Amazon Linux 2023 chronyd service must be enabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-274023	AZLX-23-001055	SV-274023r1120057_rule	CCI-004923	medium
Description
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.
STIG			Date
Amazon Linux 2023 Security Technical Implementation Guide			2026-02-27

Related Frameworks

1 mapping across 3 frameworks

SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-07.1Synchronization With Authoritative Time Source

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)
SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (9) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(9)Disconnect or Disable Access

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V1R1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-8Time Stamps

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-8(1)Synchronization with Authoritative Time Source

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

AU-8(2)Secondary Authoritative Time Source

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CM-6Configuration Settings

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)V3R3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V3R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

IA-3(1)Cryptographic Bidirectional Authentication

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)V2R2intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-45System Time Synchronization

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)1our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)1intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-45(1)Synchronization with Authoritative Time Source

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

SC-45(2)Secondary Authoritative Time Source

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)
DISA STIG Benchmark (XCCDF)3our copyintersects(normalised)
DISA STIG Benchmark (XCCDF)3intersects(normalised)
DISA CCI List2025-01-23equal to(normalised)

CCI1 mapping

CCI-004923

1.00

DISA STIG Benchmark (XCCDF)V1R3intersects(normalised)

Details

Check Text (C-274023r1120057_chk)

Verify Amazon Linux 2023 has the chronyd service set to active with the following command: $ systemctl is-active chronyd active If the chronyd service is not active, this is a finding.

Fix Text (F-78019r1120056_fix)

Configure Amazon Linux 2023 to have the chronyd service set to active with the following command: $ sudo systemctl enable --now chronyd