Title 21 CFR Part 11¶
The Code of Federal Regulations (CFR) is the codification of the general and permanent rules published in the Federal Register by the departments and agencies of the Federal Government. It is divided into 50 titles representing broad areas subject to federal regulation. Title 21 of the CFR is reserved for rules of the Food and Drug Administration, with Part 11 establishing requirements for electronic records and electronic signatures in FDA-regulated industries.
Terraform Registry Subdomain: cfrpart11¶
module "..." {
source = "cfrpart11.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}
module "..." {
source = "https://cfrpart11.compliance.tf/terraform-aws-modules/<module>/aws"
}
Refer to the Terraform Registry Endpoints section for more details.
Implemented Controls¶
The following controls are implemented as part of this framework.
- API Gateway stage should uses SSL certificate
- API Gateway stage cache encryption at rest should be enabled
- API Gateway stage logging should be enabled
- Backup plan min frequency and min retention check
- At least one enabled trail should be present in a region
- CloudTrail trails should be integrated with CloudWatch logs
- CloudTrail trail logs should be encrypted with KMS CMK
- CloudTrail trail log file validation should be enabled
- Log group retention period should be at least 365 days
- CodeBuild project artifact encryption should be enabled
- CodeBuild project S3 logs should be encrypted
- DMS replication instances should not be publicly accessible
- DynamoDB table should be encrypted with AWS KMS
- DynamoDB table point-in-time recovery should be enabled
- Attached EBS volumes should have encryption enabled
- EC2 instance should have EBS optimization enabled
- EC2 instances should have IAM profile attached
- EC2 instances should be in a VPC
- EC2 instances should not have a public IP address
- EC2 instances should use IMDSv2
- EFS file system encryption at rest should be enabled
- ElastiCache Redis cluster automatic backup should be enabled with retention period of 15 days or greater
- ELB application and classic load balancer logging should be enabled
- ELB application load balancer deletion protection should be enabled
- ELB application and network load balancers should only use SSL or HTTPS listeners
- ELB classic load balancers should have cross-zone load balancing enabled
- EMR cluster Kerberos should be enabled
- ES domain encryption at rest should be enabled
- ES domains should be in a VPC
- Elasticsearch domain should send logs to CloudWatch
- Elasticsearch domain node-to-node encryption should be enabled
- IAM password policies for users should have strong configurations
- Kinesis streams should have server side encryption enabled
- KMS CMK rotation should be enabled
- Lambda functions should be in a VPC
- Log group encryption at rest should be enabled
- OpenSearch domains should have audit logging enabled.
- OpenSearch domains should have encryption at rest enabled
- OpenSearch domains should use HTTPS
- OpenSearch domains logs to AWS CloudWatch Logs
- OpenSearch domains node-to-node encryption should be enabled
- RDS DB instance backup should be enabled
- RDS DB instances should have deletion protection enabled
- RDS DB instance encryption at rest should be enabled
- Database logging should be enabled
- RDS DB instance multiple az should be enabled
- RDS DB instances should prohibit public access
- AWS Redshift audit logging should be enabled
- AWS Redshift clusters should have automatic snapshots enabled
- Redshift cluster encryption in transit should be enabled
- Redshift cluster audit logging and encryption should be enabled
- AWS Redshift enhanced VPC routing should be enabled
- AWS Redshift clusters should be encrypted with KMS
- Redshift clusters should prohibit public access
- S3 bucket cross-region replication should be enabled
- S3 bucket default encryption should be enabled
- S3 bucket default encryption should be enabled with KMS
- S3 buckets should have lifecycle policies configured
- S3 bucket logging should be enabled
- S3 bucket object lock should be enabled
- S3 bucket policy should prohibit public access
- S3 buckets should prohibit public read access
- S3 buckets should prohibit public write access
- S3 buckets with versioning enabled should have lifecycle policies configured
- S3 bucket versioning should be enabled
- S3 public access should be blocked at account level
- S3 public access should be blocked at bucket levels
- SageMaker endpoint configuration encryption should be enabled
- SageMaker notebook instances should not have direct internet access
- SageMaker notebook instance encryption should be enabled
- Secrets Manager secrets should be encrypted using CMK
- SNS topics should be encrypted at rest
- VPC subnet auto assign public IP should be disabled
Enable/Disable Controls¶
You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.
Examples¶
S3 bucket module with Title 21 CFR Part 11 compliance framework controls enabled, and a couple of controls disabled¶
module "..." {
source = "https://cfrpart11.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_rest_api_stage_use_ssl_certificate,apigateway_stage_cache_encryption_at_rest_enabled"
}