ISO/IEC 27001:2013¶

The International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) 27001:2013 standard specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Published in 2013, Annex A provides a reference set of 114 information security controls across 14 categories. This internationally recognized standard is applicable to organizations of all sizes and industries seeking to systematically manage information security risks.

Terraform Registry Subdomain: iso27001¶

module "..." {
  source  = "iso27001.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://iso27001.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls¶

The following controls are implemented as part of this framework.

• CloudWatch alarm should have an action configured
• Ensure IAM password policy requires a minimum length of 14 or greater
• Ensure IAM password policy requires at least one lowercase letter
• Ensure IAM password policy requires at least one number
• Ensure IAM password policy requires at least one symbol
• Ensure IAM password policy requires at least one uppercase letter
• IAM password policies for users should have strong configurations
• RDS DB instances should have iam authentication enabled
• AWS Redshift clusters should have automatic snapshots enabled
• S3 bucket policy should prohibit public access
• S3 public access should be blocked at bucket levels
• SageMaker notebook instances root access should be disabled
• SNS topics should be encrypted at rest
• VPC Security groups should only allow unrestricted incoming traffic for authorized ports

Enable/Disable Controls¶

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples¶

S3 bucket module with ISO/IEC 27001:2013 compliance framework controls enabled, and a couple of controls disabled¶

module "..." {
  source = "https://iso27001.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=cloudwatch_alarm_action_enabled,iam_account_password_policy_min_length_14"
}