Controls
11 controls from PCI DSS v4.0 apply to this module.
| Control | Clause | Change |
|---|---|---|
| CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 3.2.1 | 3.2.1 | |
| Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled 3.5.1 | 3.5.1 | |
| Aurora MySQL DB clusters should have audit logging enabledrds_db_cluster_aurora_mysql_audit_logging_enabled 10.6.3 | 10.6.3 | |
| Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logsrds_db_cluster_aurora_postgres_logging_enabled None | None | |
| RDS DB clusters should have automatic minor version upgrade enabledrds_db_cluster_automatic_minor_version_upgrade_enabled None | None | |
| RDS DB clusters should be encrypted with CMKrds_db_cluster_encrypted_with_cmk None | None | |
| RDS DB clusters should be encrypted at restrds_db_cluster_encryption_at_rest_enabled 3.5.1 | 3.5.1 | |
| RDS DB clusters should have IAM authentication configuredrds_db_cluster_iam_authentication_enabled 7.2.1 | 7.2.1 | |
| VPC Security groups should only allow unrestricted incoming traffic for authorized portsvpc_security_group_allows_ingress_authorized_ports 1.3.1 | 1.3.1 | |
| VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888vpc_security_group_allows_ingress_to_cassandra_ports 1.3.1 | 1.3.1 | |
| VPC security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports (IPv4)vpc_security_group_remote_administration_ipv4 1.3.1 | 1.3.1 |