AWS CIS Benchmark Level 2

CIS Control 14.62

CIS Control 11.31

Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)

CIS Control 1.41

Ensure a log metric filter and alarm exist for AWS Config configuration changes

CIS Control 161

Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs

CIS Control 191

Ensure IAM instance roles are used for AWS resource access from instances

CIS Control 4.51

Ensure hardware MFA is enabled for the "root" account

CIS Control 4.81

Ensure a log metric filter and alarm exist for security group changes

CIS Control 6.21

Ensure VPC flow logging is enabled in all VPCs