CIS Benchmark Level 1 and 2 controls for AWS accounts — CI/CD, GitOps, DevSecOps & Observability

The CIS AWS Foundations Benchmark is the most widely adopted security baseline for AWS accounts, developed by the Center for Internet Security through a community consensus process. It defines two levels of controls: Level 1 controls are the minimum security baseline that every AWS account should meet, scored as CRITICAL or HIGH severity failures in Security Hub; Level 2 controls are additional hardening measures for higher-security environments, adding defence-in-depth protections that are appropriate for accounts holding sensitive data or processing regulated workloads.

The benchmark is organised into five domains: Identity and Access Management, Storage, Logging, Monitoring, and Networking. AWS Security Hub's CIS standard subscription automatically evaluates all controls against live account configuration, producing a compliance score and a prioritised list of failures. This automated evaluation means that achieving CIS compliance is not a one-time audit project but a continuous operational posture that Security Hub tracks and surfaces whenever a configuration change creates a new gap.

Analogy🏏Cricket

Think of it like cricket: Imagine the BCCI's team management system for an international tour with matches in three different countries simultaneously. Rather than a coordinator manually managing each match day's logistics, the system reads the official tour schedule document and automatically dispatches the right squad, equipment, and support staff to each venue. When the tour schedule changes—a match is rescheduled, a squad member is replaced—the system detects the change and updates the arrangements automatically. Just as the tour management system uses the official document as the source of truth and orchestrates multiple concurrent deployments to multiple venues, ArgoCD uses the Git repository as the source of truth and orchestrates multiple concurrent Application syncs to multiple clusters. Just as the system provides a dashboard showing which venues are 'ready', 'delayed', or 'degraded', ArgoCD provides a dashboard showing which Applications are Synced, OutOfSync, or Degraded. This reveals why ArgoCD is valued at scale: managing dozens of applications across multiple clusters manually is operationally equivalent to coordinating an international cricket tour by phone.