##################################################################################
#
#   Conformance Pack:
#     FedRAMP Rev5 Recommended Secure Configuration (RSC) Requirements
#
#   Description:
#     This conformance pack checks AWS accounts against FedRAMP Rev5 RSC requirements
#     FRR-RSC-01 through FRR-RSC-10
#
##################################################################################

Resources:
  # FRR-RSC-01: Root Account MFA
  RootAccountMFAEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-root-account-mfa-enabled
      Description: Checks whether MFA is enabled for root account
      Source:
        Owner: AWS
        SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-01: Root Account Hardware MFA
  RootAccountHardwareMFAEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-root-account-hardware-mfa-enabled
      Description: Checks whether root account uses hardware MFA
      Source:
        Owner: AWS
        SourceIdentifier: ROOT_ACCOUNT_HARDWARE_MFA_ENABLED
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-02: IAM Password Policy
  IAMPasswordPolicy:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-iam-password-policy
      Description: Checks IAM password policy meets FedRAMP requirements
      InputParameters:
        RequireUppercaseCharacters: true
        RequireLowercaseCharacters: true
        RequireSymbols: true
        RequireNumbers: true
        MinimumPasswordLength: 14
        PasswordReusePrevention: 24
        MaxPasswordAge: 90
      Source:
        Owner: AWS
        SourceIdentifier: IAM_PASSWORD_POLICY
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-03: IAM User MFA Enabled
  IAMUserMFAEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-iam-user-mfa-enabled
      Description: Checks whether IAM users have MFA enabled
      Source:
        Owner: AWS
        SourceIdentifier: IAM_USER_MFA_ENABLED
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-03: IAM User No Policies Check
  IAMUserNoPoliciesCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-iam-user-no-policies-check
      Description: Checks that IAM users have no inline policies
      Source:
        Owner: AWS
        SourceIdentifier: IAM_USER_NO_POLICIES_CHECK

  # FRR-RSC-03: IAM Policy No Statements With Admin Access
  IAMPolicyNoStatementsWithAdminAccess:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-iam-policy-no-statements-with-admin-access
      Description: Checks IAM policies do not grant full admin access
      Source:
        Owner: AWS
        SourceIdentifier: IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS
      Scope:
        ComplianceResourceTypes:
          - AWS::IAM::Policy

  # FRR-RSC-01: CloudTrail Enabled
  CloudTrailEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-cloudtrail-enabled
      Description: Checks whether CloudTrail is enabled
      Source:
        Owner: AWS
        SourceIdentifier: CLOUD_TRAIL_ENABLED
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-01: CloudTrail Log File Validation
  CloudTrailLogFileValidationEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-cloudtrail-log-file-validation-enabled
      Description: Checks whether CloudTrail log file validation is enabled
      Source:
        Owner: AWS
        SourceIdentifier: CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-01: CloudTrail CloudWatch Logs Enabled
  CloudTrailCloudWatchLogsEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-cloudtrail-cloudwatch-logs-enabled
      Description: Checks whether CloudTrail sends logs to CloudWatch
      Source:
        Owner: AWS
        SourceIdentifier: CLOUD_TRAIL_CLOUD_WATCH_LOGS_ENABLED
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-03: Access Keys Rotated
  AccessKeysRotated:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-access-keys-rotated
      Description: Checks whether access keys are rotated within 90 days
      InputParameters:
        maxAccessKeyAge: 90
      Source:
        Owner: AWS
        SourceIdentifier: ACCESS_KEYS_ROTATED
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-03: IAM User Unused Credentials Check
  IAMUserUnusedCredentialsCheck:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-iam-user-unused-credentials-check
      Description: Checks for unused IAM user credentials
      InputParameters:
        maxCredentialUsageAge: 90
      Source:
        Owner: AWS
        SourceIdentifier: IAM_USER_UNUSED_CREDENTIALS_CHECK
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-03: IAM Access Analyzer Enabled
  IAMAccessAnalyzerEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-iam-access-analyzer-enabled
      Description: Checks whether IAM Access Analyzer is enabled
      Source:
        Owner: AWS
        SourceIdentifier: IAM_ACCESS_ANALYZER_ENABLED
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-02: S3 Bucket Public Read Prohibited
  S3BucketPublicReadProhibited:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-s3-bucket-public-read-prohibited
      Description: Checks that S3 buckets do not allow public read access
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket

  # FRR-RSC-02: S3 Bucket Public Write Prohibited
  S3BucketPublicWriteProhibited:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-s3-bucket-public-write-prohibited
      Description: Checks that S3 buckets do not allow public write access
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket

  # FRR-RSC-02: S3 Bucket Server Side Encryption Enabled
  S3BucketServerSideEncryptionEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-s3-bucket-server-side-encryption-enabled
      Description: Checks that S3 buckets have encryption enabled
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket

  # FRR-RSC-02: S3 Bucket Versioning Enabled
  S3BucketVersioningEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-s3-bucket-versioning-enabled
      Description: Checks that S3 buckets have versioning enabled
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_VERSIONING_ENABLED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket

  # FRR-RSC-01: CloudTrail S3 Bucket Access Logging Enabled
  S3BucketLoggingEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-s3-bucket-logging-enabled
      Description: Checks that S3 buckets have access logging enabled
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_LOGGING_ENABLED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket

  # FRR-RSC-03: EC2 Instance Profile Attached
  EC2InstanceProfileAttached:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-ec2-instance-profile-attached
      Description: Checks that EC2 instances have IAM instance profile attached
      Source:
        Owner: AWS
        SourceIdentifier: EC2_INSTANCE_PROFILE_ATTACHED
      Scope:
        ComplianceResourceTypes:
          - AWS::EC2::Instance

  # FRR-RSC-02: VPC Flow Logs Enabled
  VPCFlowLogsEnabled:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-vpc-flow-logs-enabled
      Description: Checks that VPC flow logs are enabled
      Source:
        Owner: AWS
        SourceIdentifier: VPC_FLOW_LOGS_ENABLED
      MaximumExecutionFrequency: TwentyFour_Hours

  # FRR-RSC-02: Security Group No Unrestricted Ingress
  RestrictedSSH:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-restricted-ssh
      Description: Checks that security groups do not allow unrestricted SSH access
      Source:
        Owner: AWS
        SourceIdentifier: INCOMING_SSH_DISABLED
      Scope:
        ComplianceResourceTypes:
          - AWS::EC2::SecurityGroup

  RestrictedCommonPorts:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: fedramp-restricted-common-ports
      Description: Checks that security groups do not allow unrestricted access to common ports
      InputParameters:
        blockedPort1: 20
        blockedPort2: 21
        blockedPort3: 3389
        blockedPort4: 3306
        blockedPort5: 5432
      Source:
        Owner: AWS
        SourceIdentifier: RESTRICTED_INCOMING_TRAFFIC
      Scope:
        ComplianceResourceTypes:
          - AWS::EC2::SecurityGroup
