Cis Aws Euc 2.7

---
name: cis-aws-euc-2.7
description: "Ensure access is limited to trusted devices"
category: cis-end-user-compute
version: "1.2.0"
author: cyberstrike-official
tags: [cis, aws, end-user-compute, workspaces, trusted-devices, certificate-authentication, device-trust]
cis_id: "2.7"
cis_benchmark: "CIS AWS End User Compute Services Benchmark v1.2.0"
tech_stack: [aws]
cwe_ids: []
chains_with: [cis-aws-euc-2.6, cis-aws-euc-2.8]
prerequisites: []
severity_boost: {}
---

# Ensure access is limited to trusted devices (Manual)

## Profile Applicability

- Level 2

## Description

WorkSpaces access should be restricted to trusted devices with valid certificates.

## Rationale

WorkSpaces is accessible from any supported device that is connected to the internet. When you enable access to trusted devices, Amazon WorkSpaces uses certificate-based authentication to determine whether a device is trusted.

## Impact

For each directory, you can import up to two root certificates and Amazon WorkSpaces will present them both to the client.

**Note:** Certificates for trusted devices only applies to the Amazon WorkSpaces OS clients. This feature does not apply to the Amazon WorkSpaces Web Access client, or any third-party clients.

## Audit Procedure

### Using AWS Console

Perform the following steps to confirm that Allow Trusted Devices is set:

1. Log in to the WorkSpaces console at https://console.aws.amazon.com/workspaces/
2. In the left pane, click **Directories**
3. Select the directory id link
4. Scroll to the **Access Control Options** section
5. Confirm that the correct **Allow** settings are in place
6. Confirm that certificates have been imported
7. Confirm that the correct device types have been enabled

If everything is not configured as above refer to the remediation below.

## Remediation

### Using AWS Console

Perform the following steps to set the restriction Allow Trusted Devices:

**Create the Certificates**

**Note:** It requires root certificates generated by an internal Certificate Authority (CA) and client certificates that chain up to a root certificate.

Requirements:

- Certificates must be Base64-encoded certificate files in CRT, CERT, or PEM format
- Certificates must include a Common Name
- The maximum length of certificate chain supported is 4
- Use a strong encryption algorithm. Minimum ECDSA-2 with RSA, SHA256 with ECDSA. Other options SHA381 with ECDSA, or SHA512 with ECDSA
- Make sure "key usage: Digital signature" is present on the public key
- For macOS, if the device certificate is in the system keychain, authorize the WorkSpaces client application to access those certificates

**Deploy Client Certificates to the Trusted Devices**

- Client certificates must be installed on the trusted devices for your users
- Utilize a third party tool to install the certificates or have the certificates installed locally by an administrator
- On Windows, the WorkSpaces client application searches for client certificates in both the user and root certificate stores
- On macOS, the WorkSpaces client application searches for client certificates in the entire keychain

**Configure the Restriction**

1. Login to the WorkSpaces console at https://console.aws.amazon.com/workspaces/
2. In the left pane, click **Directories**
3. Select the directory id link
4. Scroll to the **Access Control Options** section and click **Edit**

```
[Windows] Choose Only Allow Trusted Windows Devices to Access WorkSpaces.
[macOS] Choose Only Allow Trusted macOS Devices to Access WorkSpaces.
```

5. Import up to two root certificates. For each root certificate, do the following:
   - Choose Import
   - Copy the body of the certificate to the form
   - Choose Import
   - (Optional) Specify whether other types of devices have access to WorkSpaces

6. Scroll down to the **Trusted devices** section
7. Select the device types allowed to **Trusted devices**
8. To block access from all selected device types, click **Deny All**
9. Click **Save**

## Default Value

By default, users can access their WorkSpaces from any supported device that is connected to the internet.

https://docs.aws.amazon.com/workspaces/latest/adminguide/trusted-devices.html

## References

1. https://docs.aws.amazon.com/workspaces/latest/adminguide/trusted-devices.html
2. https://docs.aws.amazon.com/acm/latest/userguide/gs.html
3. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html

## CIS Controls

**v8:**

- 3.3 Configure Data Access Control Lists
  - Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.

**v7:**

- 14.6 Protect Information through Access Control Lists
  - Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities.