CIS AWS Benchmark v6.0.0
ActiveCommon framework
Best for: Any AWS shop that needs a recognized configuration baseline. This covers enterprises whose customers demand evidence of cloud hardening, teams pursuing SOC 2 or FedRAMP (CIS controls provide supporting technical evidence but don't satisfy all required safeguards on their own), and regulated industries like financial services and healthcare that treat CIS as an accepted hardening standard. No size or revenue threshold.
| Mandatory? | Voluntary security baseline |
|---|---|
| Who validates? | Self-assessment or third-party |
| Renewal | No fixed cycle |
| Scope | AWS cloud environments; three Implementation Groups (IGs) |
| Governing body | Center for Internet Security (CIS), CIS AWS Benchmark v6.0.0. Official source |
Get started
Point the module source at the CIS AWS Benchmark v6.0.0 endpoint and pin a version range you reviewed:
module "..." {
source = "cis.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}cis.compliance.tf lists every CIS AWS Benchmark v6.0.0 module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| CloudTrail Logging Configuration | Runs controls checking multi-region trail enablement, log file validation, KMS encryption of trail logs, S3 data event logging for read and write operations, and access logging on the CloudTrail destination bucket. | Log retention policies, CloudWatch alarm configuration for specific API calls, and the investigation process when suspicious activity surfaces in logs are all yours to define. So is the incident response workflow triggered by log findings. |
| EBS Encryption at Rest | Checks that EBS encryption by default is enabled at the account level, that attached volumes are encrypted, and that all EBS volumes (attached or not) use encryption. | KMS key selection (AWS-managed vs. customer-managed), rotation schedules, and migrating any pre-existing unencrypted volumes to encrypted replacements. |
| EC2 Instance Security Configuration | Validates that EC2 instances have IAM profiles attached (with additional scrutiny for publicly accessible instances) and that IMDSv2 is enforced. | The IAM policies attached to instance profiles need to follow least privilege, which requires reviewing what permissions each role grants. Also verify that application code doesn't rely on IMDSv1 before flipping the enforcement switch. |
| AWS Config Monitoring | Verifies that AWS Config is enabled across all regions and that the configuration recorder has no failed log deliveries. | Config rules beyond the baseline, compliance dashboard reviews, and SNS notifications for configuration drift are outside what automation covers here. |
| Account-Level Security Settings | Checks whether a security alternate contact is registered on the AWS account. Programmatic verification of contact registration status. | Actually populating the contact fields with valid, monitored email addresses and phone numbers. Keeping contact information current when staff change. These are manual data entry tasks that cannot be fully automated. |
Controls by category
17 of 28 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 11 are Mapped only: CIS AWS Benchmark v6.0.0 lists them, no compliance.tf module checks them.
Data Protection - EBS Encryption
Most EBS findings here aren't about whether encryption by default is toggled on. It's the older volumes created before that setting was enabled that trip organizations up. Remediation means creating encrypted snapshots and replacing the originals, which takes real time in production environments.
| Control | Status |
|---|---|
| Attached EBS volumes should have encryption enabled | Enforced |
Identity and Access Management - EC2
Instance profiles and IMDSv2 enforcement are the two things assessors focus on here, with extra scrutiny on publicly accessible instances. For IMDSv2, check that HttpTokens is set to 'required' in the instance metadata options. Legacy instances still allowing IMDSv1 are a common finding and a real exposure: SSRF vulnerabilities can be used to steal instance credentials via the metadata service.
| Control | Status |
|---|---|
| EC2 instances should have IAM profile attached | Enforced |
| EC2 instances should use IMDSv2 | Enforced |
Logging - CloudTrail Configuration
Auditors confirm at least one multi-region trail captures both read and write management events, that log file validation is enabled to detect tampering, and that trail logs are encrypted with a customer-managed KMS key. A frequent gap: organizations have a trail enabled but it only covers one region, or log file validation was never turned on.
Additional controls (22)
AWS IAM (4)
AWS KMS (1)
| Control | Status |
|---|---|
| KMS CMK rotation should be enabled | Enforced |
Amazon EFS (2)
| Control | Status |
|---|---|
| EFS file systems should have encryption at rest enabled | Enforced |
| EFS file systems should be encrypted with CMK | Enforced |
Amazon RDS (7)
Amazon S3 (6)
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| CIS AWS Benchmark v5.0.0 | High 100% | |
| AWS Well-Architected Framework v10 | High 86% | |
| ISO/IEC 27001:2022 | High 82% |
Frequently asked questions
Does CIS v6.0.0 apply to my organization?
If you run anything on AWS, yes. CIS benchmarks are voluntary, not regulatory mandates. However, auditors in SOC 2, FedRAMP, PCI DSS, and HIPAA assessments routinely reference them as evidence of a hardened baseline, and many enterprise procurement questionnaires ask directly whether CIS benchmarks are followed. There is no revenue or size threshold.
How does v6.0.0 differ from v4.0.0?
Recommendations were added, removed, reworded and renumbered, and audit procedures were updated for current AWS console and CLI interfaces. Compare against the change history in the benchmark document before you map v4.0.0 evidence to v6.0.0.
Can I get certified against CIS benchmarks?
No. CIS does not offer a certification program. You run assessments using tools like Powerpipe or CIS-CAT Pro, produce evidence reports, and those reports are consumed by auditors or customers as supporting documentation within a broader compliance program like SOC 2 or ISO 27001.
How long does initial remediation take?
For a single AWS account with moderate complexity, expect 2 to 4 weeks. CloudTrail and Config controls can be fixed in a day with Terraform. EBS encryption takes longer if you have existing unencrypted volumes that require snapshot, encrypt, and replace workflows. IMDSv2 enforcement requires application testing to confirm nothing depends on v1. Multi-account environments using AWS Organizations will take proportionally longer but benefit from deploying fixes via SCPs and StackSets.
What about the MFA delete requirement on the CloudTrail S3 bucket?
This is the single most operationally difficult control in the benchmark. MFA delete can only be enabled by the root user via the AWS CLI, not the console, and requires a hardware or virtual MFA device registered to the root account. Many organizations document a compensating control (versioning plus bucket policy restrictions) rather than enabling MFA delete, because it complicates legitimate bucket lifecycle operations. Discuss the approach with your auditor before implementation.