Skip to main content

AWS Foundational Security Best Practices (FSBP) Standard

Lacework provides compliance policies based on AWS Foundational Security Best Practices (FSBP) Standard (or AWS FSBP Standard for short).

Once you have integrated your Amazon Web Services (AWS) environment with Lacework, you can check whether your resources are compliant with the framework policies.

Revision History​

This initial release contains critical severity policies only.

Visibility and Usage in the Lacework Console​

You can use the AWS FSBP Standard in the following ways:

Prerequisites​

Ensure you have integrated your AWS environment with the Lacework Compliance platform. Completing this will prepare your environment for the AWS FSBP Standard:

  • Integrate Lacework with AWS
    • A Configuration integration is the minimum requirement for your accounts/organizations to gain access to our Compliance platform functionality.

Previous Integrations using Terraform​

If you have previously integrated AWS with Lacework using Terraform before this framework was available:

  1. Enter the directory containing the Terraform files used for the integration.
  2. Run terraform init -upgrade to initialize the working directory (containing the Terraform files).
  3. Run terraform plan and review the changes that will be applied.
  4. Once satisfied with the changes that will be applied, run terraform apply to upgrade the modules.

AWS FSBP Standard Policies​

All policies in the AWS FSBP Standard are disabled by default.

You can enable or disable them using one of the following methods outlined in this section.

Enable or Disable Policies in the Lacework Console​

On the Policies page, use the framework:aws-fsbp-2023H2 tag to filter for AWS FSBP Standard policies only.

You can enable or disable each one using the status toggle.

Alternatively, see Batch Update Policies to enable or disable multiple policies at once.

Enable or Disable Policies using the Lacework CLI​

tip

If you have not set up the Lacework CLI before, see the Lacework CLI guide to get started.

Enable or disable all the AWS FSBP Standard policies using the following commands in the Lacework CLI:

Enable all policies
lacework policy enable --tag framework:aws-fsbp-2023H2
Disable all policies
lacework policy disable --tag framework:aws-fsbp-2023H2

Enable or disable specific AWS FSBP Standard policies using the following command examples in the Lacework CLI:

Enable lacework-global-807
lacework policy enable lacework-global-807
Disable lacework-global-807
lacework policy disable lacework-global-807

Policy Mapping for AWS FSBP Standard​

The AWS FSBP Standard controls are mapped to Lacework policies, as listed in the following tables.

Table key:

  • Control ID - The AWS FSBP Standard control identifier.
  • Title - The policy/control title.
  • Lacework Policy ID - The Lacework policy identifier.
  • Lacework Assessment - Whether Lacework have determined that the security control can be assessed automatically or if it requires manual verification.
  • Severity - The severity of the policy (as determined by Lacework).
note

All policies in the AWS FSBP Standard are automated. This means the Lacework platform monitors your environment resources to check whether they are compliant with these policies.

This framework uses Lacework AWS Security Addendum policies when there is an overlap with the AWS FSBP Standard.

Control IDTitleLacework Policy IDLacework AssessmentSeverity
CloudFront.1CloudFront distributions should have a default root object configuredlacework-global-378AutomatedCritical
Last updated on