CIS AWS Benchmark v6.0.0
Best for: Any AWS shop that needs a recognized configuration baseline. This covers enterprises whose customers demand evidence of cloud hardening, teams pursuing SOC 2 or FedRAMP (CIS controls provide supporting technical evidence but don't satisfy all required safeguards on their own), and regulated industries like financial services and healthcare that treat CIS as an accepted hardening standard. No size or revenue threshold.
| Mandatory? | Voluntary security baseline |
| Who validates? | Self-assessment or third-party |
| Renewal | No fixed cycle |
| Scope | AWS cloud environments; three Implementation Groups (IGs) |
🏛 Center for Internet Security (CIS) · CIS AWS Benchmark v6.0.0 Official source →
Get Started
module "..." {
source = "cis.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- CloudTrail Logging Configuration: Runs controls checking multi-region trail enablement, log file validation, KMS encryption of trail logs, S3 data event logging for read and write operations, and access logging on the CloudTrail destination bucket. Covers 10 of the CloudTrail-related controls in the benchmark.
- EBS Encryption at Rest: Checks that EBS encryption by default is enabled at the account level, that attached volumes are encrypted, and that all EBS volumes (attached or not) use encryption. Three controls covered.
- EC2 Instance Security Configuration: Validates that EC2 instances have IAM profiles attached (with additional scrutiny for publicly accessible instances) and that IMDSv2 is enforced. Three controls covered.
- AWS Config Monitoring: Verifies that AWS Config is enabled across all regions and that the configuration recorder has no failed log deliveries. Two controls covered.
- Account-Level Security Settings: Checks whether a security alternate contact is registered on the AWS account. Programmatic verification of contact registration status.
What you handle
- CloudTrail Logging Configuration: Log retention policies, CloudWatch alarm configuration for specific API calls, and the investigation process when suspicious activity surfaces in logs are all yours to define. So is the incident response workflow triggered by log findings.
- EBS Encryption at Rest: KMS key selection (AWS-managed vs. customer-managed), rotation schedules, and migrating any pre-existing unencrypted volumes to encrypted replacements.
- EC2 Instance Security Configuration: The IAM policies attached to instance profiles need to follow least privilege, which requires reviewing what permissions each role grants. Also verify that application code doesn't rely on IMDSv1 before flipping the enforcement switch.
- AWS Config Monitoring: Config rules beyond the baseline, compliance dashboard reviews, and SNS notifications for configuration drift are outside what automation covers here.
- Account-Level Security Settings: Actually populating the contact fields with valid, monitored email addresses and phone numbers. Keeping contact information current when staff change. These are manual data entry tasks that cannot be fully automated.
Controls by Category
Data Protection - EBS Encryption (2 controls)
Most EBS findings here aren't about whether encryption by default is toggled on. It's the older volumes created before that setting was enabled that trip organizations up. Remediation means creating encrypted snapshots and replacing the originals, which takes real time in production environments.
Identity and Access Management - EC2 (2 controls)
Instance profiles and IMDSv2 enforcement are the two things assessors focus on here, with extra scrutiny on publicly accessible instances. For IMDSv2, check that HttpTokens is set to 'required' in the instance metadata options. Legacy instances still allowing IMDSv1 are a common finding and a real exposure: SSRF vulnerabilities can be used to steal instance credentials via the metadata service.
Logging - CloudTrail Configuration (3 controls)
Auditors confirm at least one multi-region trail captures both read and write management events, that log file validation is enabled to detect tampering, and that trail logs are encrypted with a customer-managed KMS key. A frequent gap: organizations have a trail enabled but it only covers one region, or log file validation was never turned on.
Additional Controls (20)
AWS IAM (4)
Amazon EC2 (1)
Amazon EFS (2)
Amazon RDS (7)
compliance.tf moduleRDS DB instance automatic minor version upgrade should be enabledcompliance.tf moduleRDS DB instance encryption at rest should be enabledcompliance.tf moduleRDS DB instances should have multiple AZ enabledcompliance.tf moduleRDS DB instances should not use public subnetcompliance.tf moduleRDS DB instances should prohibit public accesscompliance.tf moduleAmazon S3 (5)
compliance.tf moduleS3 buckets should have object logging enabledS3 buckets should prohibit public read accesscompliance.tf moduleS3 public access should be blocked at account levelcompliance.tf moduleS3 public access should be blocked at bucket levelcompliance.tf moduleRelated Frameworks
CIS AWS Benchmark v4.0.0 — 🟢 High overlap (72%)
CIS v4.0.0 is an earlier major version. The immediate predecessor to v6.0.0 is v5.0.0. v6.0.0 retains many v4.0.0 era controls but adds newer requirements around IMDSv2 enforcement, account contact management, and expanded S3 data event logging. Organizations already compliant with v4.0.0 will still need to review incremental changes introduced in v5.0.0 and v6.0.0.
AWS Foundational Security Best Practices — 🟡 Medium overlap (55%)
AWS Foundational Security Best Practices (FSBP) partially overlaps with CIS v6.0.0 on CloudTrail, encryption, and Config controls. FSBP includes broader service coverage (Lambda, RDS, ECS) that CIS v6.0.0 does not address, while CIS includes account-level controls that FSBP skips.
NIST 800-53 Rev 5 — 🟡 Medium overlap (30%)
CIS AWS controls map to a subset of NIST 800-53 Rev 5, primarily the AU (Audit and Accountability), SC (System and Communications Protection), and AC (Access Control) families. NIST 800-53 is far broader, covering organizational policy, physical security, and personnel controls that CIS does not address.