CIS AWS Benchmark v5.0.0
ActiveCommon framework
Best for: Any organization running workloads on AWS that wants a recognized security baseline. CIS benchmarks are referenced by auditors across SOC 2, FedRAMP, PCI DSS, and HIPAA engagements as evidence of configuration hardening. If your company undergoes third-party security assessments, auditors will frequently map findings back to CIS controls.
| Mandatory? | Voluntary security baseline |
|---|---|
| Who validates? | Self-assessment or third-party |
| Renewal | No fixed cycle |
| Scope | AWS cloud environments; three Implementation Groups (IGs) |
| Governing body | Center for Internet Security (CIS), CIS AWS Benchmark v5.0.0. Official source |
Get started
Point the module source at the CIS AWS Benchmark v5.0.0 endpoint and pin a version range you reviewed:
module "..." {
source = "cisv500.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}cisv500.compliance.tf lists every CIS AWS Benchmark v5.0.0 module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| CloudTrail Configuration | Validates multi-region trail enablement, read/write event capture, S3 data event logging, object-level read and write event logging, log file validation, KMS CMK encryption, and trail bucket protections including access logging and MFA Delete. | Defining alerting thresholds on CloudTrail log anomalies, integrating with SIEM, and establishing incident response procedures when tampering is detected. |
| EBS Encryption at Rest | Checks that EBS encryption by default is enabled at the account level, that all attached volumes are encrypted, and that encryption at rest is enforced across all EBS volumes. | Migrating pre-existing unencrypted volumes, selecting appropriate KMS key policies, and documenting key ownership and rotation schedules. |
| EC2 Instance Security | Verifies that IAM instance profiles are attached to all EC2 instances, including publicly accessible ones, and that IMDSv2 is enforced. | Reviewing the actual IAM policies attached to instance profiles for least privilege. compliance.tf confirms a profile exists but does not evaluate the breadth of permissions granted. |
| AWS Config Coverage | Confirms AWS Config is enabled across all regions and that the configuration recorder has no failed log deliveries. | Defining and maintaining AWS Config rules for your specific compliance requirements, managing Config rule remediation actions, and budgeting for Config recording costs at scale. |
| Account Contact Information | Checks that a security alternate contact is registered and that account contact details are maintained. | Periodically validating that the contact information is accurate and that named contacts are still employed and reachable. This requires a manual process outside of automated scanning. |
Controls by category
17 of 28 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 11 are Mapped only: CIS AWS Benchmark v5.0.0 lists them, no compliance.tf module checks them.
Data Protection and Encryption
Account-level EBS encryption defaults must be enabled in every region, and all existing volumes need to be encrypted, not just new ones. The most common gap is legacy volumes created before the account-level default was turned on. Migrating them requires creating encrypted snapshots and replacing the original volumes, which teams routinely defer.
| Control | Status |
|---|---|
| Attached EBS volumes should have encryption enabled | Enforced |
Identity and Access Management
The key check here is whether EC2 instances rely on IAM instance profiles rather than embedded long-term credentials, and whether IMDSv2 token-based access is enforced to block SSRF-based credential theft. Common finding: instances launched from older AMIs or launch templates still default to IMDSv1.
| Control | Status |
|---|---|
| EC2 instances should have IAM profile attached | Enforced |
| EC2 instances should use IMDSv2 | Enforced |
Logging and Monitoring
This is the largest control group in CIS AWS v5.0.0. Assessors check for a multi-region trail capturing both read and write management events, S3 data event logging, log file validation, and KMS encryption of trail logs. A frequent gap: organizations enable CloudTrail but neglect S3 object-level data events, which are required for CIS sections 3.8 and 3.9. AWS Config must be active in all regions, and auditors confirm the recorder has no delivery failures.
Additional controls (22)
AWS IAM (4)
AWS KMS (1)
| Control | Status |
|---|---|
| KMS CMK rotation should be enabled | Enforced |
Amazon EFS (2)
| Control | Status |
|---|---|
| EFS file systems should have encryption at rest enabled | Enforced |
| EFS file systems should be encrypted with CMK | Enforced |
Amazon RDS (7)
Amazon S3 (6)
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| CIS AWS Benchmark v6.0.0 | High 100% | |
| AWS Well-Architected Framework v10 | High 86% | |
| ISO/IEC 27001:2022 | High 82% |
Frequently asked questions
Does CIS AWS v5.0.0 apply to my organization?
If you run any workloads on AWS, yes. CIS benchmarks are voluntary, but auditors for SOC 2, HIPAA, FedRAMP, and PCI DSS frequently use CIS as a reference baseline. Even without an external audit mandate, applying the benchmark reduces your attack surface. No minimum size, revenue, or industry requirement exists.
What changed between CIS AWS v4.0.0 and v5.0.0?
v5.0.0 updates control definitions to reflect current AWS service capabilities, adds controls for newer services, and refines check criteria for existing ones. Some controls were renumbered or consolidated. If you already pass v4.0.0, expect a small number of new findings, primarily around updated encryption and logging expectations. Review the CIS changelog published alongside the benchmark PDF for a full delta.
How long does it take to achieve full compliance with the benchmark?
For a greenfield AWS account with infrastructure-as-code, one to two weeks of focused effort is realistic. For a brownfield environment with years of accumulated configuration drift, budget four to eight weeks. The hardest controls to remediate are MFA Delete on CloudTrail S3 buckets (requires root credentials), migrating unencrypted EBS volumes, and enforcing IMDSv2 across all instances without breaking legacy workloads.
Can I scope the benchmark to specific AWS accounts in an Organization?
Yes. Run powerpipe against individual accounts or aggregate across accounts using multi-account connection configurations. CIS recommends applying the benchmark to every account, but you can prioritize production accounts and treat dev and sandbox environments on a different schedule.
Is there a certification for passing the CIS benchmark?
No. CIS does not issue certifications. You generate a compliance report showing pass/fail status for each control and submit it as evidence during other audits, such as SOC 2 or ISO 27001. Some organizations publish their CIS compliance posture to customers via trust portals.