Best Practices for NIST Requirements
Applicable Scenario
Config provides a conformance package to help you check if your resources on Huawei Cloud meet some of the National Institute of Standards and Technology (NIST) requirements.
Rules
The following table lists the rules and solutions included in this conformance package template.
Rule |
Cloud Service |
Description |
---|---|---|
access-keys-rotated |
iam |
If an IAM user's access key is not rotated within the specified number of days, this user is noncompliant. |
apig-instances-execution-logging-enabled |
apig |
If logging is not enabled for a dedicated APIG gateway, this gateway is considered non-compliant. |
apig-instances-ssl-enabled |
apig |
If no SSL certificates are attached to a dedicated APIG gateway, this gateway is considered noncompliant. |
as-group-elb-healthcheck-required |
as |
If an AS group does not have health check enabled, this AS group is noncompliant. |
css-cluster-disk-encryption-check |
css |
If disk encryption is not enabled for a CSS cluster, this cluster is noncompliant. |
css-cluster-in-vpc |
css |
If a CSS cluster is not in the specified VPCs, this cluster is noncompliant. |
cts-kms-encrypted-check |
cts |
If a CTS tracker does not have KMS encryption enabled, this tracker is noncompliant. |
cts-lts-enable |
cts |
If a CTS tracker does not have trace transfer to LTS enabled, this tracker is noncompliant. |
cts-obs-bucket-track |
cts |
If there are no CTS trackers created for the specified OBS bucket, the current account is noncompliant. |
cts-support-validate-check |
cts |
If a CTS tracker does not have trace file verification enabled, this tacker is noncompliant. |
cts-tracker-exists |
cts |
If there are no trackers or all trackers are disabled in an account, the current account is noncompliant. |
drs-data-guard-job-not-public |
drs |
If the network type of a DR task is set to public network, this DR task is noncompliant. |
drs-migration-job-not-public |
drs |
If the network type of a migration task is set to public network, this migration task is noncompliant. |
drs-synchronization-job-not-public |
drs |
If the network type of a synchronization task is not set to public network, this synchronization task is noncompliant. |
dws-enable-kms |
dws |
If KMS encryption is not enabled for a DWS cluster, this cluster is noncompliant. |
dws-enable-snapshot |
dws |
If automated snapshots are not enabled for a DWS cluster, this cluster is noncompliant. |
dws-enable-ssl |
dws |
If SSL is not enabled for a DWS cluster, this cluster is noncompliant. |
ecs-instance-in-vpc |
ecs, vpc |
If an ECS is not within the specified VPC, this ECS is noncompliant. |
ecs-instance-no-public-ip |
ecs |
If an ECS has an EIP attached, this ECS is noncompliant. |
eip-unbound-check |
vpc |
If an EIP has not been attached to any resource, this EIP is noncompliant. |
eip-use-in-specified-days |
vpc |
If an EIP has not been attached to any resources within the specified number of days after being created, this EIP is noncompliant. |
elb-tls-https-listeners-only |
elb |
If any listener of a load balancer does not have the frontend protocol set to HTTPS, this load balancer is noncompliant. |
evs-use-in-specified-days |
evs |
If an EVS disk has not been attached to any resources within the specified number of days after being created, this disk is noncompliant. |
function-graph-inside-vpc |
fgs |
If a function is not in the specified VPC, this function is noncompliant. |
function-graph-public-access-prohibited |
fgs |
If a function can be accessed over a public network, this function is noncompliant. |
gaussdb-nosql-enable-backup |
gemini db |
If a GeminiDB instance does not have the backup enabled, this instance is noncompliant. |
iam-customer-policy-blocked-kms-actions |
iam, access-analyzer-verified |
If an IAM policy allows any blocked actions on KMS keys, this policy is noncompliant. |
iam-group-has-users-check |
iam |
If an IAM user group has no user, this user group is noncompliant. |
iam-password-policy |
iam |
If the password of an IAM user does not meet the password strength requirements, this IAM user is noncompliant. |
iam-policy-no-statements-with-admin-access |
iam |
If a custom policy or role allows all actions (with the action element set to *:*:*, *:*, or *) for all cloud services, this policy or role is noncompliant. |
iam-role-has-all-permissions |
iam |
If a custom policy or role allows all actions for a cloud service, this policy or role is noncompliant. |
iam-root-access-key-check |
iam |
If the root user access key is available, the account is noncompliant. |
iam-user-group-membership-check |
iam |
If an IAM user is not in any of the specified IAM user groups, this user is noncompliant. |
iam-user-mfa-enabled |
iam |
If multi-factor authentication is not enabled for an IAM user, this user is noncompliant. |
kms-not-scheduled-for-deletion |
kms |
If a KMS key is scheduled for deletion, this key is noncompliant. |
kms-rotation-enabled |
kms |
If key rotation is not enabled for a KMS key, this key is noncompliant. |
mfa-enabled-for-iam-console-access |
iam |
If an IAM user who is allowed to access Huawei Cloud console does not have MFA enabled, this IAM user is noncompliant. |
mrs-cluster-kerberos-enabled |
mrs |
If an MRS cluster does not have Kerberos authentication enabled, this cluster is noncompliant. |
mrs-cluster-no-public-ip |
mrs |
If an MRS cluster has an EIP attached, this cluster is noncompliant. |
multi-region-cts-tracker-exists |
cts |
If there are no enabled CTS trackers in any of the specified regions, the current account is noncompliant. |
private-nat-gateway-authorized-vpc-only |
nat |
If a private NAT gateway is not in a specified VPC, this gateway is noncompliant. |
rds-instance-enable-backup |
rds |
If backup is not enabled for an RDS instance, this instance is noncompliant. |
rds-instance-multi-az-support |
rds |
If an RDS instance does not support multi-AZ deployment, this RDS instance is noncompliant. |
rds-instance-no-public-ip |
rds |
If an RDS instance has an EIP attached, this RDS instance is noncompliant. |
root-account-mfa-enabled |
iam |
If the root user does not have MFA enabled, this root user is noncompliant. |
sfsturbo-encrypted-check |
sfsturbo |
If KMS encryption is not enabled for an SFS Turbo file system, this file system is noncompliant. |
stopped-ecs-date-diff |
ecs |
If an ECS has been stopped for longer than the time allowed, and no operations have been performed on it, this ECS is noncompliant. |
volume-unused-check |
evs |
If an EVS disk is not mounted to any cloud server, this disk is noncompliant. |
volumes-encrypted-check |
ecs, evs |
If a mounted EVS disk is not encrypted, this disk is noncompliant. |
vpc-acl-unused-check |
vpc |
If a network ACL is not attached to any subnets, this ACL is noncompliant. |
vpc-default-sg-closed |
vpc |
If a default security group allows all inbound or outbound traffic, this security group is noncompliant. |
vpc-sg-ports-check |
vpc |
If a security group has the source address set to 0.0.0.0/0 or ::/0 and opens all TCP/UDP ports, this security group is noncompliant. |
vpc-sg-restricted-common-ports |
vpc |
If a security group allows all inbound traffic from any IPv4 address (0.0.0.0/0) or IPv6 address to a specified port, this security group is noncompliant. |
vpc-sg-restricted-ssh |
vpc |
If a security group allows all inbound traffic (with the source address set to 0.0.0.0/0 or ::/0) and opens the TCP 22 port, this security group is noncompliant. |
vpn-connections-active |
vpnaas |
If a VPN is not normally connected, this rule is noncompliant. |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot