aws-compliance's Introduction

AWS Compliance

This repository contains compliance data for the following AWS components: CloudFormation, IAM, S3, EC2, MultiFactor, and VPC

To import these data into a OpenControl project add the follow code to your opencontrol.yaml file.

dependencies:
  systems:
    - url: https://github.com/opencontrol/aws-compliance
      revision: master

For more information on the opencontrol.yaml visit the Compliance Masonry CLI.

aws-compliance's People

Contributors

Stargazers

Watchers

aws-compliance's Issues

Remove reference to cloud.gov

Is the intent here to satisfy only cloud.gov compliance alone or any systems with these controls?

What might have to be here are the AWS FedRAMPed components and controls talking in abstraction language and not something specific.

FedRAMP-high : 421 controls required (we have <10 here)

I see only a handful (<10) of controls listed here.
We need 421 controls completed to have FedRAMP-high compliance.

Who is in to do this with me?

Check on legality of publishing AWS control information

AWS compliance documentation is (in some cases?) protected under NDA. The content in the Control files in this repository may be in violation of that already.

While I have not dug into them myself, the AWS compliance packages likely dive into a lot of detail that is not directly needed by OpenControl users. The main use case of having a canonical set of AWS OpenControl Components is knowing what controls are fully inheritable, versus which have shared or full customer responsibility. Therefore, I would argue that it's not important that the control narrative includes any details about the implementation - it can simply say "Refer to the AWS FedRAMP package for details." Even so, I'm not sure if the list of controls implemented by AWS is considered proprietary information or not, or if they would be willing to release it in a non-restrictive way so they could be leveraged here.

Anyone have a contact at AWS to ask?