Without an active analyzer, visibility into unintended public, cross-account, or risky internal access is lost. Adversaries can exploit exposed S3, snapshots, KMS keys, or permissive role trusts for data exfiltration and escalation. Unused permissions persist, enlarging the attack surface. This degrades confidentiality and integrity.

Enable IAM Access Analyzer across all accounts and active Regions (or organization-wide). Operate on least privilege: continuously review findings, remove unintended access, and trim unused permissions. Use archive rules sparingly, integrate reviews into change/CI/CD workflows, and enforce separation of duties on policy changes.

•CIS-7.0: 2.18 •CIS-1.4: 1.20 •CIS-1.5: 1.20 •KISA-ISMS-P-2023: 2.5.1, 2.5.5, 2.5.6, 2.10.2 •C5-2025: IAM-01.04B, IAM-06.01AC, IAM-10.01B, IAM-10.02B, INQ-04.01AC, PSS-08.03B, PSS-09.01AC •CIS-2.0: 1.20 •KISA-ISMS-P-2023-korean: 2.5.1, 2.5.5, 2.5.6, 2.10.2 •NIST-CSF-2.0: po_3, po_4, ov_2, ov_3, ac_1, ac_6 •CIS-5.0: 1.19 •ASD-Essential-Eight-Nov 2023: E8-4.4 •AWS-Account-Security-Onboarding: Enabled security services, Create analyzers in each active regions, Verify that events are present in SecurityHub aggregated view •CIS-3.0: 1.20 •CIS-6.0: 2.19 •CCC-v2025.10: CCC.Core.CN05.AR04, CCC.IAM.CN11.AR01 •SecNumCloud-3.2: 9.3 •ProwlerThreatScore-1.0: 1.2.6 •ISO27001-2022: A.8.3 •AWS-AI-Security-Framework-1.0: AISF-DATA-02 •CIS-4.0.1: 1.20 •NIS2: 3.2.3.e, 11.1.1, 11.2.1, 11.2.2.e

Unresolved Active findings indicate unintended external or internal access paths.
- Confidentiality: public/cross-account reads of data (buckets, snapshots, secrets)
- Integrity: rogue role assumption or KMS use enabling policy/data changes
- Lateral movement across accounts

Enable IAM Access Analyzer in all relevant Regions and org/account scopes. Triage every Active finding:
- Remove unintended access by tightening resource and trust policies
- Enforce least privilege and separation of duties
- Archive only validated, intended access
- Continuously monitor and automate reviews

•KISA-ISMS-P-2023: 2.5.1, 2.5.5, 2.5.6, 2.10.2 •C5-2025: AM-09.04AC, IAM-06.01AC, IAM-10.01B, IAM-10.02B, INQ-04.01AC, PSS-08.03B •KISA-ISMS-P-2023-korean: 2.5.1, 2.5.5, 2.5.6, 2.10.2 •NIST-CSF-2.0: ov_2, ac_4, cm_1 •ASD-Essential-Eight-Nov 2023: E8-4.4 •AWS-Account-Security-Onboarding: Create analyzers in each active regions, Verify that events are present in SecurityHub aggregated view •AWS-Foundational-Technical-Review: SECOPS-001 •CCC-v2025.10: CCC.Core.CN05.AR04, CCC.IAM.CN11.AR01 •SecNumCloud-3.2: 9.4 •ISO27001-2022: A.8.3 •AWS-AI-Security-Framework-1.0: AISF-DATA-02 •NIS2: 2.1.2.g, 2.1.2.h

The AmazonBedrockFullAccess policy grants broad permissions across all Bedrock resources. If a role with this policy is compromised, an attacker could:
- Invoke any model to exfiltrate data or generate harmful content
- Modify guardrails, logging, and security configurations
- Incur significant costs through unrestricted model invocations

Apply least privilege: replace AmazonBedrockFullAccess with a custom policy granting only the specific Bedrock actions required.

Use permissions boundaries and SCPs to limit the scope of Bedrock permissions. Regularly review access with IAM Access Analyzer to identify and remove unused privileges.

•SOC2: cc_6_3 •KISA-ISMS-P-2023: 2.5.5 •C5-2025: IAM-06.01B •KISA-ISMS-P-2023-korean: 2.5.5 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP02 •NIST-CSF-2.0: ac_4 •SecNumCloud-3.2: 9.3 •ISO27001-2022: A.8.2 •AWS-AI-Security-Framework-1.0: AISF-IAM-02

The AmazonBedrockFullAccess policy grants broad permissions across all Bedrock resources. If a role with this policy is compromised, an attacker could:
- Invoke any model to exfiltrate data or generate harmful content
- Modify guardrails, logging, and security configurations
- Incur significant costs through unrestricted model invocations

Apply least privilege: replace AmazonBedrockFullAccess with a custom policy granting only the specific Bedrock actions required.

Use permissions boundaries and SCPs to limit the scope of Bedrock permissions. Regularly review access with IAM Access Analyzer to identify and remove unused privileges.

•SOC2: cc_6_3 •KISA-ISMS-P-2023: 2.5.5 •C5-2025: IAM-06.01B •KISA-ISMS-P-2023-korean: 2.5.5 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP02 •NIST-CSF-2.0: ac_4 •SecNumCloud-3.2: 9.3 •ISO27001-2022: A.8.2 •AWS-AI-Security-Framework-1.0: AISF-IAM-02

The AmazonBedrockFullAccess policy grants broad permissions across all Bedrock resources. If a role with this policy is compromised, an attacker could:
- Invoke any model to exfiltrate data or generate harmful content
- Modify guardrails, logging, and security configurations
- Incur significant costs through unrestricted model invocations

Apply least privilege: replace AmazonBedrockFullAccess with a custom policy granting only the specific Bedrock actions required.

Use permissions boundaries and SCPs to limit the scope of Bedrock permissions. Regularly review access with IAM Access Analyzer to identify and remove unused privileges.

•SOC2: cc_6_3 •KISA-ISMS-P-2023: 2.5.5 •C5-2025: IAM-06.01B •KISA-ISMS-P-2023-korean: 2.5.5 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP02 •NIST-CSF-2.0: ac_4 •SecNumCloud-3.2: 9.3 •ISO27001-2022: A.8.2 •AWS-AI-Security-Framework-1.0: AISF-IAM-02

Secrets in Outputs are readable to anyone with stack metadata access, enabling credential theft, unauthorized API calls, and lateral movement. Exposure via consoles, exports, or CI logs undermines confidentiality and can lead to privilege escalation and data exfiltration.

Remove secrets from Outputs. Store credentials in Secrets Manager or Parameter Store and reference them via dynamic references; set NoEcho for sensitive parameters. Apply least privilege to view stack metadata, avoid exporting sensitive values, and add automated IaC secret scanning for defense in depth.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: DEV-02.01B •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •AWS-Well-Architected-Framework-Security-Pillar: SEC02-BP03

Without CloudTrail logging for Bedrock control-plane operations, changes to prompts, guardrails, agents, flows, or knowledge bases can become invisible, weakening forensics and incident response. Management events do not capture InvokeModel; pair this control with bedrock_model_invocation_logging_enabled or Bedrock data event selectors for invocation visibility.

Enable CloudTrail logging for Amazon Bedrock on at least one actively logging trail. At minimum, enable management events to capture Bedrock control-plane operations. For invocation-level and other data-plane visibility, add advanced event selectors targeting Bedrock resource types or pair this control with bedrock_model_invocation_logging_enabled.

For broader region coverage, pair this control with a separate multi-region CloudTrail check. Centralize logs in an encrypted bucket or CloudWatch Logs to support defense in depth and forensic readiness for AI workloads.

•SOC2: cc_7_2 •KISA-ISMS-P-2023: 2.9.4 •C5-2025: OPS-12.01B, OPS-15.01B •HIPAA: 164_308_a_1_ii_d, 164_312_b •AWS-Well-Architected-Framework-Security-Pillar: SEC04-BP01 •NIST-CSF-2.0: pt_1, ae_3, cm_3 •NIST-800-53-Revision-5: au_2_b, au_12_a, au_12_c •CCC-v2025.10: CCC.AuditLog.CN02.AR01 •SecNumCloud-3.2: 12.6 •FFIEC: d2-ma-ma-b-2 •ISO27001-2022: A.8.15 •FedRamp-Moderate-Revision-4: au-2-a-d, au-12-a-c

Missing or stale CloudWatch delivery weakens visibility and delays detection, impacting confidentiality and integrity. Adversaries can:
- Hide privilege escalation
- Perform unauthorized resource changes
- Exfiltrate data via API misuse

Integrate every trail with CloudWatch Logs and maintain continuous, near-real-time delivery. Enforce least privilege on the delivery role, prefer multi-Region coverage, and implement metric filters and alerts for sensitive actions. Centralize retention to support defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_a_1_1, pi_1_3 •CIS-1.4: 3.4 •CIS-1.5: 3.4 •GDPR: article_25, article_30 •AWS-Foundational-Security-Best-Practices: CloudTrail.5 •ISO27001-2013: A.12.4.Q •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OIS-04.01AC, OIS-05.02B, AM-01.01AC, OPS-11.02AC, OPS-13.01B, OPS-13.02B, OPS-15.01B, OPS-15.02B, OPS-15.03B, OPS-15.01AC, OPS-26.05B, OPS-26.01AS, IAM-07.04B, SSO-05.01AC, SIM-02.01B, SIM-03.07B, COM-04.01AC, PSS-04.01B, PSS-04.05B, PSS-12.03AC •HIPAA: 164_308_a_1_ii_d, 164_308_a_6_ii, 164_312_b, 164_312_e_2_i •CIS-2.0: 3.4 •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •GxP-21-CFR-Part-11: 11.10-e, 11.10-k, 11.300-d •AWS-Well-Architected-Framework-Security-Pillar: SEC04-BP01 •NIST-CSF-2.0: ip_8, ae_1, ae_3, cm_1, cm_3, cm_7 •NIST-800-171-Revision-2: 3_3_1, 3_3_2, 3_3_3, 3_3_5, 3_6_1, 3_6_2, 3_12_4 •PCI-4.0: 10.2.1.1.10, 10.2.1.2.8, 10.2.1.3.8, 10.2.1.4.8, 10.2.1.5.8, 10.2.1.6.8, 10.2.1.7.8, 10.2.1.8, 10.2.2.8, 10.3.1.8, 10.4.1.1.3, 10.6.3.10, 11.5.2.4, 11.6.1.4, 12.10.5.4, 5.3.4.9, A1.2.1.10, A3.3.1.6, A3.5.1.6 •NIST-800-53-Revision-4: ac_2_4, ac_2, au_2, au_3, au_6_1, au_6_3, au_7_1, au_12, ca_7, si_4_2, si_4_4, si_4_5, si_4 •NIST-800-53-Revision-5: ac_2_4, ac_3_1, ac_3_10, ac_4_26, ac_6_9, au_2_b, au_3_a, au_3_b, au_3_c, au_3_d, au_3_e, au_3_f, au_4_1, au_6_1, au_6_3, au_6_4, au_6_5, au_6_6, au_6_9, au_7_1, au_8_b, au_9_7, au_10, au_12_a, au_12_c, au_12_1, au_12_2, au_12_3, au_12_4, au_14_a, au_14_b, au_14_3, au_16, ca_7_b, cm_5_1_b, cm_6_a, cm_9_b, ia_3_3_b, ma_4_1_a, pm_14_a_1, pm_14_b, pm_31, sc_7_9_b, si_1_1_c, si_3_8_b, si_4_2, si_4_17, si_4_20, si_7_8, si_10_1_c •ENS-RD2022: op.exp.8.r1.aws.ct.7, op.mon.3.aws.cwl.1 •NIST-CSF-1.1: ae_1, ae_3, cm_2, cm_5, cp_4, ra_5, sc_4, pt_1 •AWS-Well-Architected-Framework-Reliability-Pillar: REL06-BP01 •CCC-v2025.10: CCC.Core.CN09.AR02, CCC.Core.CN04.AR01, CCC.Core.CN04.AR02, CCC.Core.CN04.AR03, CCC.AuditLog.CN02.AR01, CCC.Logging.CN01.AR02, CCC.LB.CN04.AR01 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-is-is-b-1, d2-ma-ma-b-1, d2-ma-ma-b-2, d3-dc-an-b-3, d3-dc-an-b-4, d3-dc-an-b-5, d3-dc-ev-b-1, d3-pc-im-b-3, d3-pc-im-b-7, d5-dr-de-b-3 •PCI-3.2.1: 3.2, 3.2.3, 3.4, 3.4.d, 10.1, 10.2, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.6, 10.2.7, 10.3, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.5, 10.5.3, 10.5.4 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DETECT-01 •FedRamp-Moderate-Revision-4: ac-2-4, ac-2-g, au-2-a-d, au-3, au-6-1-3, au-7-1, au-12-a-c, si-4-a-b-c •NIS2: 3.2.3.c, 3.2.3.g, 3.4.2.c •FedRAMP-20x-KSI-Low-25.05C: ksi-mla

Without Insights, abnormal API call or error rates can go unnoticed, delaying detection of credential abuse, privilege escalation, or runaway automation. Attackers may rapidly alter policies, delete resources, or exfiltrate data before response, impacting confidentiality and availability.

Enable CloudTrail Insights on all logging trails (ideally all-Region or organization trails). Activate both ApiCallRateInsight and ApiErrorRateInsight. Integrate alerts with monitoring and review anomalies regularly. Apply defense in depth and least privilege to reduce potential blast radius.

•KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OIS-05.02B, SIM-03.07B, COM-04.01AC, PSS-12.03AC •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •NIST-CSF-2.0: cm_1, dp_4 •PCI-4.0: 10.3.2.2, 10.3.3.4, 10.3.4.3, 10.5.1.3, 5.3.4.8, A1.2.1.8 •ENS-RD2022: op.exp.8.r1.aws.ct.2, op.exp.8.r1.aws.ct.3 •CCC-v2025.10: CCC.Core.CN04.AR03, CCC.AuditLog.CN02.AR01 •SecNumCloud-3.2: 12.9 •AWS-AI-Security-Framework-1.0: AISF-DETECT-01

Without validation, adversaries can alter, forge, or delete audit entries without detection, compromising log integrity and non-repudiation.

This impairs investigations, enables alert evasion, and obscures unauthorized changes across regions or accounts.

Enable log file integrity validation on all trails (LogFileValidationEnabled=true).

Enforce least privilege on the logs bucket, retain and protect digest files (e.g., S3 Object Lock/MFA Delete), and monitor validation results to support defense in depth.

•CISA: your-systems-3 •CIS-7.0: 4.2 •SOC2: cc_7_3, pi_1_3 •CIS-1.4: 3.2 •CIS-1.5: 3.2 •GDPR: article_25, article_32 •AWS-Foundational-Security-Best-Practices: CloudTrail.4 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-13.01AC, OPS-15.02AC, OPS-26.05B, OPS-26.01AS, DEV-08.02B, SIM-01.02AC, SIM-03.07B, COM-04.01AC, PSS-12.03AC •HIPAA: 164_308_a_1_ii_b, 164_308_a_1_ii_d, 164_312_b, 164_312_c_1, 164_312_c_2 •CIS-2.0: 3.2 •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-a, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC06-BP01, SEC06-BP06 •NIST-CSF-2.0: ds_6, pt_1 •CIS-5.0: 3.2 •NIST-800-171-Revision-2: 3_3_8, 3_13_1 •PCI-4.0: 10.3.2.5, 10.3.3.7, 10.3.4.6, A1.2.1.12 •NIST-800-53-Revision-4: si_7_1, si_7 •NIST-800-53-Revision-5: au_9_a, cm_6_a, cm_9_b, pm_11_b, pm_17_b, sa_1_1, sa_10_1, sc_16_1, si_1_a_2, si_4_d, si_7_1, si_7_3, si_7_7, si_7_a •CIS-3.0: 3.2 •ENS-RD2022: op.exp.8.aws.ct.3 •CIS-6.0: 4.2 •NIST-CSF-1.1: ds_6, ds_7 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.Core.CN09.AR02, CCC.Core.CN09.AR03, CCC.Core.CN04.AR01, CCC.AuditLog.CN01.AR01, CCC.AuditLog.CN01.AR02 •SecNumCloud-3.2: 10.4, 12.7, 16.6 •PCI-3.2.1: 10.5, 10.5.2, 10.5.5 •ProwlerThreatScore-1.0: 3.1.2 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DETECT-01 •FedRamp-Moderate-Revision-4: au-9, si-7-1, si-7 •FedRAMP-Low-Revision-4: ac-2, au-2, au-9 •CIS-4.0.1: 3.2 •NIS2: 3.4.2.d •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-mla

Without access logging on the CloudTrail logs bucket, access and changes to log files lack an independent audit trail. Attackers could read, delete, or replace logs without attribution, undermining log confidentiality and integrity, and slowing incident response.

