Question 1

Is cloudwatch_log_group_kms_key_id enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, To help protect sensitive data at rest, ensure encryption is enabled for your AWS CloudWatch Log Group.

Question 2

Is cloudwatch_log_group_retention_in_days enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 3

Is encryption_config enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, Ensure that AWS Elastic Kubernetes Service clusters are configured to have Kubernetes secrets encrypted using AWS Key Management Service (KMS) keys.

Control	Clause	Change
CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 164.312(b)	164.312(b)
EKS clusters should be configured to have kubernetes secrets encrypted using KMSeks_cluster_secrets_encrypted 164.308(a)(4)(ii)(A)	164.308(a)(4)(ii)(A)
Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled 164.308(a)(1)(ii)(B)	164.308(a)(1)(ii)(B)

Controls