Question 1

Is logging_config enforced for NIST Cybersecurity Framework v2.0?

Accepted Answer

Yes, This control checks if AWS CloudFront distributions are configured to capture information from AWS Simple Storage Service (AWS S3) server access logs. This rule is non-compliant if a CloudFront distribution does not have logging configured.

Question 2

Is viewer_certificate enforced for NIST Cybersecurity Framework v2.0?

Accepted Answer

Yes, This control checks whether CloudFront distributions are using the default SSL/TLS certificate CloudFront provides. This control passes if the CloudFront distribution uses a custom SSL/TLS certificate. This control fails if the CloudFront distribution uses the default SSL/TLS certificate.

AWS CloudFront Terraform module

Terraform Module Source