tools with a pagetools the authored recipes call
- called by a recipe
- 59
- top-level, before capabilities
- 52
A tool is counted once, under its canonical name. Two overlays spelled five services two ways each, and a page keyed on the raw string would have reported both spellings as separate tools.
Recipesauthored recipes across every plane
- reaching at least one tool
- 64
- in the corpus
- 64
A recipe naming a service and one of its capabilities is one recipe, counted once against each and once — not twice — against the parent.
What each one proves
densest first — the corpus converged hard on a few evaluators, and an alphabetical list would bury that- AWS ConfigAWS29 recipes · 46 controls
- AWS IAMAWS14 recipes · 16 controls
- AWS CloudTrailAWS11 recipes · 23 controls
- AWS Systems ManagerAWS10 recipes · 27 controls
- Amazon S3AWS9 recipes · 17 controls
- Amazon EC2AWS7 recipes · 13 controls
- Amazon GuardDutyAWS6 recipes · 17 controls
- AWS IAM Identity CenterAWS6 recipes · 8 controls
- Amazon CloudWatchAWS5 recipes · 18 controls
- GitHub code security configurationspipeline5 recipes · 5 controls
- Amazon VPCAWS4 recipes · 6 controls
- AWS KMSAWS4 recipes · 6 controls
- AWS Security HubAWS4 recipes · 13 controls
- GitHub code scanningpipeline4 recipes · 4 controls
- GitHub repository rulesetspipeline4 recipes · 4 controls
- Amazon RDSAWS3 recipes · 4 controls
- Amazon Route 53AWS3 recipes · 3 controls
- AWS BackupAWS3 recipes · 5 controls
- GitHub CodeQLpipeline3 recipes · 3 controls
- GitHub Dependabotpipeline3 recipes · 3 controls
- Amazon AthenaAWS2 recipes · 7 controls
- Amazon ECRAWS2 recipes · 3 controls
- Amazon InspectorAWS2 recipes · 3 controls
- AWS IAM Access AnalyzerAWS2 recipes · 3 controls
- AWS OrganizationsAWS2 recipes · 2 controls
- Elastic Load BalancingAWS2 recipes · 2 controls
- GitHub artifact attestationspipeline2 recipes · 2 controls
- GitHub pull requestspipeline2 recipes · 2 controls
- Amazon CloudFrontAWS1 recipe · 1 control
- Amazon CognitoAWS1 recipe · 1 control
- Amazon DynamoDBAWS1 recipe · 2 controls
- Amazon EBSAWS1 recipe · 1 control
- Amazon MacieAWS1 recipe · 2 controls
- Amazon RedshiftAWS1 recipe · 1 control
- Amazon SNSAWS1 recipe · 1 control
- AWS Certificate ManagerAWS1 recipe · 1 control
- AWS Client VPNAWS1 recipe · 4 controls
- AWS HealthAWS1 recipe · 1 control
- AWS Network FirewallAWS1 recipe · 3 controls
- AWS PrivateLinkAWS1 recipe · 1 control
- AWS Resource Groups Tagging APIAWS1 recipe · 2 controls
- AWS Shield AdvancedAWS1 recipe · 1 control
- AWS STSAWS1 recipe · 1 control
- AWS Transit GatewayAWS1 recipe · 1 control
- AWS WAFAWS1 recipe · 1 control
- Checkovpipeline1 recipe · 1 control
- GitHub Actionspipeline1 recipe · 1 control
- GitHub code ownerspipeline1 recipe · 1 control
- GitHub dependency graphpipeline1 recipe · 1 control
- GitHub dependency reviewpipeline1 recipe · 1 control
- GitHub secret scanningpipeline1 recipe · 1 control
- GitHub webhookspipeline1 recipe · 1 control
Named, and not authored yet
no page, because there is nothing on itThe automation register names these as candidates for controls nobody has written a recipe for. If you run one, the honest answer today is that this product has nothing authored for it — which is a better answer than a page implying otherwise.
- AWS CloudHSM
- AWS Private CA
- AWS Secrets Manager
- Amazon S3 Block Public Access
- AWS Elastic Disaster Recovery
- AWS Resilience Hub
- AWS Firewall Manager
- AWS CloudFormation
- AWS CodePipeline
Tool names are canonical, from data/overlays/aws-services.json (v1.1.0) and data/overlays/pipeline-tools.json (v0.7.0). Neither is a catalogue of its vendor: an entry is added by the batch that first names the tool.