Question 1

Is cloudwatch_logs_kms_key_id enforced for NIST SP 800-171 Rev 2?

Accepted Answer

Yes, To help protect sensitive data at rest, ensure encryption is enabled for your AWS CloudWatch Log Group.

Question 2

Is cloudwatch_logs_retention_in_days enforced for NIST SP 800-171 Rev 2?

Accepted Answer

Yes, Ensure a minimum duration of event log data is retained for your log groups to help with troubleshooting and forensics investigations.

Question 3

Is dead_letter_target_arn enforced for NIST SP 800-171 Rev 2?

Accepted Answer

Yes, Enable this rule to help notify the appropriate personnel through AWS Simple Queue Service (AWS SQS) or AWS Simple Notification Service (AWS SNS) when a function has failed.

Question 4

Is reserved_concurrent_executions enforced for NIST SP 800-171 Rev 2?

Accepted Answer

Yes, Checks whether the AWS Lambda function is configured with function-level concurrent execution limit. The control is non-compliant if the Lambda function is not configured with function-level concurrent execution limit.

Question 5

Is vpc_subnet_ids enforced for NIST SP 800-171 Rev 2?

Accepted Answer

Yes, Deploy AWS Lambda functions within an AWS Virtual Private Cloud (AWS VPC) for a secure communication between a function and other services within the AWS VPC.

AWS Lambda Terraform module

Terraform Module Source