Add Operational Best Practices for APRA CPS 234 and CPS 230

[jaybilgaye]

I confirm these files are made available under CC0 1.0 Universal (https://creativecommons.org/publicdomain/zero/1.0/legalcode)

Issue #, if available: -

Description of changes:

Description

Adds two new conformance packs for the Australian Prudential Regulation Authority (APRA) prudential standards:

• aws-config-conformance-packs/Operational-Best-Practices-for-APRA-CPS-234.yaml — CPS 234 Information Security (46 rules)
• aws-config-conformance-packs/Operational-Best-Practices-for-APRA-CPS-230.yaml — CPS 230 Operational Risk Management (32 rules)

Both standards are mandatory for all APRA-regulated entities in Australia (ADIs/banks, general & life insurers, private health insurers and superannuation/RSE licensees).

The repo already ships Operational-Best-Practices-for-APRA-CPG-234.yaml, but that maps CPG 234 (APRA's non-binding practice guide). There is currently no pack for the binding standards CPS
234 or CPS 230. These fill that gap and complement the existing APRA/ACSC packs.

CPS 234 (Information Security) — 46 rules

Maps the AWS-observable requirements of CPS 234:

• Para 21 (implementation of controls): least-privilege IAM, MFA, password policy, encryption at rest (S3/EBS/RDS/DynamoDB/EFS/Backup), encryption in transit, KMS rotation, public-access prevention,
  CloudTrail (multi-region + log-file validation + KMS), Config, VPC flow logs, GuardDuty, Security Hub, AWS Backup coverage.
• Para 27 (testing control effectiveness): Inspector + SSM patch compliance.

CPS 230 (Operational Risk Management) — 32 rules

Maps the AWS-observable operational-risk controls:

• Para 24 IT capability / asset health: SSM management + patch compliance.
• Para 26 monitoring: CloudTrail (multi-region) + VPC flow logs.
• Para 29 control effectiveness: GuardDuty + Security Hub.
• Para 33 business continuity / backup & DR: AWS Backup plans/retention/encryption, RDS/Aurora/DynamoDB/EBS/EC2/EFS/FSx/Redshift/ElastiCache backup coverage, S3 versioning.
• Para 37 tolerance levels (availability): RDS/cluster Multi-AZ, deletion protection, ELB cross-zone + multi-AZ, Auto Scaling multi-AZ, DynamoDB autoscaling, OpenSearch fault tolerance, VPN dual
  tunnels.

Governance/process paragraphs (board roles, policy framework, incident notification, internal audit, service-provider management) are intentionally out of scope — not observable via AWS Config.

Testing

• cfn-lint passes cleanly on both files.
• Both deploy via aws configservice put-conformance-pack.
• CPS 230 rules reuse the same managed-rule identifiers as the existing Operational-Best-Practices-for-BCP-and-DR.yaml pack.

References

• APRA CPS 234: https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_public_release.pdf
• APRA CPS 230: https://handbook.apra.gov.au/standard/cps-230