Question 1

Is default_cache_behavior enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, This control checks whether an AWS CloudFront distribution requires viewers to use HTTPS directly or whether it uses redirection. The control fails if ViewerProtocolPolicy is set to allow-all for defaultCacheBehavior or for cacheBehaviors.

Question 2

Is logging_config enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, This control checks if AWS CloudFront distributions are configured to capture information from AWS Simple Storage Service (AWS S3) server access logs. This rule is non-compliant if a CloudFront distribution does not have logging configured.

Control	Clause	Change
CloudFront distributions should require encryption in transitcloudfront_distribution_encryption_in_transit_enabled 164.308(a)(4)(ii)(A)	164.308(a)(4)(ii)(A)
CloudFront distributions access logs should be enabledcloudfront_distribution_logging_enabled 164.308(a)(1)(ii)(D)	164.308(a)(1)(ii)(D)

Controls