Walkthrough: Remediating compliance violations

After you have identified a compliance violation for a specific policy rule, the first step is to associate a remediation action with that rule.

1. Select Manage > Policies.
2. From the displayed list of policies that have been imported, click a policy to view the rules that apply to that policy. In this example, we are using the CIS Amazon Web Services Foundations Benchmark Policy.
   .

Next, you need to enable the remediation action for a specific rule.

In this example, the rule is 2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket, which has been identified as a critical violation. 

1. Select the checkbox for the rule.
2. Click the Actions drop-down and choose your remediation preference from the following options:
   1. Enable Remediation (Auto): Remediation action takes place automatically if the selected rule name has been violated.
   2. Enable Remediation (On Demand): Remediation action takes place according to user discretion if the selected rule name has been violated.
   3. Disable Remediation: Remediation will be disabled.

A message is displayed indicating that the policy action mapping has been successfully enabled.

Note: The connector must be running for the remediation action to be successful.

The next step is to remediate the compliance violation.

Click the Violations tab.

In this example, we are interested in the violations associated with the "CIS Amazon Web Services Foundations Benchmark Policy".

To limit the display to only rules associated with that policy, select the policy from the Policy drop-down list.

Click the rule within the policy that was previously mapped to the remediation action. In this example, we need to remediate the 2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket.

Select the checkbox to the left of the resource you want to remediate.

Note: You can select more than one resource.

Click Remediate Violations. (This button is enabled only after you have selected a resource and content is available for that resource.)

The remediation action is initiated and is sent to the connector that created the resource. Note that the connector must be running for the remediation action to be successful.

A confirmation message is displayed.

From the Dashboard, view all the rules in the policy and locate the rule you selected previously. 

The rule is remediated after the next collection cycle. You might have to refresh your browser to see the change in status.