Sign in Join

Live chat for Free Pascal, Lazarus, Delphi and every Pascal programmer.

Catalog · How the catalog works
Anything · Lazarus or Delphi
Random projectRandom project

steampipe-mod-aws-compliance-apra

APRA CPS 234 (Information Security) compliance benchmark for AWS — run with Powerpipe + Steampipe.

View on GitHub

Member rating

No ratings yet.

Sign in to rate this project.

README

steampipe-mod-aws-compliance-apra

A Steampipe / Powerpipe compliance mod for APRA on AWS — run CPS 234, CPS 230, and Essential Eight benchmarks against your live AWS accounts with a single command. No agent, no SaaS, no PR gatekeeping: install it and query your posture instantly.

Keywords: Steampipe APRA · Powerpipe CPS 234 · APRA compliance benchmark AWS · Essential Eight Steampipe · Australian cloud compliance as code

Why this exists

Steampipe/Powerpipe ship excellent compliance mods for CIS, NIST, PCI, HIPAA, SOC 2 — but nothing for the Australian regulatory context. APRA-regulated entities running AWS have no off-the-shelf way to benchmark against CPS 234 or the Essential Eight in seconds.

Because a Steampipe mod is self-published (you git clone and run it — no maintainer approval), this is a tool I fully own. It complements the upstream Prowler contributions: same frameworks, different engine, instant interactive dashboards.

What's in here

Path Purpose
cps_234.pp CPS 234 benchmark (controls → AWS resource queries)
cps_230.pp CPS 230 operational-risk benchmark
essential_eight.pp Essential Eight ML1→ML3 benchmark
controls/ Individual control definitions
docs/ Per-benchmark documentation

Quick start

bash
# Install Powerpipe + the AWS plugin for Steampipe, then:
git clone https://github.com/jaybilgaye/steampipe-mod-aws-compliance-apra
cd steampipe-mod-aws-compliance-apra

# Run the full CPS 234 benchmark
powerpipe benchmark run aws_compliance_apra.benchmark.cps_234

# Or launch the interactive dashboard
powerpipe server

Example output

pascal
aws_compliance_apra.benchmark.cps_234
  ???  ??21  IAM users do not have AdministratorAccess attached  ??? 1 user in alarm
  ???  ??21  MFA is enabled for the root user                    ??? alarm
  ???  ??21  EBS volumes are encrypted
  ???  ??21  S3 buckets block public access                      ??? 2 buckets in alarm
  ???  ??21  GuardDuty is enabled                                 ??? alarm

Status

✅ Benchmark v1 — validated against a live AWS account. mod.pp + cps_234.pp define a CPS 234 benchmark with 14 controls (para 21 access/encryption/exposure/logging/backup, para 23 detection, para 27 testing). Run with Steampipe v2.4 + AWS plugin v1.31 + Powerpipe v1.5 — all controls executed with zero query errors. Self-owned → ships regardless of upstream review.

Requires Steampipe + the AWS plugin + Powerpipe installed and an AWS connection configured: steampipe plugin install aws → powerpipe benchmark run aws_compliance_apra.benchmark.cps_234.

Related