Amazon Web Services
Reads your AWS configuration directly — root MFA, root access keys, password policy, S3 Block Public Access, CloudTrail, KMS key rotation and EBS encryption. Needs a read-only IAM credential and nothing else; no Security Hub subscription required.
What CMDash reads
- Cloud configuration checks
Syncs only read from Amazon Web Services. Some integrations also support write-back actions on Command and Enterprise plans, such as opening a ticket or deactivating a user.
How you connect
An API key or token you create in the vendor console and enter in CMDash.
Once connected, CMDash syncs it every 4 hours by default. What it finds maps to your controls through rules you install or write.
Where this fits in your frameworks
- PCI DSS v4.0.1 — Cloud configuration checks feeds Secure Configurations
- NYDFS Cybersecurity Regulation — Cloud configuration checks feeds Encryption of Nonpublic Information
- NIST SP 800-171 Revision 3 — Cloud configuration checks feeds System and Communications Protection
This is where Amazon Web Services’s data is documented as relevant on our framework pages — not a pre-built, automatic control mapping. You configure which controls it maps to inside CMDash.
Also in Cloud Security
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.