Enable S3 server access logging on the CloudTrail logs bucket and write logs to a separate, tightly controlled bucket. Apply least privilege, enable versioning, and consider Object Lock to deter tampering. Centralize monitoring to support defense-in-depth and rapid investigation.

•CIS-7.0: 4.4 •SOC2: cc_a_1_1 •CIS-1.4: 3.6 •CIS-1.5: 3.6 •GDPR: article_25 •AWS-Foundational-Security-Best-Practices: CloudTrail.7 •ISO27001-2013: A.12.4.O •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-15.01B, OPS-15.02B, OPS-15.03B, OPS-15.01AC, OPS-26.05B, OPS-26.01AS, IAM-07.04B, IAM-10.01B, SSO-05.01AC, SIM-03.07B, COM-04.01AC, INQ-04.01AC, PSS-04.05B, PSS-12.03AC •CIS-2.0: 3.6 •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •AWS-Well-Architected-Framework-Security-Pillar: SEC04-BP01 •NIST-CSF-2.0: pt_1 •CIS-5.0: 3.4 •AWS-Account-Security-Onboarding: Send S3 access logs for critical buckets to separate S3 bucket, Confirm that logs are present in S3 bucket and SIEM •CIS-3.0: 3.4 •ENS-RD2022: op.exp.8.r1.aws.ct.6, op.exp.8.r4.aws.ct.5 •CIS-6.0: 4.4 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN04.AR01 •SecNumCloud-3.2: 12.7 •ProwlerThreatScore-1.0: 3.1.3 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DETECT-01 •CIS-4.0.1: 3.4 •NIS2: 3.2.3.c, 11.1.1, 11.2.2.f

Exposed CloudTrail logs erode confidentiality and integrity.

Adversaries can harvest API activity to map accounts, roles, and keys, enabling reconnaissance and evasion. If write is allowed, logs can be poisoned or deleted, thwarting investigations and compromising incident timelines.

Apply least privilege to the log bucket:
- Enable S3 Block Public Access (account and bucket)
- Remove AllUsers/AuthenticatedUsers ACLs; avoid wildcard principals
- Permit only CloudTrail and constrain with aws:SourceArn

Use a dedicated private bucket and monitor for permission changes.

•CIS-1.4: 3.3 •CIS-1.5: 3.3 •GDPR: article_25 •AWS-Foundational-Security-Best-Practices: CloudTrail.6 •ISO27001-2013: A.12.4.S, A.12.6.J •KISA-ISMS-P-2023: 2.6.1, 2.10.1 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, SIM-03.06B, SIM-03.07B, COM-04.01AC, PSS-12.03AC •CIS-2.0: 3.3 •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP07 •NIST-CSF-2.0: ds_5, pt_1 •ENS-RD2022: op.exp.8.aws.ct.4, op.exp.8.r4.aws.ct.2, op.exp.8.r4.aws.ct.6 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.AuditLog.CN10.AR01, CCC.AuditLog.CN10.AR02, CCC.Logging.CN04.AR01, CCC.Logging.CN05.AR01, CCC.Logging.CN05.AR02 •SecNumCloud-3.2: 12.7 •ProwlerThreatScore-1.0: 2.2.5 •ISO27001-2022: A.8.1, A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DETECT-01 •NIS2: 3.2.3.c

Missing coverage in any region creates visibility gaps.

Attackers can use lesser-monitored regions to run API actions, hide unauthorized changes, and exfiltrate data without audit trails, weakening detective controls, hindering forensics, and delaying response (confidentiality and integrity).

Use a multi-region CloudTrail trail or per-region trails so logging is active in every region, including unused ones.

Centralize logs, enforce least privilege to log stores, and add defense-in-depth with encryption, integrity validation, and retention. Continuously monitor trail health to catch gaps.

•CISA: your-systems-3, your-data-2 •CIS-7.0: 4.1 •SOC2: cc_2_1, cc_7_2, cc_a_1_1, pi_1_3 •CIS-1.4: 3.1 •CIS-1.5: 3.1 •GDPR: article_25, article_30 •AWS-Foundational-Security-Best-Practices: CloudTrail.1 •ISO27001-2013: A.12.4.T •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: OIS-05.01B, OIS-05.02B, PS-02.01B, PS-02.01AS, PS-02.02AS, OPS-15.03B, IAM-07.04B, DEV-08.02B, SIM-03.06B, SIM-03.07B, COM-04.01AC, PSS-12.03AC •HIPAA: 164_308_a_1_ii_d, 164_308_a_3_ii_a, 164_308_a_6_ii, 164_312_b, 164_312_e_2_i •CIS-2.0: 3.1 •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-e, 11.10-k, 11.300-d •AWS-Well-Architected-Framework-Security-Pillar: SEC04-BP02, SEC04-BP03 •GxP-EU-Annex-11: 1-risk-management, 4.2-validation-documentation-change-control •CIS-5.0: 3.1 •NIST-800-171-Revision-2: 3_1_12, 3_3_1, 3_3_2, 3_3_3, 3_4_1, 3_6_1, 3_6_2, 3_13_1, 3_13_2, 3_14_6, 3_14_7 •PCI-4.0: 10.2.1.1.22, 10.2.1.2.19, 10.2.1.3.19, 10.2.1.4.19, 10.2.1.5.19, 10.2.1.6.19, 10.2.1.7.19, 10.2.1.19, 10.2.2.19, 10.3.1.19, 10.6.3.24, 5.3.4.22, A1.2.1.23 •NIST-800-53-Revision-4: ac_2_4, ac_2, au_2, au_3, au_12, cm_2 •NIST-800-53-Revision-5: ac_2_4, ac_3_1, ac_3_10, ac_4_26, ac_6_9, au_2_b, au_3_1, au_3_a, au_3_b, au_3_c, au_3_d, au_3_e, au_3_f, au_6_3, au_6_4, au_6_6, au_6_9, au_8_b, au_10, au_12_a, au_12_c, au_12_1, au_12_2, au_12_3, au_12_4, au_14_a, au_14_b, au_14_3, ca_7_b, cm_5_1_b, cm_6_a, cm_9_b, ia_3_3_b, ma_4_1_a, pm_14_a_1, pm_14_b, pm_31, sc_7_9_b, si_1_1_c, si_3_8_b, si_4_2, si_4_17, si_4_20, si_7_8, si_10_1_c •AWS-Account-Security-Onboarding: Enable as part of Organization trail •CIS-3.0: 3.1 •ENS-RD2022: op.acc.6.r5.aws.iam.1, op.exp.5.aws.ct.1, op.exp.8.aws.ct.1, op.exp.8.aws.ct.6, op.exp.9.aws.ct.1, op.mon.1.aws.ct.1 •CIS-6.0: 4.1 •NIST-CSF-1.1: ae_1, ae_3, ae_4, cm_1, cm_3, cm_6, cm_7, am_3, ac_6, ds_5, ma_2, pt_1 •CCC-v2025.10: CCC.Core.CN09.AR02, CCC.Core.CN04.AR01, CCC.Core.CN04.AR03, CCC.AuditLog.CN02.AR01, CCC.AuditLog.CN05.AR01, CCC.Logging.CN01.AR01, CCC.IAM.CN10.AR02 •SecNumCloud-3.2: 12.2, 12.6, 14.2, 16.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1, d2-ma-ma-b-2, d3-dc-an-b-3, d3-dc-an-b-4, d3-dc-an-b-5, d3-dc-ev-b-1, d3-dc-ev-b-3, d3-pc-im-b-3, d3-pc-im-b-7, d5-dr-de-b-3 •PCI-3.2.1: 3.2, 3.2.3, 3.4, 3.4.d, 10.1, 10.2, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.6, 10.2.7, 10.3, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.5, 10.5.4 •ProwlerThreatScore-1.0: 3.1.1 •AWS-AI-Security-Framework-1.0: AISF-DETECT-01 •FedRamp-Moderate-Revision-4: ac-2-4, ac-2-g, au-2-a-d, au-3, au-6-1-3, au-12-a-c, ca-7-a-b, si-4-16, si-4-2, si-4-4, si-4-5 •FedRAMP-Low-Revision-4: ac-2, au-2, ca-7 •CIS-4.0.1: 3.1 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-mla, ksi-mla-07

Missing coverage in any region creates visibility gaps.

Attackers can use lesser-monitored regions to run API actions, hide unauthorized changes, and exfiltrate data without audit trails, weakening detective controls, hindering forensics, and delaying response (confidentiality and integrity).

Use a multi-region CloudTrail trail or per-region trails so logging is active in every region, including unused ones.

Centralize logs, enforce least privilege to log stores, and add defense-in-depth with encryption, integrity validation, and retention. Continuously monitor trail health to catch gaps.

•CISA: your-systems-3, your-data-2 •CIS-7.0: 4.1 •SOC2: cc_2_1, cc_7_2, cc_a_1_1, pi_1_3 •CIS-1.4: 3.1 •CIS-1.5: 3.1 •GDPR: article_25, article_30 •AWS-Foundational-Security-Best-Practices: CloudTrail.1 •ISO27001-2013: A.12.4.T •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: OIS-05.01B, OIS-05.02B, PS-02.01B, PS-02.01AS, PS-02.02AS, OPS-15.03B, IAM-07.04B, DEV-08.02B, SIM-03.06B, SIM-03.07B, COM-04.01AC, PSS-12.03AC •HIPAA: 164_308_a_1_ii_d, 164_308_a_3_ii_a, 164_308_a_6_ii, 164_312_b, 164_312_e_2_i •CIS-2.0: 3.1 •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-e, 11.10-k, 11.300-d •AWS-Well-Architected-Framework-Security-Pillar: SEC04-BP02, SEC04-BP03 •GxP-EU-Annex-11: 1-risk-management, 4.2-validation-documentation-change-control •CIS-5.0: 3.1 •NIST-800-171-Revision-2: 3_1_12, 3_3_1, 3_3_2, 3_3_3, 3_4_1, 3_6_1, 3_6_2, 3_13_1, 3_13_2, 3_14_6, 3_14_7 •PCI-4.0: 10.2.1.1.22, 10.2.1.2.19, 10.2.1.3.19, 10.2.1.4.19, 10.2.1.5.19, 10.2.1.6.19, 10.2.1.7.19, 10.2.1.19, 10.2.2.19, 10.3.1.19, 10.6.3.24, 5.3.4.22, A1.2.1.23 •NIST-800-53-Revision-4: ac_2_4, ac_2, au_2, au_3, au_12, cm_2 •NIST-800-53-Revision-5: ac_2_4, ac_3_1, ac_3_10, ac_4_26, ac_6_9, au_2_b, au_3_1, au_3_a, au_3_b, au_3_c, au_3_d, au_3_e, au_3_f, au_6_3, au_6_4, au_6_6, au_6_9, au_8_b, au_10, au_12_a, au_12_c, au_12_1, au_12_2, au_12_3, au_12_4, au_14_a, au_14_b, au_14_3, ca_7_b, cm_5_1_b, cm_6_a, cm_9_b, ia_3_3_b, ma_4_1_a, pm_14_a_1, pm_14_b, pm_31, sc_7_9_b, si_1_1_c, si_3_8_b, si_4_2, si_4_17, si_4_20, si_7_8, si_10_1_c •AWS-Account-Security-Onboarding: Enable as part of Organization trail •CIS-3.0: 3.1 •ENS-RD2022: op.acc.6.r5.aws.iam.1, op.exp.5.aws.ct.1, op.exp.8.aws.ct.1, op.exp.8.aws.ct.6, op.exp.9.aws.ct.1, op.mon.1.aws.ct.1 •CIS-6.0: 4.1 •NIST-CSF-1.1: ae_1, ae_3, ae_4, cm_1, cm_3, cm_6, cm_7, am_3, ac_6, ds_5, ma_2, pt_1 •CCC-v2025.10: CCC.Core.CN09.AR02, CCC.Core.CN04.AR01, CCC.Core.CN04.AR03, CCC.AuditLog.CN02.AR01, CCC.AuditLog.CN05.AR01, CCC.Logging.CN01.AR01, CCC.IAM.CN10.AR02 •SecNumCloud-3.2: 12.2, 12.6, 14.2, 16.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1, d2-ma-ma-b-2, d3-dc-an-b-3, d3-dc-an-b-4, d3-dc-an-b-5, d3-dc-ev-b-1, d3-dc-ev-b-3, d3-pc-im-b-3, d3-pc-im-b-7, d5-dr-de-b-3 •PCI-3.2.1: 3.2, 3.2.3, 3.4, 3.4.d, 10.1, 10.2, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.6, 10.2.7, 10.3, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.5, 10.5.4 •ProwlerThreatScore-1.0: 3.1.1 •AWS-AI-Security-Framework-1.0: AISF-DETECT-01 •FedRamp-Moderate-Revision-4: ac-2-4, ac-2-g, au-2-a-d, au-3, au-6-1-3, au-12-a-c, ca-7-a-b, si-4-16, si-4-2, si-4-4, si-4-5 •FedRAMP-Low-Revision-4: ac-2, au-2, ca-7 •CIS-4.0.1: 3.1 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-mla, ksi-mla-07

Without region-wide management event logging, changes to identities, networking, and audit settings can go untracked.

Adversaries can operate in overlooked regions to create resources, modify permissions, or disable logging, undermining integrity, confidentiality, and incident response.

Enable a multi-region CloudTrail that logs management events for read and write in all regions.

Centralize logs in a separate, locked-down account; apply least privilege, encryption, retention, and integrity validation; and protect trails and storage with tamper-evident, deny-delete controls for defense-in-depth.

•KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OIS-05.02B, AM-01.01AC, PS-02.01B, PS-02.01AS, PS-02.02AS, OPS-11.02AC, OPS-12.01B, OPS-13.02B, OPS-13.01AC, OPS-13.03AC, OPS-15.01B, OPS-15.02B, OPS-15.03B, OPS-15.01AC, OPS-26.05B, OPS-26.01AS, IAM-07.04B, DEV-08.02B, SSO-05.01AC, SIM-03.06B, SIM-03.07B, COM-04.01AC, PSS-04.05B, PSS-12.02AC, PSS-12.03AC •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •NIST-CSF-2.0: po_4, ov_3, pt_1, ae_1, ae_3, cm_1, cm_3, dp_4 •AWS-Account-Security-Onboarding: Enable as part of Organization trail •CCC-v2025.10: CCC.Core.CN04.AR01, CCC.Core.CN04.AR02, CCC.AuditLog.CN02.AR01, CCC.Logging.CN01.AR01, CCC.IAM.CN10.AR02 •SecNumCloud-3.2: 12.2, 12.6 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DETECT-01 •NIS2: 3.1.2.a, 3.2.3.c, 3.4.2.c

Without region-wide management event logging, changes to identities, networking, and audit settings can go untracked.

Adversaries can operate in overlooked regions to create resources, modify permissions, or disable logging, undermining integrity, confidentiality, and incident response.

Enable a multi-region CloudTrail that logs management events for read and write in all regions.

Centralize logs in a separate, locked-down account; apply least privilege, encryption, retention, and integrity validation; and protect trails and storage with tamper-evident, deny-delete controls for defense-in-depth.

•KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OIS-05.02B, AM-01.01AC, PS-02.01B, PS-02.01AS, PS-02.02AS, OPS-11.02AC, OPS-12.01B, OPS-13.02B, OPS-13.01AC, OPS-13.03AC, OPS-15.01B, OPS-15.02B, OPS-15.03B, OPS-15.01AC, OPS-26.05B, OPS-26.01AS, IAM-07.04B, DEV-08.02B, SSO-05.01AC, SIM-03.06B, SIM-03.07B, COM-04.01AC, PSS-04.05B, PSS-12.02AC, PSS-12.03AC •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •NIST-CSF-2.0: po_4, ov_3, pt_1, ae_1, ae_3, cm_1, cm_3, dp_4 •AWS-Account-Security-Onboarding: Enable as part of Organization trail •CCC-v2025.10: CCC.Core.CN04.AR01, CCC.Core.CN04.AR02, CCC.AuditLog.CN02.AR01, CCC.Logging.CN01.AR01, CCC.IAM.CN10.AR02 •SecNumCloud-3.2: 12.2, 12.6 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DETECT-01 •NIS2: 3.1.2.a, 3.2.3.c, 3.4.2.c

Without object-level read logging, S3 access is opaque. Attackers or insiders can exfiltrate data via GetObject without audit trails, eroding confidentiality and hindering forensics, anomaly detection, and incident response.

Enable CloudTrail data events for S3 objects with ReadOnly (or All) across all current and future buckets. Use a multi-Region trail, centralize logs in an encrypted bucket with lifecycle retention, and integrate monitoring/alerts to support defense in depth and accountable access.

