CCCS Medium Cloud Control Profile¶

The Canadian Centre for Cyber Security (CCCS) Medium Cloud Control Profile provides security control baselines for cloud services used by the Government of Canada. This profile defines medium-level security requirements for protecting cloud-based systems and data classified as Protected B, Medium Integrity, and Medium Availability. It is primarily used by Canadian federal government departments and agencies adopting cloud services.

Terraform Registry Subdomain: cccsmedium¶

module "..." {
  source  = "cccsmedium.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://cccsmedium.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls¶

The following controls are implemented as part of this framework.

• Backup plan min frequency and min retention check
• CloudWatch alarm should have an action configured
• Ensure IAM password policy requires a minimum length of 14 or greater
• Ensure IAM password policy requires at least one lowercase letter
• Ensure IAM password policy requires at least one number
• Ensure IAM password policy requires at least one symbol
• Ensure IAM password policy requires at least one uppercase letter
• IAM password policies for users should have strong configurations
• KMS CMK rotation should be enabled
• RDS DB instance multiple az should be enabled
• AWS Redshift clusters should have automatic snapshots enabled
• S3 buckets should prohibit public write access
• S3 buckets with versioning enabled should have lifecycle policies configured
• Secrets Manager secrets should be encrypted using CMK
• SNS topics should be encrypted at rest
• VPC Security groups should only allow unrestricted incoming traffic for authorized ports

Enable/Disable Controls¶

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples¶

S3 bucket module with CCCS Medium Cloud Control Profile compliance framework controls enabled, and a couple of controls disabled¶

module "..." {
  source = "https://cccsmedium.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=backup_plan_min_retention_35_days,cloudwatch_alarm_action_enabled"
}