Best Practices for NIST Requirements

Applicable Scenario

Config provides a conformance package to help you check if your resources on Huawei Cloud meet some of the National Institute of Standards and Technology (NIST) requirements.

Rules

The following table lists the rules and solutions included in this conformance package template.

**Table 1** Conformance package description
Rule	Cloud Service	Description
access-keys-rotated	iam	If an IAM user's access key is not rotated within the specified number of days, this user is noncompliant.
apig-instances-execution-logging-enabled	apig	If logging is not enabled for a dedicated APIG gateway, this gateway is considered non-compliant.
apig-instances-ssl-enabled	apig	If no SSL certificates are attached to a dedicated APIG gateway, this gateway is considered noncompliant.
as-group-elb-healthcheck-required	as	If an AS group does not have health check enabled, this AS group is noncompliant.
css-cluster-disk-encryption-check	css	If disk encryption is not enabled for a CSS cluster, this cluster is noncompliant.
css-cluster-in-vpc	css	If a CSS cluster is not in the specified VPCs, this cluster is noncompliant.
cts-kms-encrypted-check	cts	If a CTS tracker does not have KMS encryption enabled, this tracker is noncompliant.
cts-lts-enable	cts	If a CTS tracker does not have trace transfer to LTS enabled, this tracker is noncompliant.
cts-obs-bucket-track	cts	If there are no CTS trackers created for the specified OBS bucket, the current account is noncompliant.
cts-support-validate-check	cts	If a CTS tracker does not have trace file verification enabled, this tacker is noncompliant.
cts-tracker-exists	cts	If there are no trackers or all trackers are disabled in an account, the current account is noncompliant.
drs-data-guard-job-not-public	drs	If the network type of a DR task is set to public network, this DR task is noncompliant.
drs-migration-job-not-public	drs	If the network type of a migration task is set to public network, this migration task is noncompliant.
drs-synchronization-job-not-public	drs	If the network type of a synchronization task is not set to public network, this synchronization task is noncompliant.
dws-enable-kms	dws	If KMS encryption is not enabled for a DWS cluster, this cluster is noncompliant.
dws-enable-snapshot	dws	If automated snapshots are not enabled for a DWS cluster, this cluster is noncompliant.
dws-enable-ssl	dws	If SSL is not enabled for a DWS cluster, this cluster is noncompliant.
ecs-instance-in-vpc	ecs, vpc	If an ECS is not within the specified VPC, this ECS is noncompliant.
ecs-instance-no-public-ip	ecs	If an ECS has an EIP attached, this ECS is noncompliant.
eip-unbound-check	vpc	If an EIP has not been attached to any resource, this EIP is noncompliant.
eip-use-in-specified-days	vpc	If an EIP has not been attached to any resources within the specified number of days after being created, this EIP is noncompliant.
elb-tls-https-listeners-only	elb	If any listener of a load balancer does not have the frontend protocol set to HTTPS, this load balancer is noncompliant.
evs-use-in-specified-days	evs	If an EVS disk has not been attached to any resources within the specified number of days after being created, this disk is noncompliant.
function-graph-inside-vpc	fgs	If a function is not in the specified VPC, this function is noncompliant.
function-graph-public-access-prohibited	fgs	If a function can be accessed over a public network, this function is noncompliant.
gaussdb-nosql-enable-backup	gemini db	If a GeminiDB instance does not have the backup enabled, this instance is noncompliant.
iam-customer-policy-blocked-kms-actions	iam, access-analyzer-verified	If an IAM policy allows any blocked actions on KMS keys, this policy is noncompliant.
iam-group-has-users-check	iam	If an IAM user group has no user, this user group is noncompliant.
iam-password-policy	iam	If the password of an IAM user does not meet the password strength requirements, this IAM user is noncompliant.
iam-policy-no-statements-with-admin-access	iam	If a custom policy or role allows all actions (with the action element set to **::*, :*, or ) for all cloud services, this policy or role is noncompliant.
iam-role-has-all-permissions	iam	If a custom policy or role allows all actions for a cloud service, this policy or role is noncompliant.
iam-root-access-key-check	iam	If the root user access key is available, the account is noncompliant.
iam-user-group-membership-check	iam	If an IAM user is not in any of the specified IAM user groups, this user is noncompliant.
iam-user-mfa-enabled	iam	If multi-factor authentication is not enabled for an IAM user, this user is noncompliant.
kms-not-scheduled-for-deletion	kms	If a KMS key is scheduled for deletion, this key is noncompliant.
kms-rotation-enabled	kms	If key rotation is not enabled for a KMS key, this key is noncompliant.
mfa-enabled-for-iam-console-access	iam	If an IAM user who is allowed to access Huawei Cloud console does not have MFA enabled, this IAM user is noncompliant.
mrs-cluster-kerberos-enabled	mrs	If an MRS cluster does not have Kerberos authentication enabled, this cluster is noncompliant.
mrs-cluster-no-public-ip	mrs	If an MRS cluster has an EIP attached, this cluster is noncompliant.
multi-region-cts-tracker-exists	cts	If there are no enabled CTS trackers in any of the specified regions, the current account is noncompliant.
private-nat-gateway-authorized-vpc-only	nat	If a private NAT gateway is not in a specified VPC, this gateway is noncompliant.
rds-instance-enable-backup	rds	If backup is not enabled for an RDS instance, this instance is noncompliant.
rds-instance-multi-az-support	rds	If an RDS instance does not support multi-AZ deployment, this RDS instance is noncompliant.
rds-instance-no-public-ip	rds	If an RDS instance has an EIP attached, this RDS instance is noncompliant.
root-account-mfa-enabled	iam	If the root user does not have MFA enabled, this root user is noncompliant.
sfsturbo-encrypted-check	sfsturbo	If KMS encryption is not enabled for an SFS Turbo file system, this file system is noncompliant.
stopped-ecs-date-diff	ecs	If an ECS has been stopped for longer than the time allowed, and no operations have been performed on it, this ECS is noncompliant.
volume-unused-check	evs	If an EVS disk is not mounted to any cloud server, this disk is noncompliant.
volumes-encrypted-check	ecs, evs	If a mounted EVS disk is not encrypted, this disk is noncompliant.
vpc-acl-unused-check	vpc	If a network ACL is not attached to any subnets, this ACL is noncompliant.
vpc-default-sg-closed	vpc	If a default security group allows all inbound or outbound traffic, this security group is noncompliant.
vpc-sg-ports-check	vpc	If a security group has the source address set to 0.0.0.0/0 or ::/0 and opens all TCP/UDP ports, this security group is noncompliant.
vpc-sg-restricted-common-ports	vpc	If a security group allows all inbound traffic from any IPv4 address (0.0.0.0/0) or IPv6 address to a specified port, this security group is noncompliant.
vpc-sg-restricted-ssh	vpc	If a security group allows all inbound traffic (with the source address set to 0.0.0.0/0 or ::/0) and opens the TCP 22 port, this security group is noncompliant.
vpn-connections-active	vpnaas	If a VPN is not normally connected, this rule is noncompliant.