•CISA: your-systems-3, your-data-2 •CIS-7.0: 4.9 •SOC2: cc_2_1, cc_7_2 •CIS-1.4: 3.11 •CIS-1.5: 3.11 •GDPR: article_30 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-15.01B, OPS-15.02B, OPS-15.03B, OPS-15.01AC, OPS-26.05B, OPS-26.01AS, IAM-07.04B, SSO-05.01AC, SIM-03.07B, COM-04.01AC, PSS-04.05B, PSS-12.03AC •HIPAA: 164_308_a_1_ii_d, 164_308_a_3_ii_a, 164_308_a_6_ii, 164_312_a_2_i, 164_312_b, 164_312_e_2_i •CIS-2.0: 3.11 •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •GxP-21-CFR-Part-11: 11.10-e, 11.10-k •AWS-Well-Architected-Framework-Security-Pillar: SEC04-BP01 •GxP-EU-Annex-11: 8.2-printouts-data-changes, 9-audit-trails, 12.4-security-audit-trail •CIS-5.0: 3.9 •NIST-800-171-Revision-2: 3_1_12, 3_3_1, 3_3_2, 3_3_3, 3_13_1, 3_14_6, 3_14_7 •NIST-800-53-Revision-4: ac_2, au_2, au_3, au_12 •NIST-800-53-Revision-5: ac_2_4, ac_3_1, ac_3_10, ac_4_26, ac_6_9, au_2_b, au_3_a, au_3_b, au_3_c, au_3_d, au_3_e, au_3_f, au_6_3, au_6_4, au_6_6, au_6_9, au_8_b, au_10, au_12_a, au_12_c, au_12_1, au_12_2, au_12_3, au_12_4, au_14_a, au_14_b, au_14_3, ca_7_b, cm_5_1_b, cm_6_a, cm_9_b, ia_3_3_b, ma_4_1_a, pm_14_a_1, pm_14_b, pm_31, sc_7_9_b, si_1_1_c, si_3_8_b, si_4_2, si_4_17, si_4_20, si_7_8, si_10_1_c •AWS-Account-Security-Onboarding: Confirm that logs are present in S3 bucket and SIEM •CIS-3.0: 3.9 •ENS-RD2022: op.exp.8.r1.aws.ct.2, op.exp.8.r1.aws.ct.3, op.exp.8.r1.aws.ct.4 •CIS-6.0: 4.9 •NIST-CSF-1.1: ae_3, ae_4, cm_1, cm_3, cm_6, cm_7, ds_5 •CCC-v2025.10: CCC.Core.CN04.AR03, CCC.AuditLog.CN02.AR01, CCC.AuditLog.CN05.AR01 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1, d2-ma-ma-b-2, d3-dc-an-b-3, d3-dc-an-b-4, d3-dc-ev-b-1, d5-dr-de-b-3 •PCI-3.2.1: 10.1, 10.2, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.6, 10.2.7, 10.3, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.3.6, 10.5, 10.5.4 •ProwlerThreatScore-1.0: 3.1.6 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: ac-2-4, ac-2-g, au-2-a-d, au-3, au-6-1-3, au-12-a-c, ca-7-a-b, si-4-16, si-4-2, si-4-4, si-4-5 •FedRAMP-Low-Revision-4: ac-2, au-2, ca-7 •CIS-4.0.1: 3.9 •NIS2: 3.2.3.c, 3.2.3.g, 3.4.2.c •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-mla

Without object-level write logging, unauthorized or accidental changes and deletions can go unobserved, undermining data integrity and availability. Forensics lose visibility into who modified or removed objects, hindering detection of ransomware, rogue automation, or insider tampering.

Enable CloudTrail S3 data events for object-level write (and optionally read) across all buckets on a multi-Region trail. Apply least privilege to log storage, set lifecycle retention, and integrate alerts. Use advanced selectors to target sensitive buckets/operations for cost control and defense in depth.

•CISA: your-systems-3, your-data-2 •CIS-7.0: 4.8 •SOC2: cc_2_1, cc_7_2, pi_1_2 •CIS-1.4: 3.10 •CIS-1.5: 3.10 •GDPR: article_30 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OPS-11.02AC, OPS-15.01B, OPS-15.02B, OPS-15.03B, OPS-15.01AC, OPS-26.05B, OPS-26.01AS, IAM-07.04B, SSO-05.01AC, SIM-03.07B, COM-04.01AC, PSS-04.05B, PSS-12.03AC •HIPAA: 164_308_a_1_ii_d, 164_308_a_3_ii_a, 164_308_a_6_ii, 164_312_a_2_i, 164_312_b, 164_312_e_2_i •CIS-2.0: 3.10 •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •GxP-21-CFR-Part-11: 11.10-e, 11.10-k •AWS-Well-Architected-Framework-Security-Pillar: SEC04-BP01 •GxP-EU-Annex-11: 8.2-printouts-data-changes, 9-audit-trails, 12.4-security-audit-trail •CIS-5.0: 3.8 •NIST-800-171-Revision-2: 3_1_12, 3_3_1, 3_3_2, 3_3_3, 3_13_1, 3_14_6, 3_14_7 •PCI-4.0: 10.2.1.1.7, 10.2.1.2.7, 10.2.1.3.7, 10.2.1.4.7, 10.2.1.5.7, 10.2.1.6.7, 10.2.1.7.7, 10.2.1.7, 10.2.2.7, 10.3.1.7, 10.6.3.7, 5.3.4.7, A1.2.1.7 •NIST-800-53-Revision-4: ac_2, au_2, au_3, au_12 •NIST-800-53-Revision-5: ac_2_4, ac_3_1, ac_3_10, ac_4_26, ac_6_9, au_2_b, au_3_a, au_3_b, au_3_c, au_3_d, au_3_e, au_3_f, au_6_3, au_6_4, au_6_6, au_6_9, au_8_b, au_10, au_12_a, au_12_c, au_12_1, au_12_2, au_12_3, au_12_4, au_14_a, au_14_b, au_14_3, ca_7_b, cm_5_1_b, cm_6_a, cm_9_b, ia_3_3_b, ma_4_1_a, pm_14_a_1, pm_14_b, pm_31, sc_7_9_b, si_1_1_c, si_3_8_b, si_4_2, si_4_17, si_4_20, si_7_8, si_10_1_c •AWS-Account-Security-Onboarding: Send S3 access logs for critical buckets to separate S3 bucket, Confirm that logs are present in S3 bucket and SIEM •CIS-3.0: 3.8 •ENS-RD2022: op.exp.8.aws.ct.4, op.exp.8.r1.aws.ct.2, op.exp.8.r1.aws.ct.3, op.exp.8.r1.aws.ct.4 •CIS-6.0: 4.8 •NIST-CSF-1.1: ae_3, ae_4, cm_1, cm_3, cm_6, cm_7, ds_5 •CCC-v2025.10: CCC.Core.CN04.AR02, CCC.AuditLog.CN02.AR01, CCC.AuditLog.CN05.AR01 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1, d2-ma-ma-b-2, d3-dc-an-b-3, d3-dc-an-b-4, d3-dc-ev-b-1, d5-dr-de-b-3 •ProwlerThreatScore-1.0: 3.1.5 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: ac-2-4, ac-2-g, au-2-a-d, au-3, au-6-1-3, au-12-a-c, ca-7-a-b, si-4-16, si-4-2, si-4-4, si-4-5 •FedRAMP-Low-Revision-4: ac-2, au-2, ca-7 •CIS-4.0.1: 3.8 •NIS2: 3.2.3.c, 3.2.3.g •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-mla

Without an ALARM action, threshold breaches trigger no notification or automated response. This delays detection and containment, risking:
- Availability: prolonged outages or missed scale-out
- Integrity/confidentiality: unchecked anomalies enabling tampering or data loss

Assign at least one ALARM-state action per alarm (e.g., notify via SNS or run automated remediation with Lambda/SSM). Keep actions enabled, apply least privilege to targets, and regularly test. For critical metrics, add redundant paths (EventBridge) for defense in depth.

•KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OIS-04.02AC, HR-03.02AC, AM-09.03AC, OPS-13.03AC, OPS-26.06B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •NIST-CSF-2.0: ip_7, ip_8, dp_4 •PCI-4.0: 10.2.1.1.8, 10.2.1.1.9, 10.4.1.1.2, 10.4.1.2, 10.4.2.2, 10.4.2.3, 10.4.3.1, 10.6.3.8, 10.6.3.9, 10.7.1.3, 10.7.1.4, 10.7.2.3, 10.7.2.4, 11.5.2.2, 11.5.2.3, 11.6.1.2, 11.6.1.3, 12.10.5.2, 12.10.5.3, A3.3.1.3, A3.3.1.4, A3.3.1.5, A3.5.1.3, A3.5.1.4, A3.5.1.5

Without an ALARM action, threshold breaches trigger no notification or automated response. This delays detection and containment, risking:
- Availability: prolonged outages or missed scale-out
- Integrity/confidentiality: unchecked anomalies enabling tampering or data loss

Assign at least one ALARM-state action per alarm (e.g., notify via SNS or run automated remediation with Lambda/SSM). Keep actions enabled, apply least privilege to targets, and regularly test. For critical metrics, add redundant paths (EventBridge) for defense in depth.

•KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OIS-04.02AC, HR-03.02AC, AM-09.03AC, OPS-13.03AC, OPS-26.06B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •NIST-CSF-2.0: ip_7, ip_8, dp_4 •PCI-4.0: 10.2.1.1.8, 10.2.1.1.9, 10.4.1.1.2, 10.4.1.2, 10.4.2.2, 10.4.2.3, 10.4.3.1, 10.6.3.8, 10.6.3.9, 10.7.1.3, 10.7.1.4, 10.7.2.3, 10.7.2.4, 11.5.2.2, 11.5.2.3, 11.6.1.2, 11.6.1.3, 12.10.5.2, 12.10.5.3, A3.3.1.3, A3.3.1.4, A3.3.1.5, A3.5.1.3, A3.5.1.4, A3.5.1.5

Without an ALARM action, threshold breaches trigger no notification or automated response. This delays detection and containment, risking:
- Availability: prolonged outages or missed scale-out
- Integrity/confidentiality: unchecked anomalies enabling tampering or data loss

Assign at least one ALARM-state action per alarm (e.g., notify via SNS or run automated remediation with Lambda/SSM). Keep actions enabled, apply least privilege to targets, and regularly test. For critical metrics, add redundant paths (EventBridge) for defense in depth.

•KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OIS-04.02AC, HR-03.02AC, AM-09.03AC, OPS-13.03AC, OPS-26.06B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •NIST-CSF-2.0: ip_7, ip_8, dp_4 •PCI-4.0: 10.2.1.1.8, 10.2.1.1.9, 10.4.1.1.2, 10.4.1.2, 10.4.2.2, 10.4.2.3, 10.4.3.1, 10.6.3.8, 10.6.3.9, 10.7.1.3, 10.7.1.4, 10.7.2.3, 10.7.2.4, 11.5.2.2, 11.5.2.3, 11.6.1.2, 11.6.1.3, 12.10.5.2, 12.10.5.3, A3.3.1.3, A3.3.1.4, A3.3.1.5, A3.5.1.3, A3.5.1.4, A3.5.1.5

With alarm actions disabled, state changes neither notify nor remediate. Incidents can persist unnoticed, enabling unauthorized activity, configuration drift, or capacity exhaustion. Visibility drops, MTTR rises, and confidentiality, integrity, and availability are all at greater risk.

Enable actions_enabled on critical alarms and attach least-privilege actions (SNS, automation) for ALARM and recovery states. Use redundant targets, regularly test notifications, and integrate with incident response. Apply defense in depth with complementary detections to ensure timely, reliable alerting.

•KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OIS-04.02AC, HR-03.02AC, AM-09.03AC, OPS-13.03AC, OPS-26.06B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •NIST-CSF-2.0: ip_8, dp_4 •CCC-v2025.10: CCC.LB.CN06.AR01 •SecNumCloud-3.2: 16.2

With alarm actions disabled, state changes neither notify nor remediate. Incidents can persist unnoticed, enabling unauthorized activity, configuration drift, or capacity exhaustion. Visibility drops, MTTR rises, and confidentiality, integrity, and availability are all at greater risk.

Enable actions_enabled on critical alarms and attach least-privilege actions (SNS, automation) for ALARM and recovery states. Use redundant targets, regularly test notifications, and integrate with incident response. Apply defense in depth with complementary detections to ensure timely, reliable alerting.

•KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OIS-04.02AC, HR-03.02AC, AM-09.03AC, OPS-13.03AC, OPS-26.06B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •NIST-CSF-2.0: ip_8, dp_4 •CCC-v2025.10: CCC.LB.CN06.AR01 •SecNumCloud-3.2: 16.2

With alarm actions disabled, state changes neither notify nor remediate. Incidents can persist unnoticed, enabling unauthorized activity, configuration drift, or capacity exhaustion. Visibility drops, MTTR rises, and confidentiality, integrity, and availability are all at greater risk.

Enable actions_enabled on critical alarms and attach least-privilege actions (SNS, automation) for ALARM and recovery states. Use redundant targets, regularly test notifications, and integrate with incident response. Apply defense in depth with complementary detections to ensure timely, reliable alerting.

•KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •C5-2025: OIS-04.02AC, HR-03.02AC, AM-09.03AC, OPS-13.03AC, OPS-26.06B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2, 2.11.3 •NIST-CSF-2.0: ip_8, dp_4 •CCC-v2025.10: CCC.LB.CN06.AR01 •SecNumCloud-3.2: 16.2

Granting other accounts visibility into observability data reduces confidentiality and enables reconnaissance. Adversaries or over-privileged partners can map architectures, profile workloads, and spot alerting gaps, increasing chances of lateral movement and evasion.

Disable cross-account sharing unless strictly required. If needed, restrict access to specific trusted accounts, scope read-only permissions to only necessary resources, and use a dedicated monitoring account. Apply least privilege and separation of duties, and regularly audit role trust and access patterns.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.2, 2.10.1, 2.10.2 •C5-2025: OIS-04.01AC, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.1, 2.10.2 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP01 •ENS-RD2022: op.acc.4.aws.iam.1

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Leaked credentials in logs erode confidentiality and enable unauthorized API calls. Attackers reusing tokens/keys can escalate privileges, alter resources, and exfiltrate data. Subscriptions and exports widen exposure, and users with logs:Unmask can reveal values, increasing the blast radius.

Avoid logging secrets via application sanitization and data minimization. Apply CloudWatch data protection policies to audit and mask sensitive patterns. Enforce least privilege for log readers and restrict logs:Unmask. Rotate exposed keys, reduce retention, and monitor findings to validate controls.

•MITRE-ATTACK: T1552 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.01AC, OPS-11.02AC, OPS-13.03B, OPS-26.05B, OPS-26.01AS, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •SecNumCloud-3.2: 10.5 •ISO27001-2022: A.8.15, A.8.16 •AWS-AI-Security-Framework-1.0: AISF-DATA-05

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Public access to log groups enables unauthorized reading of logs, revealing secrets and operational metadata, harming confidentiality. If broad actions are allowed, attackers can modify subscriptions or logs, undermining integrity and disrupting availability of audit evidence.

Remove public access from log group resource policies. Replace Principal:"*" and Resource:"*" with narrowly scoped principals and specific ARNs. Grant only necessary actions, apply conditions to constrain use, and enforce least privilege and separation of duties with regular policy reviews.

•SOC2: pi_1_4 •KISA-ISMS-P-2023: 2.6.1, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, PS-03.02B, OPS-11.02AC, OPS-26.05B, OPS-26.01AS, IAM-10.01B, COS-02.01B, PSS-04.01B •KISA-ISMS-P-2023-korean: 2.6.1, 2.10.1, 2.10.2 •NIST-CSF-2.0: ds_5 •CCC-v2025.10: CCC.Core.CN09.AR01, CCC.AuditLog.CN09.AR01, CCC.Logging.CN04.AR01, CCC.Monitor.CN04.AR01 •SecNumCloud-3.2: 12.7 •ISO27001-2022: A.8.15, A.8.16 •NIS2: 3.2.3.c

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Short log retention erodes audit evidence. Adversaries can wait out the window, creating gaps in detection, forensics, and compliance reporting. This degrades the availability of historical logs and the integrity of incident timelines.

Define a minimum retention baseline (e.g., >=365 days) aligned to legal and investigative needs. Apply it consistently with documented exceptions. Automate enforcement, monitor changes, and restrict who can modify retention under least privilege and defense in depth.

