A Steampipe / Powerpipe compliance mod for APRA on AWS — run CPS 234, CPS 230, and Essential Eight benchmarks against your live AWS accounts with a single command. No agent, no SaaS, no PR gatekeeping: install it and query your posture instantly.
Keywords: Steampipe APRA · Powerpipe CPS 234 · APRA compliance benchmark AWS · Essential Eight Steampipe · Australian cloud compliance as code
Steampipe/Powerpipe ship excellent compliance mods for CIS, NIST, PCI, HIPAA, SOC 2 — but nothing for the Australian regulatory context. APRA-regulated entities running AWS have no off-the-shelf way to benchmark against CPS 234 or the Essential Eight in seconds.
Because a Steampipe mod is self-published (you git clone and run it — no maintainer approval), this is a tool I fully own. It complements the upstream Prowler contributions: same frameworks, different engine, instant interactive dashboards.
| Path | Purpose |
|---|---|
cps_234.pp |
CPS 234 benchmark (controls → AWS resource queries) |
cps_230.pp |
CPS 230 operational-risk benchmark |
essential_eight.pp |
Essential Eight ML1→ML3 benchmark |
controls/ |
Individual control definitions |
docs/ |
Per-benchmark documentation |
# Install Powerpipe + the AWS plugin for Steampipe, then:
git clone https://github.com/jaybilgaye/steampipe-mod-aws-compliance-apra
cd steampipe-mod-aws-compliance-apra
# Run the full CPS 234 benchmark
powerpipe benchmark run aws_compliance_apra.benchmark.cps_234
# Or launch the interactive dashboard
powerpipe serveraws_compliance_apra.benchmark.cps_234
✘ ¶21 IAM users do not have AdministratorAccess attached — 1 user in alarm
✘ ¶21 MFA is enabled for the root user — alarm
✔ ¶21 EBS volumes are encrypted
✘ ¶21 S3 buckets block public access — 2 buckets in alarm
✘ ¶21 GuardDuty is enabled — alarm
✅ Benchmark v1 — validated against a live AWS account. mod.pp + cps_234.pp define a
CPS 234 benchmark with 14 controls (para 21 access/encryption/exposure/logging/backup, para 23
detection, para 27 testing). Run with Steampipe v2.4 + AWS plugin v1.31 + Powerpipe v1.5 —
all controls executed with zero query errors. Self-owned → ships regardless of upstream review.
Requires Steampipe + the AWS plugin + Powerpipe installed and an AWS connection configured:
steampipe plugin install aws→powerpipe benchmark run aws_compliance_apra.benchmark.cps_234.
- 📖 Blog: APRA CPS 234 on AWS — controls mapping
- 🔗 Companion:
cps234-aws-config-pack— same controls, AWS Config engine - 🌐 More at aiopsone.com — AI-powered AWS Security & Cloud Operations for APRA-regulated Australia.