Skip to main content

AWS Foundational Security Best Practices (FSBP) Standard

Lacework provides compliance policies based on AWS Foundational Security Best Practices (FSBP) Standard (or AWS FSBP Standard for short).

Once you have integrated your Amazon Web Services (AWS) environment with Lacework, you can check whether your resources are compliant with the framework policies.

Revision History​

This revision adds high severity policies. See the Compliance Policy Changelog for details on what was added or changed.

Visibility and Usage in the Lacework Console​

You can use the AWS FSBP Standard in the following ways:

Prerequisites​

Ensure you have integrated your AWS environment with the Lacework Compliance platform. Completing this will prepare your environment for the AWS FSBP Standard:

  • Integrate Lacework with AWS
    • A Configuration integration is the minimum requirement for your accounts/organizations to gain access to our Compliance platform functionality.

Previous Integrations using Terraform​

If you have previously integrated AWS with Lacework using Terraform before this framework was available:

  1. Enter the directory containing the Terraform files used for the integration.
  2. Run terraform init -upgrade to initialize the working directory (containing the Terraform files).
  3. Run terraform plan and review the changes that will be applied.
  4. Once satisfied with the changes that will be applied, run terraform apply to upgrade the modules.

AWS FSBP Standard Policies​

All policies in the AWS FSBP Standard are disabled by default.

You can enable or disable them using one of the following methods outlined in this section.

Enable or Disable Policies in the Lacework Console​

On the Policies page, use the framework:aws-fsbp-2023H2 tag to filter for AWS FSBP Standard policies only.

You can enable or disable each one using the status toggle.

Alternatively, see Batch Update Policies to enable or disable multiple policies at once.

Enable or Disable Policies using the Lacework CLI​

tip

If you have not set up the Lacework CLI before, see the Lacework CLI guide to get started.

Enable or disable all the AWS FSBP Standard policies using the following commands in the Lacework CLI:

Enable all policies
lacework policy enable --tag framework:aws-fsbp-2023H2
Disable all policies
lacework policy disable --tag framework:aws-fsbp-2023H2

Enable or disable specific AWS FSBP Standard policies using the following command examples in the Lacework CLI:

Enable lacework-global-807
lacework policy enable lacework-global-807
Disable lacework-global-807
lacework policy disable lacework-global-807

Policy Mapping for AWS FSBP Standard​

The AWS FSBP Standard controls are mapped to Lacework policies, as listed in the following tables.

Table key:

  • Control ID - The AWS FSBP Standard control identifier.
  • Title - The policy/control title.
  • Lacework Policy ID - The Lacework policy identifier.
  • Lacework Assessment - Whether Lacework have determined that the security control can be assessed automatically or if it requires manual verification.
  • Severity - The severity of the policy (as determined by Lacework).
note

This framework uses Lacework AWS Security Addendum policies when there is an overlap with the AWS FSBP Standard.

Control IDTitleLacework Policy IDLacework AssessmentSeverity
ACM.2Rivest-Shamir-Adleman (RSA) certificates managed by AWS Certificate Manager (ACM) should use a key length of at least 2,048 bitslacework-global-382AutomatedHigh

Automated vs Manual Policies​

Lacework automates compliance policies where possible. This allows the Lacework platform to monitor your environment resources to check whether they are compliant with the benchmark recommendations.

For some benchmark recommendations, it is not possible to automate the policy checks in an Azure environment. These policies are manual, and you must verify such policies manually. Lacework provides the manual remediation steps for these policies (when available).

Adjusted Controls​

IAM.1 - IAM policies should not allow full "*" administrative privileges​

This control has been split into three policies to monitor users, groups, and roles.

The following table lists each policy and their new title:

Click to expand
Control IDLacework Policy IDTitle
IAM.1lacework-global-45Ensure Identity and Access Management (IAM) policies that allow full "*:*" administrative privileges are not attached to users
IAM.1lacework-global-485Ensure IAM policies that allow full "*:*" administrative privileges are not attached to groups.
IAM.1lacework-global-486Ensure IAM policies that allow full "*:*" administrative privileges are not attached to roles.
note

The policy catalog only retains one entry for this control, which is lacework-global-45.

Last updated on