•SOC2: cc_7_2, cc_7_3, cc_c_1_2 •KISA-ISMS-P-2023: 2.9.4, 2.10.1, 2.10.2 •C5-2025: AM-01.01AC, OPS-11.02AC, OPS-14.01B, OPS-14.02B, OPS-26.05B, OPS-26.01AS, PI-03.02B, PSS-04.01B •HIPAA: 164_312_b •KISA-ISMS-P-2023-korean: 2.9.4, 2.10.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-c, 11.10-e •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_3_1, 3_6_1, 3_6_2 •PCI-4.0: 10.5.1.4, 3.2.1.3, 3.3.1.1.3, 3.3.1.3.3, 3.3.2.3, 3.3.3.3, 5.3.4.11 •NIST-800-53-Revision-4: au_11, si_12 •NIST-800-53-Revision-5: ac_16_b, au_6_3, au_6_4, au_6_6, au_6_9, au_10, au_11, au_11_1, au_12_1, au_12_2, au_12_3, au_14_a, au_14_b, ca_7_b, pm_14_a_1, pm_14_b, pm_21_b, pm_31, sc_28_2, si_4_17, si_12 •ENS-RD2022: op.exp.8.r3.aws.cw.1 •CCC-v2025.10: CCC.Logging.CN02.AR01, CCC.Logging.CN02.AR02 •SecNumCloud-3.2: 12.6 •RBI-Cyber-Security-Framework: annex_i_7_4 •FFIEC: d2-ma-ma-b-1 •PCI-3.2.1: 10.1, 10.7, 10.7.b, 10.7.c •ProwlerThreatScore-1.0: 3.2.2 •ISO27001-2022: A.8.15, A.8.16 •FedRamp-Moderate-Revision-4: au-6-1-3, au-11, si-12 •FedRAMP-Low-Revision-4: au-11 •NIS2: 1.1.1.h, 3.2.3.c, 3.2.5, 4.2.2.f •FedRAMP-20x-KSI-Low-25.05C: ksi-mla, ksi-mla-07

Gaps in Config recording create blind spots. Changes in unmonitored Regions aren't captured, weakening integrity and auditability. Adversaries can alter resources or stage assets unnoticed, enabling misconfigurations and delaying incident response.

Enable AWS Config in every Region with continuous recording and maintain healthy recorder status.

•CIS-7.0: 4.3 •SOC2: cc_2_1, cc_3_1, cc_3_4, cc_8_1, pi_1_3 •CIS-1.4: 3.5 •CIS-1.5: 3.5 •MITRE-ATTACK: T1190, T1078, T1204, T1098, T1136, T1525, T1562, T1110, T1040, T1119, T1530, T1485, T1486, T1491, T1499, T1496, T1498 •GDPR: article_25, article_30 •AWS-Foundational-Security-Best-Practices: Config.1 •ISO27001-2013: A.12.4.P •KISA-ISMS-P-2023: 2.10.2, 2.11.3 •C5-2025: OIS-05.01B, PS-02.01B, PS-02.01AS, PS-02.02AS, DEV-08.02B •HIPAA: 164_308_a_1_ii_a •CIS-2.0: 3.5 •KISA-ISMS-P-2023-korean: 2.10.2, 2.11.3 •AWS-Well-Architected-Framework-Security-Pillar: SEC04-BP02 •GxP-EU-Annex-11: 10-change-and-configuration-management, 4.5-validation-development-quality, 4.6-validation-quality-performance •NIST-CSF-2.0: rm_1, po_3, po_4, ov_3, pt_1 •CIS-5.0: 3.3 •ASD-Essential-Eight-Nov 2023: E8-1.1, E8-2.1 •AWS-Account-Security-Onboarding: Enable continuous recording for most of the resources, Confirm that records are present in central aggregator •CIS-3.0: 3.3 •ENS-RD2022: op.exp.1.aws.cfg.1, op.exp.1.aws.cfg.2, op.exp.3.aws.cfg.1, op.exp.3.r3.aws.cfg.1, op.mon.3.r2.aws.cfg.1, op.mon.3.r6.aws.cfg.1 •CIS-6.0: 4.3 •NIST-CSF-1.1: cm_2, am_1, ra_5, sc_4, ip_12 •CCC-v2025.10: CCC.Core.CN04.AR01 •SecNumCloud-3.2: 8.1, 12.2, 13.1, 14.2, 17.5, 18.3 •PCI-3.2.1: 2.4, 2.4.a, 10.5, 10.5.2, 11.5, 11.5.a, 11.5.b •ProwlerThreatScore-1.0: 3.3.1 •ISO27001-2022: A.5.16, A.5.22 •AWS-AI-Security-Framework-1.0: AISF-GOV-01 •CIS-4.0.1: 3.3 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-piy, ksi-mla-07

Using a custom or incorrect role can break recording or create blind spots, undermining the integrity and availability of configuration history. Over‑privileged roles weaken least privilege, increasing risk of unauthorized access, stealthy changes, and delayed incident response.

Use the AWS‑managed service‑linked role AWSServiceRoleForConfig for all recorders to enforce least privilege and consistent trust.

Avoid custom roles; restrict who can modify the recorder or role; monitor for drift and ensure recording remains enabled as part of defense in depth.

•KISA-ISMS-P-2023: 2.5.6, 2.10.2 •C5-2025: IAM-01.01B, IAM-01.04B, DEV-08.02B •KISA-ISMS-P-2023-korean: 2.5.6, 2.10.2 •NIST-CSF-2.0: rm_1, po_4, ov_3, pt_1 •SecNumCloud-3.2: 13.1 •AWS-AI-Security-Framework-1.0: AISF-GOV-01 •FedRAMP-20x-KSI-Low-25.05C: ksi-piy

Insufficient capacity scaling causes throttling that degrades availability and increases latency.

Sustained throttling can trigger retry storms, timeouts, and backlogs, risking missed writes or out-of-order processing that impacts data integrity and drives operational costs.

Adopt elastic capacity: prefer on-demand for unpredictable traffic, or use PROVISIONED with auto scaling on both reads and writes.

Define safe utilization targets and bounds, monitor consumption, and plan for bursts to maintain availability and resilience over manual fixed throughput.

•KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •NIST-CSF-2.0: ds_4

Relying on the default service-owned key reduces control over confidentiality: no custom key policies, limited auditability, and no independent rotation or disablement. This weakens least-privilege enforcement and incident response, and can impede meeting mandates that require customer-controlled keys.

Encrypt tables with KMS keys in your account-prefer customer-managed keys for sensitive data.

• Enforce least-privilege key policies and scope grants
• Enable rotation and monitor key usage
• Separate duties for key admins vs data users
• Restrict which principals can use the key for DynamoDB

•CISA: your-systems-3, your-data-1, your-data-2 •SOC2: pi_1_5 •MITRE-ATTACK: T1530 •GDPR: article_32 •KISA-ISMS-P-2023: 2.7.2, 2.10.2 •C5-2025: OIS-08.02B, OPS-31.01B, IAM-07.03B, IAM-09.03B, IAM-09.02AC, CRY-01.02AC, CRY-05.02B, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_e_2_ii •KISA-ISMS-P-2023-korean: 2.7.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •NIST-CSF-2.0: ds_1 •NIST-800-171-Revision-2: 3_13_11, 3_13_16 •PCI-4.0: 3.5.1.11, 3.5.1.12, 8.3.2.18, 8.3.2.19 •NIST-800-53-Revision-4: sc_13 •NIST-800-53-Revision-5: au_9_3, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •ENS-RD2022: mp.si.2.aws.dydb.1 •AWS-Foundational-Technical-Review: SDAT-002 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ISO27001-2022: A.8.5, A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05

Without blocking public access, AMIs could be accidentally or maliciously shared publicly, exposing baked-in secrets, source code, and infrastructure details to unauthorized actors.

Enable AMI block public access (block-new-sharing) in every active Region. Apply guardrails (SCPs) to prevent it from being disabled, and review any AMIs that are currently shared publicly.

Without blocking public access, AMIs could be accidentally or maliciously shared publicly, exposing baked-in secrets, source code, and infrastructure details to unauthorized actors.

Enable AMI block public access (block-new-sharing) in every active Region. Apply guardrails (SCPs) to prevent it from being disabled, and review any AMIs that are currently shared publicly.

Without encryption by default, data on new EBS volumes and snapshots may be stored in plaintext. A compromised account or mis-shared snapshot can expose disk contents, enabling data exfiltration, offline analysis, and loss of confidentiality.

Enable EBS encryption by default in every region and select a customer-managed KMS key. Apply least privilege to key use, rotate keys, and monitor access. Enforce encrypted volume creation with organizational guardrails and secure templates as defense in depth.

•CISA: your-systems-3, your-data-1 •CIS-7.0: 6.1.1 •MITRE-ATTACK: T1119 •AWS-Foundational-Security-Best-Practices: EC2.7 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: OPS-31.01B, IAM-07.03B, CRY-01.02AC, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_e_2_ii •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •NIST-800-53-Revision-4: sc_28 •NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •AWS-Audit-Manager-Control-Tower-Guardrails: 1.0.3 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •FFIEC: d3-pc-am-b-12 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ISO27001-2022: A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05 •FedRAMP-20x-KSI-Low-25.05C: ksi-svc

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

•CISA: your-systems-3, your-data-1, your-data-2 •SOC2: pi_1_5 •CIS-1.4: 2.2.1 •CIS-1.5: 2.2.1 •MITRE-ATTACK: T1119 •GDPR: article_32 •AWS-Foundational-Security-Best-Practices: EC2.3 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: OPS-31.01B, IAM-07.03B, CRY-01.02AC, CRY-03.01B, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii •CIS-2.0: 2.2.1 •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •CIS-5.0: 5.1.1 •NIST-800-171-Revision-2: 3_5_10, 3_13_11, 3_13_16 •PCI-4.0: 3.5.1.20, 8.3.2.34 •NIST-800-53-Revision-4: sc_28 •NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •CIS-3.0: 2.2.1 •ENS-RD2022: mp.si.2.aws.kms.1 •CIS-6.0: 6.1.1 •NIST-CSF-1.1: ds_1 •AWS-Audit-Manager-Control-Tower-Guardrails: 1.0.3 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •FFIEC: d3-pc-am-b-12 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ProwlerThreatScore-1.0: 4.2.1 •ISO27001-2022: A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05 •FedRamp-Moderate-Revision-4: sc-28 •CIS-4.0.1: 5.1.1

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

•CISA: your-systems-3, your-data-1, your-data-2 •SOC2: pi_1_5 •CIS-1.4: 2.2.1 •CIS-1.5: 2.2.1 •MITRE-ATTACK: T1119 •GDPR: article_32 •AWS-Foundational-Security-Best-Practices: EC2.3 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: OPS-31.01B, IAM-07.03B, CRY-01.02AC, CRY-03.01B, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii •CIS-2.0: 2.2.1 •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •CIS-5.0: 5.1.1 •NIST-800-171-Revision-2: 3_5_10, 3_13_11, 3_13_16 •PCI-4.0: 3.5.1.20, 8.3.2.34 •NIST-800-53-Revision-4: sc_28 •NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •CIS-3.0: 2.2.1 •ENS-RD2022: mp.si.2.aws.kms.1 •CIS-6.0: 6.1.1 •NIST-CSF-1.1: ds_1 •AWS-Audit-Manager-Control-Tower-Guardrails: 1.0.3 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •FFIEC: d3-pc-am-b-12 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ProwlerThreatScore-1.0: 4.2.1 •ISO27001-2022: A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05 •FedRamp-Moderate-Revision-4: sc-28 •CIS-4.0.1: 5.1.1

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

•CISA: your-systems-3, your-data-1, your-data-2 •SOC2: pi_1_5 •CIS-1.4: 2.2.1 •CIS-1.5: 2.2.1 •MITRE-ATTACK: T1119 •GDPR: article_32 •AWS-Foundational-Security-Best-Practices: EC2.3 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: OPS-31.01B, IAM-07.03B, CRY-01.02AC, CRY-03.01B, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii •CIS-2.0: 2.2.1 •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •CIS-5.0: 5.1.1 •NIST-800-171-Revision-2: 3_5_10, 3_13_11, 3_13_16 •PCI-4.0: 3.5.1.20, 8.3.2.34 •NIST-800-53-Revision-4: sc_28 •NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •CIS-3.0: 2.2.1 •ENS-RD2022: mp.si.2.aws.kms.1 •CIS-6.0: 6.1.1 •NIST-CSF-1.1: ds_1 •AWS-Audit-Manager-Control-Tower-Guardrails: 1.0.3 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •FFIEC: d3-pc-am-b-12 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ProwlerThreatScore-1.0: 4.2.1 •ISO27001-2022: A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05 •FedRamp-Moderate-Revision-4: sc-28 •CIS-4.0.1: 5.1.1

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

•CISA: your-systems-3, your-data-1, your-data-2 •SOC2: pi_1_5 •CIS-1.4: 2.2.1 •CIS-1.5: 2.2.1 •MITRE-ATTACK: T1119 •GDPR: article_32 •AWS-Foundational-Security-Best-Practices: EC2.3 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: OPS-31.01B, IAM-07.03B, CRY-01.02AC, CRY-03.01B, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii •CIS-2.0: 2.2.1 •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •CIS-5.0: 5.1.1 •NIST-800-171-Revision-2: 3_5_10, 3_13_11, 3_13_16 •PCI-4.0: 3.5.1.20, 8.3.2.34 •NIST-800-53-Revision-4: sc_28 •NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •CIS-3.0: 2.2.1 •ENS-RD2022: mp.si.2.aws.kms.1 •CIS-6.0: 6.1.1 •NIST-CSF-1.1: ds_1 •AWS-Audit-Manager-Control-Tower-Guardrails: 1.0.3 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •FFIEC: d3-pc-am-b-12 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ProwlerThreatScore-1.0: 4.2.1 •ISO27001-2022: A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05 •FedRamp-Moderate-Revision-4: sc-28 •CIS-4.0.1: 5.1.1

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

•CISA: your-systems-3, your-data-1, your-data-2 •SOC2: pi_1_5 •CIS-1.4: 2.2.1 •CIS-1.5: 2.2.1 •MITRE-ATTACK: T1119 •GDPR: article_32 •AWS-Foundational-Security-Best-Practices: EC2.3 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: OPS-31.01B, IAM-07.03B, CRY-01.02AC, CRY-03.01B, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii •CIS-2.0: 2.2.1 •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •CIS-5.0: 5.1.1 •NIST-800-171-Revision-2: 3_5_10, 3_13_11, 3_13_16 •PCI-4.0: 3.5.1.20, 8.3.2.34 •NIST-800-53-Revision-4: sc_28 •NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •CIS-3.0: 2.2.1 •ENS-RD2022: mp.si.2.aws.kms.1 •CIS-6.0: 6.1.1 •NIST-CSF-1.1: ds_1 •AWS-Audit-Manager-Control-Tower-Guardrails: 1.0.3 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •FFIEC: d3-pc-am-b-12 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ProwlerThreatScore-1.0: 4.2.1 •ISO27001-2022: A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05 •FedRamp-Moderate-Revision-4: sc-28 •CIS-4.0.1: 5.1.1

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

•CISA: your-systems-3, your-data-1, your-data-2 •SOC2: pi_1_5 •CIS-1.4: 2.2.1 •CIS-1.5: 2.2.1 •MITRE-ATTACK: T1119 •GDPR: article_32 •AWS-Foundational-Security-Best-Practices: EC2.3 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: OPS-31.01B, IAM-07.03B, CRY-01.02AC, CRY-03.01B, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii •CIS-2.0: 2.2.1 •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •CIS-5.0: 5.1.1 •NIST-800-171-Revision-2: 3_5_10, 3_13_11, 3_13_16 •PCI-4.0: 3.5.1.20, 8.3.2.34 •NIST-800-53-Revision-4: sc_28 •NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •CIS-3.0: 2.2.1 •ENS-RD2022: mp.si.2.aws.kms.1 •CIS-6.0: 6.1.1 •NIST-CSF-1.1: ds_1 •AWS-Audit-Manager-Control-Tower-Guardrails: 1.0.3 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •FFIEC: d3-pc-am-b-12 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ProwlerThreatScore-1.0: 4.2.1 •ISO27001-2022: A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05 •FedRamp-Moderate-Revision-4: sc-28 •CIS-4.0.1: 5.1.1

