|   Trend Micro Cloud One™
Open menu

Rules

Last updated: 12 January 2020

Contents

What rules does Conformity support?

What is the frequency of running the rules?

What rules are run?

New Accounts

Rules configuration

Rule settings

Anatomy of a rule

Check summary

Not scored

Deprecated Rules

FAQs

What rules does Conformity support?

Cloud Conformity supports over 540 rules founded on cloud and security governance best practices, and Compliance Standards.

Cloud Conformity’s rules cover the 5 categories of security and governance best practices:

  1. Security
  2. Cost Optimisation
  3. Operational Excellence
  4. Reliability
  5. Performance Efficiency

Rules are run against your cloud account services, resources, their settings, and configurations.

What is the frequency of running the rules?

Cloud Conformity rules are run:

  1. Periodically on your added Accounts by the Conformity Bot, or
  2. In real-time for selected rules, if you have the Real-Time Monitoring subscription turned on for your account.

What rules are run?

Refer to Cloud Conformity Knowledge Base for all the rules supported by Cloud Conformity.

  • Is there any rule that looks for open access to all ports? Rule: EC2-001 (Security Group Port Range) checks for any range of open ports including all ports.
  • Are all the rules in AWS Config included in Cloud Conformity? We support every rule in AWS Config as soon as they become available through config:DescribeConfigRules API

If Cloud Conformity doesn’t support a rule you need, you have the option to create custom rules using AWS Config Service.

New Accounts

When an account is first added to Cloud Conformity, a set of default rules will be run on the account by the Conformity Bot.

Rules configuration

Rules can be configured to better cater to your organisation’s circumstances and governance needs. Some rules require configuration before they can be run, and all rules have configuration options including adjusting severity and enabling/disabling.

See Rule Configuration.

Rule settings

There are common rule settings (such as new rule behavior, and rule configurations) that can be managed at the Cloud Accounts level. See Rule settings.

Anatomy of a rule

A Cloud Conformity rule is run against an AWS (or other Cloud Provider) or Cloud Conformity Service. For example Guard Duty, CloudTrail, CloudConformity. A full list of services can be found on the Knowledge Base.

Cloud Conformity runs Checks for each Rule against the Service and or Service resources, the Rule belongs to. Checks can fail or succeed and are captured by Cloud Conformity’s numerous reporting tools.

Note: New rules or rules that are updated will be marked accordingly for 10 days after the release.

Check summary

Provides a count for different check statuses. See Model: Check for more info on each status.

Not scored

Some rules are documented by Cloud Conformity but cannot be tested against your cloud infrastructure due to not being applicable to cloud infrastructure, or limitations of the data provided by the cloud provider. Rules that cannot be tested are identified as Not Scored. For more information see Model Check.

Deprecated Rules

Rules marked for removal by Conformity are identified as ‘Deprecated Rules’. You will be notified of Deprecated Rules within your Profile and Account Rule settings. We will also send you an email providing more information about the rule deprecation, including any instructions that you need to follow.

Profile Notification

Account Notification

FAQs

  1. A rule is marked as “New” or “Updated” on Cloud Conformity web interface. What does it mean?
    Rules that are updated and new rules are marked as “Updated” and “New” for 10 days after the release. Updates include changes to rule behaviour, bug fixes, improvements, new settings, changes to default settings, changes to default risk level, etc.
  2. Why does an AssumeRole action trigger a failure for our blacklisted region rule?
    Sometimes regions get picked up by the browser from the last session. Say the user’s last action was in us east 1. When the user next logs in, the console login may be us east 1 even if user normally logs in to eu west 1.
  3. Is there a rule to check for S3 buckets with static website hosting option turned on? I created a bucket with static website hosting turned on and it didn’t trigger any violations.
    Refer to the link: S3 Buckets with Website Configuration Enabled
  4. How are the AWS Inspector Findings risk levels calculated by Cloud Conformity?
    AWS Inspector Findings risk levels are calculated in the following way:
    Inspector.severity = High; Cloud Conformity risk level = HIGH
    Inspector.severity = Medium; Cloud Conformity risk level = MEDIUM
    Inspector.severity = Low; Cloud Conformity risk level = LOW
    Otherwise Cloud Conformity risk level = LOW
  5. How are the GuardDuty Findings risk levels calculated by Cloud Conformity?
    GuardDuty Findings risk levels are calculated in the following way:
    GuardDuty.level >=7.0; Cloud Conformity risk level = EXTREME
    GuardDuty.level >=4.0 & GuardDuty.level <=6.9; Cloud Conformity risk level = MEDIUM
    Otherwise Cloud Conformity risk level = LOW
  6. How are the Macie Alerts risk levels calculated by Cloud Conformity?
    Macie Alerts risk levels are calculated in the following way:
    Macie.severity = Critical; Cloud Conformity risk level = EXTREME
    Macie.severity = High; Cloud Conformity risk level = HIGH
    Macie.severity = Medium; Cloud Conformity risk level = MEDIUM
    Macie.severity = Low; Cloud Conformity risk level = LOW
    Macie.severity = Informational; Cloud Conformity risk level = LOW
  7. Adding several trusted accounts is a very time-consuming process. Is there a better way to do it?
    If you are adding several trusted accounts, you can perhaps use the Cloud Conformity API.Trusted accounts are part of Cross Account rules. Example here - https://www.cloudconformity.com/conformity-rules/SQS/sqs-cross-account-access.htmlYou can use update rule setting endpoint - https://github.com/cloudconformity/documentation-api/blob/master/Accounts.md#update-rule-setting
  8. We have experienced some issues with ACM Certificates expiring recently. It is my understanding that Cloud Conformity has rules for 7 Days (ACM-002), 30 Days (ACM-003), and 45 days (ACM-004) before expiry. However, when I visit our dashboard and filter by the ACM service I can only see ACM-004. I just wanted to clarify whether Cloud Conformity account is checking for all of the ACM certificate expiry rules. If they are being checked, is it possible for you to explain why am I unable to see them when filtering by ACM?
    Only one of ACM Certificates Renewal rule - 2,3,4 generates a Check at any given time to avoid overlap
    a. ACM-002 Certificate will expire within 7 days
    b. ACM-003 Certificate will expire between 7 and 30 days
    c. ACM-004 Certificate will expire between 30 and 45 days

    The reason for producing one Check out of ACM-002, ACM-003, an ACM-004 at any given time is to avoid overlap and create a reliable conformity score:
    ACM-002 is high risk
    ACM-003 is medium risk
    ACM-004 is low risk
    Between 45 and 30 days you receive a low risk Check; between 30 and 7 days you receive a medium risk Check; and eventually, between 7 days and expiry, you get a high risk Check.
  9. Is there a rule to detect whether CloudTrail is configured to log to S3?
    Yes. CloudTrail Enabled rule detects whether CloudTrail is configured to log to S3. S3BucketName is required for configuring a trail.
  10. Is it possible to check for logons from users that aren’t whitelisted
    Sign-In Events rule checks Sign-In Events for IAM and Federated Users. Also, User signed in to AWS from an approved country rule detects user authentication session from an unapproved country.
  11. Is it possible to detect if an RDS Snapshot is shared publicly?
    Yes. Amazon RDS Public Snapshots rule detects any public RDS snapshots
  12. Can we export cloudwatch logs from an EC2 instance and generate alerts?
    Cloud Conformity doesn’t have access to CloudWatch logs so it cannot generate alerts out of it.