Conformance Pack for FedRamp not deployable in GovCloud

[jpSimkins]

I tried to use: Operational-Best-Practices-for-FedRAMP.yaml from here in CloudFormation in GovCloud and it will not deploy due to a couple reasons.

1. Some metrics are not on GovCloud.

2. Property validation failure: [Value of property {/InputParameters} does not match type {String}]

This is the same issue when trying to deploy the same conformance pack in Config in the AWS console.

I recommend adding a check to see if the region is a GovCloud region. I added this to my template so I can use the same template across partitions but I am stuck with the inputParameters not being a string.

[iteuscher]

I also ran into issues deploying the FedRAMP conformance packs in AWS Gov Cloud. Specifically the rules listed below are not in GovCloud or several other regions. I performed a full analysis of the non-GovCloud Config Rules and provided suggestions for how to update the rules. The full content of my analysis is available in this public spreadsheet: https://docs.google.com/spreadsheets/d/1eKZpe2EPA-8RQkG6bWViwLRrdDeS4yUpvtvUpu_4WEg/edit?usp=sharing

For an example see the documentation below on root-account-mfa-enabled https://docs.aws.amazon.com/config/latest/developerguide/root-account-mfa-enabled.html

AWS Region: All supported AWS regions except China (Beijing), Asia Pacific (Thailand), Middle East (UAE), Asia Pacific (Malaysia), AWS GovCloud (US-East), AWS GovCloud (US-West), Mexico (Central), Israel (Tel Aviv), Canada West (Calgary), China (Ningxia) Region

Config rules that need to be fixed	Suggested Change	Note
cloudtrail-enabled	cloud-trail-enabled	Add hypen (cloud-trail)
ec2-instance-managed-by-systems-manager	ec2-instance-managed-by-ssm	Acronym for SSM
ec2-instances-in-vpc	instances-in-vpc	Remove ec2
ecs-task-definition-memory-hard-limit	--	Consider creating custom rule
multi-region-cloudtrail-enabled	multi-region-cloud-trail-enabled	Add hypen (cloud-trail)
opensearch-in-vpc-only	--	elasticsearch-in-vpc-only already used
restricted-common-ports	nacl-no-unrestricted-ssh-rdp	Use similar rule
restricted-ssh	incoming-ssh-disabled	Use similar rule
root-account-hardware-mfa-enabled	--	No root account MFA checks in GovCloud
root-account-mfa-enabled	--	No root account MFA checks in GovCloud
waf-regional-webacl-not-empty	--	Consider creating custom rule

[iteuscher]

Opened a PR with a version of the FedRAMP Low rules that works in GovCloud. Available to use here: #440