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

•CISA: your-systems-3, your-data-1, your-data-2 •SOC2: pi_1_5 •CIS-1.4: 2.2.1 •CIS-1.5: 2.2.1 •MITRE-ATTACK: T1119 •GDPR: article_32 •AWS-Foundational-Security-Best-Practices: EC2.3 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: OPS-31.01B, IAM-07.03B, CRY-01.02AC, CRY-03.01B, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii •CIS-2.0: 2.2.1 •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •CIS-5.0: 5.1.1 •NIST-800-171-Revision-2: 3_5_10, 3_13_11, 3_13_16 •PCI-4.0: 3.5.1.20, 8.3.2.34 •NIST-800-53-Revision-4: sc_28 •NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •CIS-3.0: 2.2.1 •ENS-RD2022: mp.si.2.aws.kms.1 •CIS-6.0: 6.1.1 •NIST-CSF-1.1: ds_1 •AWS-Audit-Manager-Control-Tower-Guardrails: 1.0.3 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •FFIEC: d3-pc-am-b-12 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ProwlerThreatScore-1.0: 4.2.1 •ISO27001-2022: A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05 •FedRamp-Moderate-Revision-4: sc-28 •CIS-4.0.1: 5.1.1

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

•CISA: your-systems-3, your-data-1, your-data-2 •SOC2: pi_1_5 •CIS-1.4: 2.2.1 •CIS-1.5: 2.2.1 •MITRE-ATTACK: T1119 •GDPR: article_32 •AWS-Foundational-Security-Best-Practices: EC2.3 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: OPS-31.01B, IAM-07.03B, CRY-01.02AC, CRY-03.01B, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii •CIS-2.0: 2.2.1 •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •CIS-5.0: 5.1.1 •NIST-800-171-Revision-2: 3_5_10, 3_13_11, 3_13_16 •PCI-4.0: 3.5.1.20, 8.3.2.34 •NIST-800-53-Revision-4: sc_28 •NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •CIS-3.0: 2.2.1 •ENS-RD2022: mp.si.2.aws.kms.1 •CIS-6.0: 6.1.1 •NIST-CSF-1.1: ds_1 •AWS-Audit-Manager-Control-Tower-Guardrails: 1.0.3 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •FFIEC: d3-pc-am-b-12 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ProwlerThreatScore-1.0: 4.2.1 •ISO27001-2022: A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05 •FedRamp-Moderate-Revision-4: sc-28 •CIS-4.0.1: 5.1.1

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

•CISA: your-systems-3, your-data-1, your-data-2 •SOC2: pi_1_5 •CIS-1.4: 2.2.1 •CIS-1.5: 2.2.1 •MITRE-ATTACK: T1119 •GDPR: article_32 •AWS-Foundational-Security-Best-Practices: EC2.3 •KISA-ISMS-P-2023: 2.7.1, 2.10.2 •C5-2025: OPS-31.01B, IAM-07.03B, CRY-01.02AC, CRY-03.01B, CRY-05.01AC, PSS-12.02B •HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii •CIS-2.0: 2.2.1 •KISA-ISMS-P-2023-korean: 2.7.1, 2.10.2 •GxP-21-CFR-Part-11: 11.10-g, 11.30 •AWS-Well-Architected-Framework-Security-Pillar: SEC08-BP02 •GxP-EU-Annex-11: 7.1-data-storage-damage-protection •CIS-5.0: 5.1.1 •NIST-800-171-Revision-2: 3_5_10, 3_13_11, 3_13_16 •PCI-4.0: 3.5.1.20, 8.3.2.34 •NIST-800-53-Revision-4: sc_28 •NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, sc_8_3, sc_8_4, sc_13_a, sc_28_1, si_19_4 •CIS-3.0: 2.2.1 •ENS-RD2022: mp.si.2.aws.kms.1 •CIS-6.0: 6.1.1 •NIST-CSF-1.1: ds_1 •AWS-Audit-Manager-Control-Tower-Guardrails: 1.0.3 •CCC-v2025.10: CCC.Core.CN02.AR01 •SecNumCloud-3.2: 10.1 •RBI-Cyber-Security-Framework: annex_i_1_3 •FFIEC: d3-pc-am-b-12 •PCI-3.2.1: 3.4, 3.4.1, 3.4.1.a, 3.4.1.c, 3.4.a, 3.4.b, 8.2, 8.2.1, 8.2.1.a •ProwlerThreatScore-1.0: 4.2.1 •ISO27001-2022: A.8.11, A.8.24 •AWS-AI-Security-Framework-1.0: AISF-INFRA-05 •FedRamp-Moderate-Revision-4: sc-28 •CIS-4.0.1: 5.1.1

Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (availability). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.

Release unused Elastic IPs or promptly associate them only where required. Enforce least privilege for address allocation, apply tagging to track ownership, and schedule periodic audits. Prefer private networking or managed front ends to reduce public IPv4 use. Automate reclaiming of unassociated addresses in lifecycle policies.

•CISA: your-systems-1, your-surroundings-1 •AWS-Foundational-Security-Best-Practices: EC2.12 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_4_1 •NIST-CSF-1.1: ds_3 •FFIEC: d1-g-it-b-1 •PCI-3.2.1: 2.4 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (availability). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.

Release unused Elastic IPs or promptly associate them only where required. Enforce least privilege for address allocation, apply tagging to track ownership, and schedule periodic audits. Prefer private networking or managed front ends to reduce public IPv4 use. Automate reclaiming of unassociated addresses in lifecycle policies.

•CISA: your-systems-1, your-surroundings-1 •AWS-Foundational-Security-Best-Practices: EC2.12 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_4_1 •NIST-CSF-1.1: ds_3 •FFIEC: d1-g-it-b-1 •PCI-3.2.1: 2.4 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (availability). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.

Release unused Elastic IPs or promptly associate them only where required. Enforce least privilege for address allocation, apply tagging to track ownership, and schedule periodic audits. Prefer private networking or managed front ends to reduce public IPv4 use. Automate reclaiming of unassociated addresses in lifecycle policies.

•CISA: your-systems-1, your-surroundings-1 •AWS-Foundational-Security-Best-Practices: EC2.12 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_4_1 •NIST-CSF-1.1: ds_3 •FFIEC: d1-g-it-b-1 •PCI-3.2.1: 2.4 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (availability). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.

Release unused Elastic IPs or promptly associate them only where required. Enforce least privilege for address allocation, apply tagging to track ownership, and schedule periodic audits. Prefer private networking or managed front ends to reduce public IPv4 use. Automate reclaiming of unassociated addresses in lifecycle policies.

•CISA: your-systems-1, your-surroundings-1 •AWS-Foundational-Security-Best-Practices: EC2.12 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_4_1 •NIST-CSF-1.1: ds_3 •FFIEC: d1-g-it-b-1 •PCI-3.2.1: 2.4 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (availability). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.

Release unused Elastic IPs or promptly associate them only where required. Enforce least privilege for address allocation, apply tagging to track ownership, and schedule periodic audits. Prefer private networking or managed front ends to reduce public IPv4 use. Automate reclaiming of unassociated addresses in lifecycle policies.

•CISA: your-systems-1, your-surroundings-1 •AWS-Foundational-Security-Best-Practices: EC2.12 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_4_1 •NIST-CSF-1.1: ds_3 •FFIEC: d1-g-it-b-1 •PCI-3.2.1: 2.4 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (availability). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.

Release unused Elastic IPs or promptly associate them only where required. Enforce least privilege for address allocation, apply tagging to track ownership, and schedule periodic audits. Prefer private networking or managed front ends to reduce public IPv4 use. Automate reclaiming of unassociated addresses in lifecycle policies.

•CISA: your-systems-1, your-surroundings-1 •AWS-Foundational-Security-Best-Practices: EC2.12 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_4_1 •NIST-CSF-1.1: ds_3 •FFIEC: d1-g-it-b-1 •PCI-3.2.1: 2.4 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (availability). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.

Release unused Elastic IPs or promptly associate them only where required. Enforce least privilege for address allocation, apply tagging to track ownership, and schedule periodic audits. Prefer private networking or managed front ends to reduce public IPv4 use. Automate reclaiming of unassociated addresses in lifecycle policies.

•CISA: your-systems-1, your-surroundings-1 •AWS-Foundational-Security-Best-Practices: EC2.12 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP06 •NIST-800-171-Revision-2: 3_4_1 •NIST-CSF-1.1: ds_3 •FFIEC: d1-g-it-b-1 •PCI-3.2.1: 2.4 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Permitting IMDSv1 or optional tokens lets SSRF or compromised workloads retrieve temporary IAM credentials, impacting confidentiality and integrity. Stolen role creds can drive privilege escalation, unauthorized data access, and lateral movement across AWS resources.

Apply defense in depth:
- Require IMDSv2 tokens on all instances (http_tokens: required)
- Disable metadata where not needed (http_endpoint: disabled)
- Minimize hop limit to 1 when feasible
- Update SDKs/apps for IMDSv2
- Restrict instance profile permissions (least privilege)
- Block metadata access from untrusted workloads

•CIS-7.0: 6.7 •SOC2: cc_7_2 •MITRE-ATTACK: T1552 •AWS-Foundational-Security-Best-Practices: EC2.8 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •CIS-2.0: 5.6 •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-d, 11.10-g •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP01, SEC06-BP01 •NIST-CSF-2.0: ac_3 •CIS-5.0: 5.7 •NIST-800-171-Revision-2: 3_12_4 •PCI-4.0: 8.2.8.4 •NIST-800-53-Revision-4: ac_6, ca_7, si_4_2, si_4 •NIST-800-53-Revision-5: ac_2_6, ac_3, ac_3_3, ac_3_3_a, ac_3_3_b_1, ac_3_3_b_2, ac_3_3_b_3, ac_3_3_b_4, ac_3_3_b_5, ac_3_3_c, ac_3_4, ac_3_4_a, ac_3_4_b, ac_3_4_c, ac_3_4_d, ac_3_4_e, ac_3_7, ac_3_8, ac_3_12_a, ac_3_13, ac_3_15_a, ac_3_15_b, ac_4_28, ac_6, ac_24, cm_5_1_a, mp_2, sc_23_3 •CIS-3.0: 5.6 •CIS-6.0: 6.7 •NIST-CSF-1.1: cm_2, cm_5, cp_4, cp_5, ra_5, sc_4 •ProwlerThreatScore-1.0: 4.1.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •FedRamp-Moderate-Revision-4: ac-3, ac-6, ca-7-a-b, si-4-2, si-4-4, si-4-5, si-4-a-b-c •FedRAMP-Low-Revision-4: ac-3, ca-7 •CIS-4.0.1: 5.7 •NIS2: 6.7.2.i •FedRAMP-20x-KSI-Low-25.05C: ksi-cna

Permitting IMDSv1 or optional tokens lets SSRF or compromised workloads retrieve temporary IAM credentials, impacting confidentiality and integrity. Stolen role creds can drive privilege escalation, unauthorized data access, and lateral movement across AWS resources.

Apply defense in depth:
- Require IMDSv2 tokens on all instances (http_tokens: required)
- Disable metadata where not needed (http_endpoint: disabled)
- Minimize hop limit to 1 when feasible
- Update SDKs/apps for IMDSv2
- Restrict instance profile permissions (least privilege)
- Block metadata access from untrusted workloads

•CIS-7.0: 6.7 •SOC2: cc_7_2 •MITRE-ATTACK: T1552 •AWS-Foundational-Security-Best-Practices: EC2.8 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •CIS-2.0: 5.6 •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-d, 11.10-g •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP01, SEC06-BP01 •NIST-CSF-2.0: ac_3 •CIS-5.0: 5.7 •NIST-800-171-Revision-2: 3_12_4 •PCI-4.0: 8.2.8.4 •NIST-800-53-Revision-4: ac_6, ca_7, si_4_2, si_4 •NIST-800-53-Revision-5: ac_2_6, ac_3, ac_3_3, ac_3_3_a, ac_3_3_b_1, ac_3_3_b_2, ac_3_3_b_3, ac_3_3_b_4, ac_3_3_b_5, ac_3_3_c, ac_3_4, ac_3_4_a, ac_3_4_b, ac_3_4_c, ac_3_4_d, ac_3_4_e, ac_3_7, ac_3_8, ac_3_12_a, ac_3_13, ac_3_15_a, ac_3_15_b, ac_4_28, ac_6, ac_24, cm_5_1_a, mp_2, sc_23_3 •CIS-3.0: 5.6 •CIS-6.0: 6.7 •NIST-CSF-1.1: cm_2, cm_5, cp_4, cp_5, ra_5, sc_4 •ProwlerThreatScore-1.0: 4.1.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •FedRamp-Moderate-Revision-4: ac-3, ac-6, ca-7-a-b, si-4-2, si-4-4, si-4-5, si-4-a-b-c •FedRAMP-Low-Revision-4: ac-3, ca-7 •CIS-4.0.1: 5.7 •NIS2: 6.7.2.i •FedRAMP-20x-KSI-Low-25.05C: ksi-cna

Permitting IMDSv1 or optional tokens lets SSRF or compromised workloads retrieve temporary IAM credentials, impacting confidentiality and integrity. Stolen role creds can drive privilege escalation, unauthorized data access, and lateral movement across AWS resources.

Apply defense in depth:
- Require IMDSv2 tokens on all instances (http_tokens: required)
- Disable metadata where not needed (http_endpoint: disabled)
- Minimize hop limit to 1 when feasible
- Update SDKs/apps for IMDSv2
- Restrict instance profile permissions (least privilege)
- Block metadata access from untrusted workloads

•CIS-7.0: 6.7 •SOC2: cc_7_2 •MITRE-ATTACK: T1552 •AWS-Foundational-Security-Best-Practices: EC2.8 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •CIS-2.0: 5.6 •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-d, 11.10-g •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP01, SEC06-BP01 •NIST-CSF-2.0: ac_3 •CIS-5.0: 5.7 •NIST-800-171-Revision-2: 3_12_4 •PCI-4.0: 8.2.8.4 •NIST-800-53-Revision-4: ac_6, ca_7, si_4_2, si_4 •NIST-800-53-Revision-5: ac_2_6, ac_3, ac_3_3, ac_3_3_a, ac_3_3_b_1, ac_3_3_b_2, ac_3_3_b_3, ac_3_3_b_4, ac_3_3_b_5, ac_3_3_c, ac_3_4, ac_3_4_a, ac_3_4_b, ac_3_4_c, ac_3_4_d, ac_3_4_e, ac_3_7, ac_3_8, ac_3_12_a, ac_3_13, ac_3_15_a, ac_3_15_b, ac_4_28, ac_6, ac_24, cm_5_1_a, mp_2, sc_23_3 •CIS-3.0: 5.6 •CIS-6.0: 6.7 •NIST-CSF-1.1: cm_2, cm_5, cp_4, cp_5, ra_5, sc_4 •ProwlerThreatScore-1.0: 4.1.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •FedRamp-Moderate-Revision-4: ac-3, ac-6, ca-7-a-b, si-4-2, si-4-4, si-4-5, si-4-a-b-c •FedRAMP-Low-Revision-4: ac-3, ca-7 •CIS-4.0.1: 5.7 •NIS2: 6.7.2.i •FedRAMP-20x-KSI-Low-25.05C: ksi-cna

Permitting IMDSv1 or optional tokens lets SSRF or compromised workloads retrieve temporary IAM credentials, impacting confidentiality and integrity. Stolen role creds can drive privilege escalation, unauthorized data access, and lateral movement across AWS resources.

Apply defense in depth:
- Require IMDSv2 tokens on all instances (http_tokens: required)
- Disable metadata where not needed (http_endpoint: disabled)
- Minimize hop limit to 1 when feasible
- Update SDKs/apps for IMDSv2
- Restrict instance profile permissions (least privilege)
- Block metadata access from untrusted workloads

•CIS-7.0: 6.7 •SOC2: cc_7_2 •MITRE-ATTACK: T1552 •AWS-Foundational-Security-Best-Practices: EC2.8 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •CIS-2.0: 5.6 •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-d, 11.10-g •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP01, SEC06-BP01 •NIST-CSF-2.0: ac_3 •CIS-5.0: 5.7 •NIST-800-171-Revision-2: 3_12_4 •PCI-4.0: 8.2.8.4 •NIST-800-53-Revision-4: ac_6, ca_7, si_4_2, si_4 •NIST-800-53-Revision-5: ac_2_6, ac_3, ac_3_3, ac_3_3_a, ac_3_3_b_1, ac_3_3_b_2, ac_3_3_b_3, ac_3_3_b_4, ac_3_3_b_5, ac_3_3_c, ac_3_4, ac_3_4_a, ac_3_4_b, ac_3_4_c, ac_3_4_d, ac_3_4_e, ac_3_7, ac_3_8, ac_3_12_a, ac_3_13, ac_3_15_a, ac_3_15_b, ac_4_28, ac_6, ac_24, cm_5_1_a, mp_2, sc_23_3 •CIS-3.0: 5.6 •CIS-6.0: 6.7 •NIST-CSF-1.1: cm_2, cm_5, cp_4, cp_5, ra_5, sc_4 •ProwlerThreatScore-1.0: 4.1.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •FedRamp-Moderate-Revision-4: ac-3, ac-6, ca-7-a-b, si-4-2, si-4-4, si-4-5, si-4-a-b-c •FedRAMP-Low-Revision-4: ac-3, ca-7 •CIS-4.0.1: 5.7 •NIS2: 6.7.2.i •FedRAMP-20x-KSI-Low-25.05C: ksi-cna

Permitting IMDSv1 or optional tokens lets SSRF or compromised workloads retrieve temporary IAM credentials, impacting confidentiality and integrity. Stolen role creds can drive privilege escalation, unauthorized data access, and lateral movement across AWS resources.

