Question 1

Is cloudwatch_log_group_kms_key_id enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, This control checks whether a CloudWatch Logs log group is associated with an AWS KMS key. CloudWatch Logs always encrypts log data at rest with a service-owned key; the control passes only if the log group has a KMS key configured and fails otherwise.

Question 2

Is cloudwatch_log_group_retention_in_days enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 3

Is cluster_monitoring_interval enforced for HIPAA Omnibus Rule 2013?

Accepted Answer

Yes, Enable AWS Relational Database Service (AWS RDS) to help monitor AWS RDS availability. This provides detailed visibility into the health of your AWS RDS database instances.

Control	Clause	Change
CloudWatch log groups should have retention period of at least 365 dayscloudwatch_log_group_retention_period_365 164.312(b)	164.312(b)
Log groups should have encryption at rest enabledlog_group_encryption_at_rest_enabled 164.308(a)(1)(ii)(B)	164.308(a)(1)(ii)(B)
RDS DB instances and clusters should have enhanced monitoring enabledrds_db_instance_and_cluster_enhanced_monitoring_enabled 164.312(b)	164.312(b)
VPC security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports (IPv4)vpc_security_group_remote_administration_ipv4 None	None

Controls