AWS CloudFormation Misconfiguration: Insufficient AppSync Logging

JSON
YAML

Abstract

구성이 감사 로깅 기능이 없는 서비스를 정의합니다.

Explanation

감사 기록이 없으면 보안 관련 사고를 감지하고 대응하는 능력이 제한되고 포렌식 조사가 불가능해집니다.

로깅 기능의 효율성을 떨어뜨리는 구성 설정에는 다음을 비롯한 여러 가지가 포함됩니다.
- 의도적인 감사 로깅 비활성화
- 특정 사용자, 그룹, 프로세스의 작업을 로깅 대상에서 제외
- 부적절한 방식으로 로그 무결성 보호
- 선택적 감사 로깅 미활성화
- 로그 샘플링 비율 하향 조정

References

[1] Open Web Application Security Project (OWASP) Logging Cheat Sheet

[2] Standards Mapping - CIS Azure Kubernetes Service Benchmark 5

[3] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 3

[4] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[5] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[6] Standards Mapping - Common Weakness Enumeration CWE ID 778

[7] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-000172

[8] Standards Mapping - FIPS200 CM

[9] Standards Mapping - NIST Special Publication 800-53 Revision 4 AU-12 Audit Generation (P1)

[10] Standards Mapping - NIST Special Publication 800-53 Revision 5 AU-12 Audit Record Generation

[11] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration, A10 Insufficient Logging and Monitoring

[12] Standards Mapping - OWASP Top 10 2021 A09 Security Logging and Monitoring Failures

[13] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[14] Standards Mapping - OWASP Application Security Verification Standard 4.0 7.1.3 Log Content Requirements (L2 L3), 7.1.4 Log Content Requirements (L2 L3), 7.2.1 Log Processing Requirements (L2 L3), 7.2.2 Log Processing Requirements (L2 L3)

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 10.2.1, Requirement 10.2.4, Requirement 10.3.4

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 10.2.1, Requirement 10.2.1.4, Requirement 10.2.2

[17] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 8.2 - Activity Tracking

[18] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 8.2 - Activity Tracking

[19] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 8.2 - Activity Tracking

[20] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000830 CAT II

[21] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000830 CAT II

[22] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000830 CAT II

[23] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000380 CAT III, APSC-DV-000390 CAT III, APSC-DV-000400 CAT III, APSC-DV-000410 CAT III, APSC-DV-000430 CAT III, APSC-DV-000590 CAT II

desc.structural.iac.misconfiguration_insufficient_logging.base