Apply defense in depth:
- Require IMDSv2 tokens on all instances (http_tokens: required)
- Disable metadata where not needed (http_endpoint: disabled)
- Minimize hop limit to 1 when feasible
- Update SDKs/apps for IMDSv2
- Restrict instance profile permissions (least privilege)
- Block metadata access from untrusted workloads

•CIS-7.0: 6.7 •SOC2: cc_7_2 •MITRE-ATTACK: T1552 •AWS-Foundational-Security-Best-Practices: EC2.8 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •CIS-2.0: 5.6 •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-d, 11.10-g •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP01, SEC06-BP01 •NIST-CSF-2.0: ac_3 •CIS-5.0: 5.7 •NIST-800-171-Revision-2: 3_12_4 •PCI-4.0: 8.2.8.4 •NIST-800-53-Revision-4: ac_6, ca_7, si_4_2, si_4 •NIST-800-53-Revision-5: ac_2_6, ac_3, ac_3_3, ac_3_3_a, ac_3_3_b_1, ac_3_3_b_2, ac_3_3_b_3, ac_3_3_b_4, ac_3_3_b_5, ac_3_3_c, ac_3_4, ac_3_4_a, ac_3_4_b, ac_3_4_c, ac_3_4_d, ac_3_4_e, ac_3_7, ac_3_8, ac_3_12_a, ac_3_13, ac_3_15_a, ac_3_15_b, ac_4_28, ac_6, ac_24, cm_5_1_a, mp_2, sc_23_3 •CIS-3.0: 5.6 •CIS-6.0: 6.7 •NIST-CSF-1.1: cm_2, cm_5, cp_4, cp_5, ra_5, sc_4 •ProwlerThreatScore-1.0: 4.1.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •FedRamp-Moderate-Revision-4: ac-3, ac-6, ca-7-a-b, si-4-2, si-4-4, si-4-5, si-4-a-b-c •FedRAMP-Low-Revision-4: ac-3, ca-7 •CIS-4.0.1: 5.7 •NIS2: 6.7.2.i •FedRAMP-20x-KSI-Low-25.05C: ksi-cna

Permitting IMDSv1 or optional tokens lets SSRF or compromised workloads retrieve temporary IAM credentials, impacting confidentiality and integrity. Stolen role creds can drive privilege escalation, unauthorized data access, and lateral movement across AWS resources.

Apply defense in depth:
- Require IMDSv2 tokens on all instances (http_tokens: required)
- Disable metadata where not needed (http_endpoint: disabled)
- Minimize hop limit to 1 when feasible
- Update SDKs/apps for IMDSv2
- Restrict instance profile permissions (least privilege)
- Block metadata access from untrusted workloads

•CIS-7.0: 6.7 •SOC2: cc_7_2 •MITRE-ATTACK: T1552 •AWS-Foundational-Security-Best-Practices: EC2.8 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •CIS-2.0: 5.6 •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-d, 11.10-g •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP01, SEC06-BP01 •NIST-CSF-2.0: ac_3 •CIS-5.0: 5.7 •NIST-800-171-Revision-2: 3_12_4 •PCI-4.0: 8.2.8.4 •NIST-800-53-Revision-4: ac_6, ca_7, si_4_2, si_4 •NIST-800-53-Revision-5: ac_2_6, ac_3, ac_3_3, ac_3_3_a, ac_3_3_b_1, ac_3_3_b_2, ac_3_3_b_3, ac_3_3_b_4, ac_3_3_b_5, ac_3_3_c, ac_3_4, ac_3_4_a, ac_3_4_b, ac_3_4_c, ac_3_4_d, ac_3_4_e, ac_3_7, ac_3_8, ac_3_12_a, ac_3_13, ac_3_15_a, ac_3_15_b, ac_4_28, ac_6, ac_24, cm_5_1_a, mp_2, sc_23_3 •CIS-3.0: 5.6 •CIS-6.0: 6.7 •NIST-CSF-1.1: cm_2, cm_5, cp_4, cp_5, ra_5, sc_4 •ProwlerThreatScore-1.0: 4.1.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •FedRamp-Moderate-Revision-4: ac-3, ac-6, ca-7-a-b, si-4-2, si-4-4, si-4-5, si-4-a-b-c •FedRAMP-Low-Revision-4: ac-3, ca-7 •CIS-4.0.1: 5.7 •NIS2: 6.7.2.i •FedRAMP-20x-KSI-Low-25.05C: ksi-cna

Permitting IMDSv1 or optional tokens lets SSRF or compromised workloads retrieve temporary IAM credentials, impacting confidentiality and integrity. Stolen role creds can drive privilege escalation, unauthorized data access, and lateral movement across AWS resources.

Apply defense in depth:
- Require IMDSv2 tokens on all instances (http_tokens: required)
- Disable metadata where not needed (http_endpoint: disabled)
- Minimize hop limit to 1 when feasible
- Update SDKs/apps for IMDSv2
- Restrict instance profile permissions (least privilege)
- Block metadata access from untrusted workloads

•CIS-7.0: 6.7 •SOC2: cc_7_2 •MITRE-ATTACK: T1552 •AWS-Foundational-Security-Best-Practices: EC2.8 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •CIS-2.0: 5.6 •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-d, 11.10-g •AWS-Well-Architected-Framework-Security-Pillar: SEC03-BP01, SEC06-BP01 •NIST-CSF-2.0: ac_3 •CIS-5.0: 5.7 •NIST-800-171-Revision-2: 3_12_4 •PCI-4.0: 8.2.8.4 •NIST-800-53-Revision-4: ac_6, ca_7, si_4_2, si_4 •NIST-800-53-Revision-5: ac_2_6, ac_3, ac_3_3, ac_3_3_a, ac_3_3_b_1, ac_3_3_b_2, ac_3_3_b_3, ac_3_3_b_4, ac_3_3_b_5, ac_3_3_c, ac_3_4, ac_3_4_a, ac_3_4_b, ac_3_4_c, ac_3_4_d, ac_3_4_e, ac_3_7, ac_3_8, ac_3_12_a, ac_3_13, ac_3_15_a, ac_3_15_b, ac_4_28, ac_6, ac_24, cm_5_1_a, mp_2, sc_23_3 •CIS-3.0: 5.6 •CIS-6.0: 6.7 •NIST-CSF-1.1: cm_2, cm_5, cp_4, cp_5, ra_5, sc_4 •ProwlerThreatScore-1.0: 4.1.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •FedRamp-Moderate-Revision-4: ac-3, ac-6, ca-7-a-b, si-4-2, si-4-4, si-4-5, si-4-a-b-c •FedRAMP-Low-Revision-4: ac-3, ca-7 •CIS-4.0.1: 5.7 •NIS2: 6.7.2.i •FedRAMP-20x-KSI-Low-25.05C: ksi-cna

Publicly reachable instances with IAM role credentials expand the blast radius. Remote exploits or misconfigurations can steal credentials via the instance metadata service, enabling unauthorized API calls, data exfiltration, and lateral movement, impacting confidentiality, integrity, and availability.

Avoid direct Internet exposure. Place workloads behind an Application Load Balancer and protect HTTP apps with WAF. Remove public IPs or restrict ingress to trusted sources. Apply least privilege to instance profiles and enforce IMDSv2. Use bastion hosts or Session Manager for admin access.

•KISA-ISMS-P-2023: 2.5.6, 2.6.1, 2.6.2, 2.10.2 •KISA-ISMS-P-2023-korean: 2.5.6, 2.6.1, 2.6.2, 2.10.2 •AWS-Well-Architected-Framework-Security-Pillar: SEC06-BP01 •ENS-RD2022: mp.com.4.aws.vpc.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.

Enroll all instances as Systems Manager managed nodes. Prefer Session Manager over SSH/RDP, restrict inbound admin ports, and use least privilege roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.

•CISA: your-systems-1 •SOC2: cc_3_2, cc_7_1 •AWS-Foundational-Security-Best-Practices: SSM.1 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •HIPAA: 164_308_a_5_ii_b •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-a, 11.10-h •AWS-Well-Architected-Framework-Security-Pillar: SEC01-BP06, SEC06-BP04, SEC06-BP05 •NIST-CSF-2.0: ac_3 •NIST-800-171-Revision-2: 3_4_1, 3_4_2, 3_4_6, 3_4_9, 3_14_2 •ASD-Essential-Eight-Nov 2023: E8-1.1, E8-2.1, E8-2.6, E8-2.7 •NIST-800-53-Revision-4: cm_2, cm_7, cm_8_1, cm_8_3, sa_3, sa_10, si_2_2, si_7_1 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_6, cm_8_1, cm_8_2, cm_8_3_a, cm_8_6, cm_8_a, cm_8_a_1, cm_8_a_2, cm_8_a_3, cm_8_a_4, cm_8_a_5, cm_8_b, si_3_c_2 •ENS-RD2022: op.acc.4.aws.iam.6, op.acc.4.aws.sys.1, op.exp.1.aws.sys.1, op.exp.4.aws.sys.2, op.exp.4.r2.aws.sys.1, op.exp.9.aws.img.1, op.acc.4.aws.iam.3 •NIST-CSF-1.1: am_1, am_2, ds_3, ds_7, ds_8, ip_1, ip_2, ip_12 •SecNumCloud-3.2: 8.1, 12.10, 12.12 •RBI-Cyber-Security-Framework: annex_i_1_1 •FFIEC: d1-g-it-b-1, d3-pc-im-b-5 •ISO27001-2022: A.5.26 •FedRamp-Moderate-Revision-4: cm-2, cm-7-a, cm-8-1, cm-8-3-a, sa-3-a, sa-10, si-2-2, si-7-1 •FedRAMP-Low-Revision-4: cm-8, sa-3 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-piy

Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.

Enroll all instances as Systems Manager managed nodes. Prefer Session Manager over SSH/RDP, restrict inbound admin ports, and use least privilege roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.

•CISA: your-systems-1 •SOC2: cc_3_2, cc_7_1 •AWS-Foundational-Security-Best-Practices: SSM.1 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •HIPAA: 164_308_a_5_ii_b •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-a, 11.10-h •AWS-Well-Architected-Framework-Security-Pillar: SEC01-BP06, SEC06-BP04, SEC06-BP05 •NIST-CSF-2.0: ac_3 •NIST-800-171-Revision-2: 3_4_1, 3_4_2, 3_4_6, 3_4_9, 3_14_2 •ASD-Essential-Eight-Nov 2023: E8-1.1, E8-2.1, E8-2.6, E8-2.7 •NIST-800-53-Revision-4: cm_2, cm_7, cm_8_1, cm_8_3, sa_3, sa_10, si_2_2, si_7_1 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_6, cm_8_1, cm_8_2, cm_8_3_a, cm_8_6, cm_8_a, cm_8_a_1, cm_8_a_2, cm_8_a_3, cm_8_a_4, cm_8_a_5, cm_8_b, si_3_c_2 •ENS-RD2022: op.acc.4.aws.iam.6, op.acc.4.aws.sys.1, op.exp.1.aws.sys.1, op.exp.4.aws.sys.2, op.exp.4.r2.aws.sys.1, op.exp.9.aws.img.1, op.acc.4.aws.iam.3 •NIST-CSF-1.1: am_1, am_2, ds_3, ds_7, ds_8, ip_1, ip_2, ip_12 •SecNumCloud-3.2: 8.1, 12.10, 12.12 •RBI-Cyber-Security-Framework: annex_i_1_1 •FFIEC: d1-g-it-b-1, d3-pc-im-b-5 •ISO27001-2022: A.5.26 •FedRamp-Moderate-Revision-4: cm-2, cm-7-a, cm-8-1, cm-8-3-a, sa-3-a, sa-10, si-2-2, si-7-1 •FedRAMP-Low-Revision-4: cm-8, sa-3 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-piy

Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.

Enroll all instances as Systems Manager managed nodes. Prefer Session Manager over SSH/RDP, restrict inbound admin ports, and use least privilege roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.

•CISA: your-systems-1 •SOC2: cc_3_2, cc_7_1 •AWS-Foundational-Security-Best-Practices: SSM.1 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •HIPAA: 164_308_a_5_ii_b •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-a, 11.10-h •AWS-Well-Architected-Framework-Security-Pillar: SEC01-BP06, SEC06-BP04, SEC06-BP05 •NIST-CSF-2.0: ac_3 •NIST-800-171-Revision-2: 3_4_1, 3_4_2, 3_4_6, 3_4_9, 3_14_2 •ASD-Essential-Eight-Nov 2023: E8-1.1, E8-2.1, E8-2.6, E8-2.7 •NIST-800-53-Revision-4: cm_2, cm_7, cm_8_1, cm_8_3, sa_3, sa_10, si_2_2, si_7_1 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_6, cm_8_1, cm_8_2, cm_8_3_a, cm_8_6, cm_8_a, cm_8_a_1, cm_8_a_2, cm_8_a_3, cm_8_a_4, cm_8_a_5, cm_8_b, si_3_c_2 •ENS-RD2022: op.acc.4.aws.iam.6, op.acc.4.aws.sys.1, op.exp.1.aws.sys.1, op.exp.4.aws.sys.2, op.exp.4.r2.aws.sys.1, op.exp.9.aws.img.1, op.acc.4.aws.iam.3 •NIST-CSF-1.1: am_1, am_2, ds_3, ds_7, ds_8, ip_1, ip_2, ip_12 •SecNumCloud-3.2: 8.1, 12.10, 12.12 •RBI-Cyber-Security-Framework: annex_i_1_1 •FFIEC: d1-g-it-b-1, d3-pc-im-b-5 •ISO27001-2022: A.5.26 •FedRamp-Moderate-Revision-4: cm-2, cm-7-a, cm-8-1, cm-8-3-a, sa-3-a, sa-10, si-2-2, si-7-1 •FedRAMP-Low-Revision-4: cm-8, sa-3 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-piy

Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.

Enroll all instances as Systems Manager managed nodes. Prefer Session Manager over SSH/RDP, restrict inbound admin ports, and use least privilege roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.

•CISA: your-systems-1 •SOC2: cc_3_2, cc_7_1 •AWS-Foundational-Security-Best-Practices: SSM.1 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •HIPAA: 164_308_a_5_ii_b •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-a, 11.10-h •AWS-Well-Architected-Framework-Security-Pillar: SEC01-BP06, SEC06-BP04, SEC06-BP05 •NIST-CSF-2.0: ac_3 •NIST-800-171-Revision-2: 3_4_1, 3_4_2, 3_4_6, 3_4_9, 3_14_2 •ASD-Essential-Eight-Nov 2023: E8-1.1, E8-2.1, E8-2.6, E8-2.7 •NIST-800-53-Revision-4: cm_2, cm_7, cm_8_1, cm_8_3, sa_3, sa_10, si_2_2, si_7_1 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_6, cm_8_1, cm_8_2, cm_8_3_a, cm_8_6, cm_8_a, cm_8_a_1, cm_8_a_2, cm_8_a_3, cm_8_a_4, cm_8_a_5, cm_8_b, si_3_c_2 •ENS-RD2022: op.acc.4.aws.iam.6, op.acc.4.aws.sys.1, op.exp.1.aws.sys.1, op.exp.4.aws.sys.2, op.exp.4.r2.aws.sys.1, op.exp.9.aws.img.1, op.acc.4.aws.iam.3 •NIST-CSF-1.1: am_1, am_2, ds_3, ds_7, ds_8, ip_1, ip_2, ip_12 •SecNumCloud-3.2: 8.1, 12.10, 12.12 •RBI-Cyber-Security-Framework: annex_i_1_1 •FFIEC: d1-g-it-b-1, d3-pc-im-b-5 •ISO27001-2022: A.5.26 •FedRamp-Moderate-Revision-4: cm-2, cm-7-a, cm-8-1, cm-8-3-a, sa-3-a, sa-10, si-2-2, si-7-1 •FedRAMP-Low-Revision-4: cm-8, sa-3 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-piy

Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.

Enroll all instances as Systems Manager managed nodes. Prefer Session Manager over SSH/RDP, restrict inbound admin ports, and use least privilege roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.

