Cis AWS Storage 2.13
DevOps & Securitycis-aws-storage-2.13Cis AWS Storage 2.13 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure creating an SNS subscription
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Storage_Services_Benchmark_v1.0.0/cis-aws-storage-2.13/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-storage-2-13, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
CIS Control 2.13: Ensure creating an SNS subscription (Manual)
Profile Applicability
- Level 2
Description
SNS (Simple Notification Service) subscriptions enable real-time alerts and notifications for AWS CloudWatch alarms and events, ensuring administrators are immediately informed of critical issues with EC2 instances and EBS volumes.
Rationale
Creating SNS subscriptions is essential for timely incident response and proactive monitoring. By receiving immediate notifications about CloudWatch alarms, administrators can quickly address performance issues, security events, or resource failures before they impact operations.
Impact
Without SNS subscriptions, CloudWatch alarms may go unnoticed, leading to delayed incident response, prolonged downtime, and potential data loss. Real-time notifications ensure that critical issues are addressed promptly, minimizing operational disruptions and maintaining service availability.
Audit Procedure
Via AWS Management Console
- Navigate to SNS → Subscriptions
- Verify subscriptions exist for critical CloudWatch alarms
- Confirm subscription endpoints (email, SMS, Lambda) are active
- Test notification delivery
Via AWS CLI
```bash
List SNS topics
aws sns list-topics
List subscriptions
aws sns list-subscriptions
Get topic attributes
aws sns get-topic-attributes --topic-arn <TOPIC_ARN>
List subscriptions for specific topic
aws sns list-subscriptions-by-topic --topic-arn <TOPIC_ARN> ```
Expected Result
- SNS topics exist for critical alarm categories
- Subscriptions are configured for appropriate notification channels
- Subscription endpoints are confirmed and active
- Test notifications are successfully delivered
Remediation
Via AWS Management Console
- Navigate to SNS → Create Topic
- Provide topic name and display name
- Create subscription to the topic
- Choose protocol (Email, SMS, HTTPS, Lambda, SQS)
- Enter endpoint details
- Confirm subscription
- Link topic to CloudWatch alarms
Via AWS CLI
```bash
Create SNS topic
aws sns create-topic --name CloudWatchAlerts
Create email subscription
aws sns subscribe
--topic-arn arn:aws:sns:region:account:CloudWatchAlerts
--protocol email
--notification-endpoint [email protected]
Confirm subscription (check email for confirmation link)
Associate CloudWatch alarm with SNS topic
aws cloudwatch put-metric-alarm
--alarm-name HighCPUUtilization
--alarm-actions arn:aws:sns:region:account:CloudWatchAlerts
--metric-name CPUUtilization
--namespace AWS/EC2
--statistic Average
--period 300
--threshold 80
--comparison-operator GreaterThanThreshold
```
Default Value
No SNS topics or subscriptions are created by default.
References
CIS Controls
Not explicitly mapped in the provided documentation.
Notes
- This is a manual control requiring SNS configuration verification
- Configure multiple notification channels for redundancy
- Use SNS message filtering to reduce notification noise
- Regularly test SNS subscriptions to ensure delivery
- Consider integrating with incident management systems (PagerDuty, OpsGenie)