HIPAA Security - Implement access-keys-rotated config rule

[dontirun]

Summary

As a developer

I would like to implement the access-keys-rotated config rule

So that I can check if qualified resources in my CDK app conforms to the following HIPAA Security control(s): 164.308(a)(4)(ii)(B)

Details

ruleId: HIPAA.Security-AccessKeysRotated

info: The IAM access key is not rotated per organizational policy - (Control IDs: 164.308(a)(4)(ii)(B))

Given Reason: The credentials are audited for authorized devices, users, and processes by ensuring IAM access keys are rotated as per organizational policy. Changing the access keys on a regular schedule is a security best practice. It shortens the period an access key is active and reduces the business impact if the keys are compromised. This rule requires an access key rotation value (Config Default: 90). The actual value should reflect your organization's policies.

Acceptance Criteria

If the rule can be implemented

Given a CDK app with a non-compliant resource

• When HIPAA Security Pack is enabled
• Then the CDK stack does not deploy and the user receives an ERROR with relevant Control ID information about the non compliant resource

Given a CDK app with a compliant resource

• When HIPAA Security Pack is enabled
• Then the CDK stack deploys and the user does not receive an ERROR about the compliant resource

Given the cdk-nag RULES file

• When the HIPAA.Security-AccessKeysRotated rule is added to the rule pack
• Then the HIPAA Security Errors section is updated with the rule information

If the rule cannot be implemented

Given the cdk-nag RULES file

• When the access-keys-rotated check is not added to the rule pack
• Then the HIPAA Security Excluded Rules section is updated with the check information