•CISA: your-systems-1 •SOC2: cc_3_2, cc_7_1 •AWS-Foundational-Security-Best-Practices: SSM.1 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •HIPAA: 164_308_a_5_ii_b •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-a, 11.10-h •AWS-Well-Architected-Framework-Security-Pillar: SEC01-BP06, SEC06-BP04, SEC06-BP05 •NIST-CSF-2.0: ac_3 •NIST-800-171-Revision-2: 3_4_1, 3_4_2, 3_4_6, 3_4_9, 3_14_2 •ASD-Essential-Eight-Nov 2023: E8-1.1, E8-2.1, E8-2.6, E8-2.7 •NIST-800-53-Revision-4: cm_2, cm_7, cm_8_1, cm_8_3, sa_3, sa_10, si_2_2, si_7_1 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_6, cm_8_1, cm_8_2, cm_8_3_a, cm_8_6, cm_8_a, cm_8_a_1, cm_8_a_2, cm_8_a_3, cm_8_a_4, cm_8_a_5, cm_8_b, si_3_c_2 •ENS-RD2022: op.acc.4.aws.iam.6, op.acc.4.aws.sys.1, op.exp.1.aws.sys.1, op.exp.4.aws.sys.2, op.exp.4.r2.aws.sys.1, op.exp.9.aws.img.1, op.acc.4.aws.iam.3 •NIST-CSF-1.1: am_1, am_2, ds_3, ds_7, ds_8, ip_1, ip_2, ip_12 •SecNumCloud-3.2: 8.1, 12.10, 12.12 •RBI-Cyber-Security-Framework: annex_i_1_1 •FFIEC: d1-g-it-b-1, d3-pc-im-b-5 •ISO27001-2022: A.5.26 •FedRamp-Moderate-Revision-4: cm-2, cm-7-a, cm-8-1, cm-8-3-a, sa-3-a, sa-10, si-2-2, si-7-1 •FedRAMP-Low-Revision-4: cm-8, sa-3 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-piy

Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.

Enroll all instances as Systems Manager managed nodes. Prefer Session Manager over SSH/RDP, restrict inbound admin ports, and use least privilege roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.

•CISA: your-systems-1 •SOC2: cc_3_2, cc_7_1 •AWS-Foundational-Security-Best-Practices: SSM.1 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •HIPAA: 164_308_a_5_ii_b •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-a, 11.10-h •AWS-Well-Architected-Framework-Security-Pillar: SEC01-BP06, SEC06-BP04, SEC06-BP05 •NIST-CSF-2.0: ac_3 •NIST-800-171-Revision-2: 3_4_1, 3_4_2, 3_4_6, 3_4_9, 3_14_2 •ASD-Essential-Eight-Nov 2023: E8-1.1, E8-2.1, E8-2.6, E8-2.7 •NIST-800-53-Revision-4: cm_2, cm_7, cm_8_1, cm_8_3, sa_3, sa_10, si_2_2, si_7_1 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_6, cm_8_1, cm_8_2, cm_8_3_a, cm_8_6, cm_8_a, cm_8_a_1, cm_8_a_2, cm_8_a_3, cm_8_a_4, cm_8_a_5, cm_8_b, si_3_c_2 •ENS-RD2022: op.acc.4.aws.iam.6, op.acc.4.aws.sys.1, op.exp.1.aws.sys.1, op.exp.4.aws.sys.2, op.exp.4.r2.aws.sys.1, op.exp.9.aws.img.1, op.acc.4.aws.iam.3 •NIST-CSF-1.1: am_1, am_2, ds_3, ds_7, ds_8, ip_1, ip_2, ip_12 •SecNumCloud-3.2: 8.1, 12.10, 12.12 •RBI-Cyber-Security-Framework: annex_i_1_1 •FFIEC: d1-g-it-b-1, d3-pc-im-b-5 •ISO27001-2022: A.5.26 •FedRamp-Moderate-Revision-4: cm-2, cm-7-a, cm-8-1, cm-8-3-a, sa-3-a, sa-10, si-2-2, si-7-1 •FedRAMP-Low-Revision-4: cm-8, sa-3 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-piy

Unmanaged instances lack centralized patching, inventory, and secure remote access. This increases exposure to brute force on SSH/RDP, delayed patching, and poor visibility. Exploits can enable lateral movement and persistence, degrading confidentiality, integrity, and availability.

Enroll all instances as Systems Manager managed nodes. Prefer Session Manager over SSH/RDP, restrict inbound admin ports, and use least privilege roles. Ensure connectivity to SSM endpoints (or private endpoints), automate patching and inventory, and monitor activity for defense-in-depth.

•CISA: your-systems-1 •SOC2: cc_3_2, cc_7_1 •AWS-Foundational-Security-Best-Practices: SSM.1 •KISA-ISMS-P-2023: 2.6.2, 2.10.2 •HIPAA: 164_308_a_5_ii_b •KISA-ISMS-P-2023-korean: 2.6.2, 2.10.2 •GxP-21-CFR-Part-11: 11.10-a, 11.10-h •AWS-Well-Architected-Framework-Security-Pillar: SEC01-BP06, SEC06-BP04, SEC06-BP05 •NIST-CSF-2.0: ac_3 •NIST-800-171-Revision-2: 3_4_1, 3_4_2, 3_4_6, 3_4_9, 3_14_2 •ASD-Essential-Eight-Nov 2023: E8-1.1, E8-2.1, E8-2.6, E8-2.7 •NIST-800-53-Revision-4: cm_2, cm_7, cm_8_1, cm_8_3, sa_3, sa_10, si_2_2, si_7_1 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_6, cm_8_1, cm_8_2, cm_8_3_a, cm_8_6, cm_8_a, cm_8_a_1, cm_8_a_2, cm_8_a_3, cm_8_a_4, cm_8_a_5, cm_8_b, si_3_c_2 •ENS-RD2022: op.acc.4.aws.iam.6, op.acc.4.aws.sys.1, op.exp.1.aws.sys.1, op.exp.4.aws.sys.2, op.exp.4.r2.aws.sys.1, op.exp.9.aws.img.1, op.acc.4.aws.iam.3 •NIST-CSF-1.1: am_1, am_2, ds_3, ds_7, ds_8, ip_1, ip_2, ip_12 •SecNumCloud-3.2: 8.1, 12.10, 12.12 •RBI-Cyber-Security-Framework: annex_i_1_1 •FFIEC: d1-g-it-b-1, d3-pc-im-b-5 •ISO27001-2022: A.5.26 •FedRamp-Moderate-Revision-4: cm-2, cm-7-a, cm-8-1, cm-8-3-a, sa-3-a, sa-10, si-2-2, si-7-1 •FedRAMP-Low-Revision-4: cm-8, sa-3 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt, ksi-piy

Long-lived instances often run unpatched OS and agents, enabling:
- Exploitation of known CVEs loss of confidentiality
- Privilege escalation and tampering integrity compromise
- Malware/crypto-mining and instability reduced availability

Aged hosts also drift from baselines and impede response.

Adopt short-lived, patched workloads:
- Rebuild regularly from hardened, updated images; rotate AMIs
- Use centralized patch management and vulnerability scanning
- Retire or modernize legacy hosts; tag for lifecycle
- Apply least privilege and defense in depth to limit blast radius

Adjust max_ec2_instance_age_in_days to match policy.

•CISA: your-systems-1 •AWS-Foundational-Security-Best-Practices: EC2.4 •KISA-ISMS-P-2023: 2.9.2 •HIPAA: 164_308_a_1_ii_b •KISA-ISMS-P-2023-korean: 2.9.2 •GxP-21-CFR-Part-11: 11.10-a •NIST-800-171-Revision-2: 3_4_1, 3_4_2 •ASD-Essential-Eight-Nov 2023: E8-2.8 •NIST-800-53-Revision-4: cm_2 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_8_6 •NIST-CSF-1.1: ds_7, ip_1 •FFIEC: d1-g-it-b-1 •ISO27001-2022: A.8.10 •FedRamp-Moderate-Revision-4: cm-2 •FedRAMP-Low-Revision-4: cm-2 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt

Long-lived instances often run unpatched OS and agents, enabling:
- Exploitation of known CVEs loss of confidentiality
- Privilege escalation and tampering integrity compromise
- Malware/crypto-mining and instability reduced availability

Aged hosts also drift from baselines and impede response.

Adopt short-lived, patched workloads:
- Rebuild regularly from hardened, updated images; rotate AMIs
- Use centralized patch management and vulnerability scanning
- Retire or modernize legacy hosts; tag for lifecycle
- Apply least privilege and defense in depth to limit blast radius

Adjust max_ec2_instance_age_in_days to match policy.

•CISA: your-systems-1 •AWS-Foundational-Security-Best-Practices: EC2.4 •KISA-ISMS-P-2023: 2.9.2 •HIPAA: 164_308_a_1_ii_b •KISA-ISMS-P-2023-korean: 2.9.2 •GxP-21-CFR-Part-11: 11.10-a •NIST-800-171-Revision-2: 3_4_1, 3_4_2 •ASD-Essential-Eight-Nov 2023: E8-2.8 •NIST-800-53-Revision-4: cm_2 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_8_6 •NIST-CSF-1.1: ds_7, ip_1 •FFIEC: d1-g-it-b-1 •ISO27001-2022: A.8.10 •FedRamp-Moderate-Revision-4: cm-2 •FedRAMP-Low-Revision-4: cm-2 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt

Long-lived instances often run unpatched OS and agents, enabling:
- Exploitation of known CVEs loss of confidentiality
- Privilege escalation and tampering integrity compromise
- Malware/crypto-mining and instability reduced availability

Aged hosts also drift from baselines and impede response.

Adopt short-lived, patched workloads:
- Rebuild regularly from hardened, updated images; rotate AMIs
- Use centralized patch management and vulnerability scanning
- Retire or modernize legacy hosts; tag for lifecycle
- Apply least privilege and defense in depth to limit blast radius

Adjust max_ec2_instance_age_in_days to match policy.

•CISA: your-systems-1 •AWS-Foundational-Security-Best-Practices: EC2.4 •KISA-ISMS-P-2023: 2.9.2 •HIPAA: 164_308_a_1_ii_b •KISA-ISMS-P-2023-korean: 2.9.2 •GxP-21-CFR-Part-11: 11.10-a •NIST-800-171-Revision-2: 3_4_1, 3_4_2 •ASD-Essential-Eight-Nov 2023: E8-2.8 •NIST-800-53-Revision-4: cm_2 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_8_6 •NIST-CSF-1.1: ds_7, ip_1 •FFIEC: d1-g-it-b-1 •ISO27001-2022: A.8.10 •FedRamp-Moderate-Revision-4: cm-2 •FedRAMP-Low-Revision-4: cm-2 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt

Long-lived instances often run unpatched OS and agents, enabling:
- Exploitation of known CVEs loss of confidentiality
- Privilege escalation and tampering integrity compromise
- Malware/crypto-mining and instability reduced availability

Aged hosts also drift from baselines and impede response.

Adopt short-lived, patched workloads:
- Rebuild regularly from hardened, updated images; rotate AMIs
- Use centralized patch management and vulnerability scanning
- Retire or modernize legacy hosts; tag for lifecycle
- Apply least privilege and defense in depth to limit blast radius

Adjust max_ec2_instance_age_in_days to match policy.

•CISA: your-systems-1 •AWS-Foundational-Security-Best-Practices: EC2.4 •KISA-ISMS-P-2023: 2.9.2 •HIPAA: 164_308_a_1_ii_b •KISA-ISMS-P-2023-korean: 2.9.2 •GxP-21-CFR-Part-11: 11.10-a •NIST-800-171-Revision-2: 3_4_1, 3_4_2 •ASD-Essential-Eight-Nov 2023: E8-2.8 •NIST-800-53-Revision-4: cm_2 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_8_6 •NIST-CSF-1.1: ds_7, ip_1 •FFIEC: d1-g-it-b-1 •ISO27001-2022: A.8.10 •FedRamp-Moderate-Revision-4: cm-2 •FedRAMP-Low-Revision-4: cm-2 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt

Long-lived instances often run unpatched OS and agents, enabling:
- Exploitation of known CVEs loss of confidentiality
- Privilege escalation and tampering integrity compromise
- Malware/crypto-mining and instability reduced availability

Aged hosts also drift from baselines and impede response.

Adopt short-lived, patched workloads:
- Rebuild regularly from hardened, updated images; rotate AMIs
- Use centralized patch management and vulnerability scanning
- Retire or modernize legacy hosts; tag for lifecycle
- Apply least privilege and defense in depth to limit blast radius

Adjust max_ec2_instance_age_in_days to match policy.

•CISA: your-systems-1 •AWS-Foundational-Security-Best-Practices: EC2.4 •KISA-ISMS-P-2023: 2.9.2 •HIPAA: 164_308_a_1_ii_b •KISA-ISMS-P-2023-korean: 2.9.2 •GxP-21-CFR-Part-11: 11.10-a •NIST-800-171-Revision-2: 3_4_1, 3_4_2 •ASD-Essential-Eight-Nov 2023: E8-2.8 •NIST-800-53-Revision-4: cm_2 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_8_6 •NIST-CSF-1.1: ds_7, ip_1 •FFIEC: d1-g-it-b-1 •ISO27001-2022: A.8.10 •FedRamp-Moderate-Revision-4: cm-2 •FedRAMP-Low-Revision-4: cm-2 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt

Long-lived instances often run unpatched OS and agents, enabling:
- Exploitation of known CVEs loss of confidentiality
- Privilege escalation and tampering integrity compromise
- Malware/crypto-mining and instability reduced availability

Aged hosts also drift from baselines and impede response.

Adopt short-lived, patched workloads:
- Rebuild regularly from hardened, updated images; rotate AMIs
- Use centralized patch management and vulnerability scanning
- Retire or modernize legacy hosts; tag for lifecycle
- Apply least privilege and defense in depth to limit blast radius

Adjust max_ec2_instance_age_in_days to match policy.

•CISA: your-systems-1 •AWS-Foundational-Security-Best-Practices: EC2.4 •KISA-ISMS-P-2023: 2.9.2 •HIPAA: 164_308_a_1_ii_b •KISA-ISMS-P-2023-korean: 2.9.2 •GxP-21-CFR-Part-11: 11.10-a •NIST-800-171-Revision-2: 3_4_1, 3_4_2 •ASD-Essential-Eight-Nov 2023: E8-2.8 •NIST-800-53-Revision-4: cm_2 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_8_6 •NIST-CSF-1.1: ds_7, ip_1 •FFIEC: d1-g-it-b-1 •ISO27001-2022: A.8.10 •FedRamp-Moderate-Revision-4: cm-2 •FedRAMP-Low-Revision-4: cm-2 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt

Long-lived instances often run unpatched OS and agents, enabling:
- Exploitation of known CVEs loss of confidentiality
- Privilege escalation and tampering integrity compromise
- Malware/crypto-mining and instability reduced availability

Aged hosts also drift from baselines and impede response.

Adopt short-lived, patched workloads:
- Rebuild regularly from hardened, updated images; rotate AMIs
- Use centralized patch management and vulnerability scanning
- Retire or modernize legacy hosts; tag for lifecycle
- Apply least privilege and defense in depth to limit blast radius

Adjust max_ec2_instance_age_in_days to match policy.

•CISA: your-systems-1 •AWS-Foundational-Security-Best-Practices: EC2.4 •KISA-ISMS-P-2023: 2.9.2 •HIPAA: 164_308_a_1_ii_b •KISA-ISMS-P-2023-korean: 2.9.2 •GxP-21-CFR-Part-11: 11.10-a •NIST-800-171-Revision-2: 3_4_1, 3_4_2 •ASD-Essential-Eight-Nov 2023: E8-2.8 •NIST-800-53-Revision-4: cm_2 •NIST-800-53-Revision-5: cm_2_a, cm_2_b, cm_2_b_1, cm_2_b_2, cm_2_b_3, cm_2_2, cm_3_3, cm_8_6 •NIST-CSF-1.1: ds_7, ip_1 •FFIEC: d1-g-it-b-1 •ISO27001-2022: A.8.10 •FedRamp-Moderate-Revision-4: cm-2 •FedRAMP-Low-Revision-4: cm-2 •FedRAMP-20x-KSI-Low-25.05C: ksi-cmt

Using paravirtual (PV) weakens isolation versus HVM/Nitro and blocks features like ENA and NVMe. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.

Standardize on HVM/Nitro. Migrate PV workloads to HVM AMIs and current instance families; ensure support for ENA and NVMe, current kernels, and hardened configs. Apply defense in depth and least privilege. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.

•AWS-Foundational-Security-Best-Practices: EC2.24 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Using paravirtual (PV) weakens isolation versus HVM/Nitro and blocks features like ENA and NVMe. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.

Standardize on HVM/Nitro. Migrate PV workloads to HVM AMIs and current instance families; ensure support for ENA and NVMe, current kernels, and hardened configs. Apply defense in depth and least privilege. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.

