AWS KMS
What this tool proves, in the authored overlay. Every recipe below names AWS KMS; the controls are what their output is evidence for. The mapping is this project’s opinion (overlay v3.0.0) — the upstream FedRAMP rules name no vendor and no product.
Recipes calling AWS KMS (4)
- partialconfig-encryption-at-restcontinuous
AWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMS
- partialconfig-kms-key-managementcontinuous
AWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection control
- partialconfig-cloudtrail-audit-loggingcontinuous
AWS Config compliance results proving the audit trail exists and is protected — CloudTrail enabled and multi-region so management events are captured account-wide, log-file validation on so records are tamper-evident, and SSE-KMS encryption on so the logs themselves are protected at rest
- partialroute53-dnssec-signingweekly
DNSSEC signing status of every public hosted zone, with the key-signing key state and the DS record that carries the chain of trust to the parent
Controls it carries evidence for (6)
The reverse of the join above. A mark here is the control’s own grade across the whole corpus, not its grade from this tool alone — a control this tool partly proves may be fully proved with another.
Tool names are canonical, from data/overlays/aws-services.json and data/overlays/pipeline-tools.json. The two overlays that name services spelled five of them two ways; a page keyed on the raw string would have split those in half.