•AWS-Foundational-Security-Best-Practices: EC2.24 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Using paravirtual (PV) weakens isolation versus HVM/Nitro and blocks features like ENA and NVMe. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.

Standardize on HVM/Nitro. Migrate PV workloads to HVM AMIs and current instance families; ensure support for ENA and NVMe, current kernels, and hardened configs. Apply defense in depth and least privilege. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.

•AWS-Foundational-Security-Best-Practices: EC2.24 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Using paravirtual (PV) weakens isolation versus HVM/Nitro and blocks features like ENA and NVMe. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.

Standardize on HVM/Nitro. Migrate PV workloads to HVM AMIs and current instance families; ensure support for ENA and NVMe, current kernels, and hardened configs. Apply defense in depth and least privilege. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.

•AWS-Foundational-Security-Best-Practices: EC2.24 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Using paravirtual (PV) weakens isolation versus HVM/Nitro and blocks features like ENA and NVMe. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.

Standardize on HVM/Nitro. Migrate PV workloads to HVM AMIs and current instance families; ensure support for ENA and NVMe, current kernels, and hardened configs. Apply defense in depth and least privilege. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.

•AWS-Foundational-Security-Best-Practices: EC2.24 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Using paravirtual (PV) weakens isolation versus HVM/Nitro and blocks features like ENA and NVMe. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.

Standardize on HVM/Nitro. Migrate PV workloads to HVM AMIs and current instance families; ensure support for ENA and NVMe, current kernels, and hardened configs. Apply defense in depth and least privilege. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.

•AWS-Foundational-Security-Best-Practices: EC2.24 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Using paravirtual (PV) weakens isolation versus HVM/Nitro and blocks features like ENA and NVMe. Confidentiality and integrity can suffer due to reliance on legacy hypercalls/drivers; availability and performance may degrade under load, increasing exposure to kernel/driver exploits and noisy-neighbor impacts.

Standardize on HVM/Nitro. Migrate PV workloads to HVM AMIs and current instance families; ensure support for ENA and NVMe, current kernels, and hardened configs. Apply defense in depth and least privilege. Use immutable images with staged testing, then retire PV images to prevent drift and regressions.

•AWS-Foundational-Security-Best-Practices: EC2.24 •KISA-ISMS-P-2023: 2.9.2 •KISA-ISMS-P-2023-korean: 2.9.2 •ISO27001-2022: A.8.20, A.8.21, A.8.22

Internet-exposed Cassandra enables unauthorized queries on 9042, remote management via 7199 (JMX), and tampering with inter-node channels on 7000/7001 and 9160.

Attackers can read/modify data (confidentiality, integrity), disrupt or take over the cluster (availability), and pivot within the VPC.

Apply least privilege network access:
- Remove 0.0.0.0/0 and ::/0 to Cassandra ports
- Allow only trusted subnets or VPN/bastion
- Keep nodes in private subnets; segment inter-node traffic
- Enforce authentication and TLS/mTLS for clients and JMX
- Add defense in depth with NACLs and monitoring

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.4, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.4, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Internet-exposed Cassandra enables unauthorized queries on 9042, remote management via 7199 (JMX), and tampering with inter-node channels on 7000/7001 and 9160.

Attackers can read/modify data (confidentiality, integrity), disrupt or take over the cluster (availability), and pivot within the VPC.

Apply least privilege network access:
- Remove 0.0.0.0/0 and ::/0 to Cassandra ports
- Allow only trusted subnets or VPN/bastion
- Keep nodes in private subnets; segment inter-node traffic
- Enforce authentication and TLS/mTLS for clients and JMX
- Add defense in depth with NACLs and monitoring

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.4, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.4, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Internet-exposed Cassandra enables unauthorized queries on 9042, remote management via 7199 (JMX), and tampering with inter-node channels on 7000/7001 and 9160.

Attackers can read/modify data (confidentiality, integrity), disrupt or take over the cluster (availability), and pivot within the VPC.

Apply least privilege network access:
- Remove 0.0.0.0/0 and ::/0 to Cassandra ports
- Allow only trusted subnets or VPN/bastion
- Keep nodes in private subnets; segment inter-node traffic
- Enforce authentication and TLS/mTLS for clients and JMX
- Add defense in depth with NACLs and monitoring

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.4, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.4, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Internet-exposed Cassandra enables unauthorized queries on 9042, remote management via 7199 (JMX), and tampering with inter-node channels on 7000/7001 and 9160.

Attackers can read/modify data (confidentiality, integrity), disrupt or take over the cluster (availability), and pivot within the VPC.

Apply least privilege network access:
- Remove 0.0.0.0/0 and ::/0 to Cassandra ports
- Allow only trusted subnets or VPN/bastion
- Keep nodes in private subnets; segment inter-node traffic
- Enforce authentication and TLS/mTLS for clients and JMX
- Add defense in depth with NACLs and monitoring

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.4, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.4, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Internet-exposed Cassandra enables unauthorized queries on 9042, remote management via 7199 (JMX), and tampering with inter-node channels on 7000/7001 and 9160.

Attackers can read/modify data (confidentiality, integrity), disrupt or take over the cluster (availability), and pivot within the VPC.

Apply least privilege network access:
- Remove 0.0.0.0/0 and ::/0 to Cassandra ports
- Allow only trusted subnets or VPN/bastion
- Keep nodes in private subnets; segment inter-node traffic
- Enforce authentication and TLS/mTLS for clients and JMX
- Add defense in depth with NACLs and monitoring

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.4, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.4, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Internet-exposed Cassandra enables unauthorized queries on 9042, remote management via 7199 (JMX), and tampering with inter-node channels on 7000/7001 and 9160.

Attackers can read/modify data (confidentiality, integrity), disrupt or take over the cluster (availability), and pivot within the VPC.

Apply least privilege network access:
- Remove 0.0.0.0/0 and ::/0 to Cassandra ports
- Allow only trusted subnets or VPN/bastion
- Keep nodes in private subnets; segment inter-node traffic
- Enforce authentication and TLS/mTLS for clients and JMX
- Add defense in depth with NACLs and monitoring

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.4, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.4, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Internet-exposed Cassandra enables unauthorized queries on 9042, remote management via 7199 (JMX), and tampering with inter-node channels on 7000/7001 and 9160.

Attackers can read/modify data (confidentiality, integrity), disrupt or take over the cluster (availability), and pivot within the VPC.

Apply least privilege network access:
- Remove 0.0.0.0/0 and ::/0 to Cassandra ports
- Allow only trusted subnets or VPN/bastion
- Keep nodes in private subnets; segment inter-node traffic
- Enforce authentication and TLS/mTLS for clients and JMX
- Add defense in depth with NACLs and monitoring

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.4, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.4, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Publicly reachable SMB allows unauthorized access and remote code execution, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread ransomware, degrading confidentiality, integrity, and availability.

Restrict CIFS/SMB to trusted internal sources using least privilege; do not allow 0.0.0.0/0.

Adopt defense in depth: place hosts in private subnets, require VPN or controlled jump paths, and enforce segmentation. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.

•CIS-7.0: 6.1.2 •SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •CIS-5.0: 5.1.2 •CIS-6.0: 6.1.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •CIS-4.0.1: 5.1.2 •NIS2: 6.7.2.g

Publicly reachable SMB allows unauthorized access and remote code execution, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread ransomware, degrading confidentiality, integrity, and availability.

Restrict CIFS/SMB to trusted internal sources using least privilege; do not allow 0.0.0.0/0.

Adopt defense in depth: place hosts in private subnets, require VPN or controlled jump paths, and enforce segmentation. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.

•CIS-7.0: 6.1.2 •SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •CIS-5.0: 5.1.2 •CIS-6.0: 6.1.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •CIS-4.0.1: 5.1.2 •NIS2: 6.7.2.g

Publicly reachable SMB allows unauthorized access and remote code execution, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread ransomware, degrading confidentiality, integrity, and availability.

Restrict CIFS/SMB to trusted internal sources using least privilege; do not allow 0.0.0.0/0.

Adopt defense in depth: place hosts in private subnets, require VPN or controlled jump paths, and enforce segmentation. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.

•CIS-7.0: 6.1.2 •SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •CIS-5.0: 5.1.2 •CIS-6.0: 6.1.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •CIS-4.0.1: 5.1.2 •NIS2: 6.7.2.g

Publicly reachable SMB allows unauthorized access and remote code execution, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread ransomware, degrading confidentiality, integrity, and availability.

Restrict CIFS/SMB to trusted internal sources using least privilege; do not allow 0.0.0.0/0.

Adopt defense in depth: place hosts in private subnets, require VPN or controlled jump paths, and enforce segmentation. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.

•CIS-7.0: 6.1.2 •SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •CIS-5.0: 5.1.2 •CIS-6.0: 6.1.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •CIS-4.0.1: 5.1.2 •NIS2: 6.7.2.g

Publicly reachable SMB allows unauthorized access and remote code execution, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread ransomware, degrading confidentiality, integrity, and availability.

Restrict CIFS/SMB to trusted internal sources using least privilege; do not allow 0.0.0.0/0.

Adopt defense in depth: place hosts in private subnets, require VPN or controlled jump paths, and enforce segmentation. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.

•CIS-7.0: 6.1.2 •SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •CIS-5.0: 5.1.2 •CIS-6.0: 6.1.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •CIS-4.0.1: 5.1.2 •NIS2: 6.7.2.g

Publicly reachable SMB allows unauthorized access and remote code execution, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread ransomware, degrading confidentiality, integrity, and availability.

Restrict CIFS/SMB to trusted internal sources using least privilege; do not allow 0.0.0.0/0.

Adopt defense in depth: place hosts in private subnets, require VPN or controlled jump paths, and enforce segmentation. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.

•CIS-7.0: 6.1.2 •SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •CIS-5.0: 5.1.2 •CIS-6.0: 6.1.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •CIS-4.0.1: 5.1.2 •NIS2: 6.7.2.g

Publicly reachable SMB allows unauthorized access and remote code execution, enabling credential theft, NTLM relay, and share enumeration. Attackers can exfiltrate files, tamper or delete data, and spread ransomware, degrading confidentiality, integrity, and availability.

Restrict CIFS/SMB to trusted internal sources using least privilege; do not allow 0.0.0.0/0.

Adopt defense in depth: place hosts in private subnets, require VPN or controlled jump paths, and enforce segmentation. Disable SMB if unnecessary or use alternatives (e.g., SFTP). Require strong auth and SMB signing.

•CIS-7.0: 6.1.2 •SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •CIS-5.0: 5.1.2 •CIS-6.0: 6.1.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •CIS-4.0.1: 5.1.2 •NIS2: 6.7.2.g

Public access to Elasticsearch/Kibana can lead to:
- Unauthorized queries or dashboard viewing confidentiality loss
- Index changes or cluster control via 9300 integrity impact
- Scans and bulk queries availability degradation

Enables data exfiltration and lateral movement.

Apply least privilege to network exposure:
- Restrict 9200, 9300, 5601 to trusted sources or keep them private
- Use private subnets, VPN/peering, or bastion/SSM for admin access
- Enforce authentication and TLS on Elasticsearch/Kibana
- Avoid public IPs unless strictly required

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Public access to Elasticsearch/Kibana can lead to:
- Unauthorized queries or dashboard viewing confidentiality loss
- Index changes or cluster control via 9300 integrity impact
- Scans and bulk queries availability degradation

Enables data exfiltration and lateral movement.

Apply least privilege to network exposure:
- Restrict 9200, 9300, 5601 to trusted sources or keep them private
- Use private subnets, VPN/peering, or bastion/SSM for admin access
- Enforce authentication and TLS on Elasticsearch/Kibana
- Avoid public IPs unless strictly required

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Public access to Elasticsearch/Kibana can lead to:
- Unauthorized queries or dashboard viewing confidentiality loss
- Index changes or cluster control via 9300 integrity impact
- Scans and bulk queries availability degradation

Enables data exfiltration and lateral movement.

Apply least privilege to network exposure:
- Restrict 9200, 9300, 5601 to trusted sources or keep them private
- Use private subnets, VPN/peering, or bastion/SSM for admin access
- Enforce authentication and TLS on Elasticsearch/Kibana
- Avoid public IPs unless strictly required

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Public access to Elasticsearch/Kibana can lead to:
- Unauthorized queries or dashboard viewing confidentiality loss
- Index changes or cluster control via 9300 integrity impact
- Scans and bulk queries availability degradation

Enables data exfiltration and lateral movement.

Apply least privilege to network exposure:
- Restrict 9200, 9300, 5601 to trusted sources or keep them private
- Use private subnets, VPN/peering, or bastion/SSM for admin access
- Enforce authentication and TLS on Elasticsearch/Kibana
- Avoid public IPs unless strictly required

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Public access to Elasticsearch/Kibana can lead to:
- Unauthorized queries or dashboard viewing confidentiality loss
- Index changes or cluster control via 9300 integrity impact
- Scans and bulk queries availability degradation

Enables data exfiltration and lateral movement.

Apply least privilege to network exposure:
- Restrict 9200, 9300, 5601 to trusted sources or keep them private
- Use private subnets, VPN/peering, or bastion/SSM for admin access
- Enforce authentication and TLS on Elasticsearch/Kibana
- Avoid public IPs unless strictly required

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Public access to Elasticsearch/Kibana can lead to:
- Unauthorized queries or dashboard viewing confidentiality loss
- Index changes or cluster control via 9300 integrity impact
- Scans and bulk queries availability degradation

Enables data exfiltration and lateral movement.

Apply least privilege to network exposure:
- Restrict 9200, 9300, 5601 to trusted sources or keep them private
- Use private subnets, VPN/peering, or bastion/SSM for admin access
- Enforce authentication and TLS on Elasticsearch/Kibana
- Avoid public IPs unless strictly required

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Public access to Elasticsearch/Kibana can lead to:
- Unauthorized queries or dashboard viewing confidentiality loss
- Index changes or cluster control via 9300 integrity impact
- Scans and bulk queries availability degradation

Enables data exfiltration and lateral movement.

Apply least privilege to network exposure:
- Restrict 9200, 9300, 5601 to trusted sources or keep them private
- Use private subnets, VPN/peering, or bastion/SSM for admin access
- Enforce authentication and TLS on Elasticsearch/Kibana
- Avoid public IPs unless strictly required

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.3, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Exposed FTP invites Internet brute force and transmits in cleartext, enabling credential theft and packet sniffing (confidentiality).

Attackers can upload/alter files (integrity) and abuse services for malware staging or DoS (availability). Publicly reachable hosts are rapidly probed by scanners.

Deny public ingress to FTP ports 20-21 following least privilege. Prefer SFTP or FTPS; if transfers are required, restrict to trusted sources and use private access (VPN or dedicated network). Apply defense in depth with tightened security groups and network ACLs, and monitor authentication and access.

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Exposed FTP invites Internet brute force and transmits in cleartext, enabling credential theft and packet sniffing (confidentiality).

Attackers can upload/alter files (integrity) and abuse services for malware staging or DoS (availability). Publicly reachable hosts are rapidly probed by scanners.

Deny public ingress to FTP ports 20-21 following least privilege. Prefer SFTP or FTPS; if transfers are required, restrict to trusted sources and use private access (VPN or dedicated network). Apply defense in depth with tightened security groups and network ACLs, and monitor authentication and access.

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Exposed FTP invites Internet brute force and transmits in cleartext, enabling credential theft and packet sniffing (confidentiality).

Attackers can upload/alter files (integrity) and abuse services for malware staging or DoS (availability). Publicly reachable hosts are rapidly probed by scanners.

Deny public ingress to FTP ports 20-21 following least privilege. Prefer SFTP or FTPS; if transfers are required, restrict to trusted sources and use private access (VPN or dedicated network). Apply defense in depth with tightened security groups and network ACLs, and monitor authentication and access.

•SOC2: cc_6_6 •KISA-ISMS-P-2023: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •C5-2025: PI-01.01AC •KISA-ISMS-P-2023-korean: 2.6.1, 2.6.2, 2.6.6, 2.10.2 •ProwlerThreatScore-1.0: 2.1.6 •ISO27001-2022: A.8.20, A.8.21, A.8.22 •NIS2: 6.7.2.g

Exposed FTP invites Internet brute force and transmits in cleartext, enabling credential theft and packet sniffing (confidentiality).

Attackers can upload/alter files (integrity) and abuse services for malware staging or DoS (availability). Publicly reachable hosts are rapidly probed by scanners.

Deny public ingress to FTP ports 20-21 following least privilege. Prefer SFTP or FTPS; if transfers are required, restrict to trusted sources and use private access (VPN or dedicated network). Apply defense in depth with tightened security groups and network ACLs, and monitor authentication and access.