knarayan/cloud_posture_checks huggingface dataset:
CUSTOMIZE: Non-corporate accounts have access to Google Cloud Platform (GCP) resources
Using personal accounts to access GCP resources may compromise the security of your business. Using fully managed corporate Google accounts to access Google Cloud Platform resources is recommended to make sure that your resources are secure.

NOTE : This policy requires customization before using it.

To customize, follow the steps mentioned below:
	- Clone this policy and replace '@yourcompanydomainname' in RQL with your domain name. For example: 'user does not end with @prismacloud.io and user does not end with gserviceaccount.com'.
	- For multiple domains, update the RQL with conditions for each domain. For example: 'user does not end with @prismacloud.io and user does not end with @prismacloud.com and user does not end with gserviceaccount.com'.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['USER_ANOMALY'].
Mitigation of this issue can be done as follows: It is recommended to use fully managed corporate Google accounts for increased visibility, auditing, and control over access to Google Cloud Platform resources. Do not access GCP resources through personal accounts..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-projects-get-iam-user' AND json.rule = 'user does not end with @yourcompanydomainname and user does not end with gserviceaccount.com'```
Azure App Service Web app doesn't use latest PHP version
This policy identifies App Service Web apps that are not configured with latest PHP version. Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. It is recommended to use the latest PHP version for web apps in order to take advantage of security fixes, if any.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure Portal
2. Navigate to 'App Services' dashboard
3. Select the reported web app service
4. Under 'Settings' section, Click on 'Configuration'
5. Click on 'General settings' tab, Ensure that Stack is set to PHP and Minor version is set to latest version.
6. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'config.isPhpVersionLatest exists and config.isPhpVersionLatest equals false'```
IBM Cloud Application Load Balancer for VPC has backend pool with health check protocol not configured with HTTPS
This policy identifies IBM Cloud Application Load Balancers for VPC that has different health check protocol instead of HTTPS. HTTPS pools uses TLS(SSL) to encrypt normal HTTP requests and responses. It is highly recommended to use application load balancers with HTTPS backend pools for additional security.
This is applicable to ibm cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Log in to the IBM Cloud Console 
2. Click on 'Menu Icon' and navigate to 'VPC Infrastructure' and then 'Load balancers'
3. Select the 'Load balancers' reported in the alert
4. Under ‘Back-end pools' tab, click on three dots on the right corner of a row containing back-end pool with health check protocol other than HTTPS. Then click on 'Edit’
5. In the 'Edit back-end pool' screen, under 'Health check' section, select 'HTTPS' from the 'Health protocol' dropdown.
6. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-loadbalancer' AND json.rule = profile.family equal ignore case application and operating_status equal ignore case online and pools[?any( health_monitor.type does not equal ignore case https )] exists```
IBM Cloud user with IAM policies provide administrative privileges for Cloud object storage buckets
This policy identifies IBM Cloud users with overly permissive administrative role on IBM Cloud cloud object storage service. 

IBM Cloud Object Storage is a highly scalable, resilient, and secure managed data storage service on the IBM Cloud platform that offers an alternative to traditional block and file storage solutions. When a user having a policy with admin rights on object storage gets compromised, the whole service gets compromised. 

As a security best practice, it is recommended to grant the least privilege access, such as granting only the permissions required to perform a task, instead of providing excessive permissions.
This is applicable to ibm cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['HIGH_PRIVILEGED_ROLE'].
Mitigation of this issue can be done as follows: 1. Log in to the IBM Cloud console.
2. In the IBM Cloud console, click 'Manage' on the title bar > 'Access (IAM)', and then click on 'Users' in the left panel.
3. Select the user for whom you want to edit access.
4. Go to the 'Access' tab, and under the 'Access policies' section, click on the three dots on the right corner of a row for the policy that has administrator permission on the 'IBM Cloud Object Storage' service.
5. Click on Remove or Edit to assign limited permission to the policy.
6. Review the policy details that you're about to edit or remove, and confirm by clicking Save or Remove..

Query:
```config from cloud.resource where api.name = 'ibm-iam-policy' AND json.rule = type equal ignore case "access" and roles[?any( role_id contains "crn:v1:bluemix:public:iam::::role:Administrator" )] exists and resources[?any( attributes[?any( name equal ignore case "serviceName" and value equal ignore case "cloud-object-storage" and operator is member of ("stringEquals", "stringMatch"))] exists and (attributes[?any( name is member of ("resource","resourceGroupId","serviceInstance","prefix"))] does not exist or attributes[?any( name equal ignore case "resourceType" and value equal ignore case "bucket" )] exists ) )] exists and subjects[?any( attributes[?any( name contains "iam_id" and value contains "IBMid")] exists )] exists as X;config from cloud.resource where api.name = 'ibm-iam-user' as Y; filter '$.X.subjects[*].attributes[*].value contains $.Y.iam_id'; show Y;```
NSK test AWS config recorder
test
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.account = 'Aws_sand_2743_Dipankar_Again' AND api.name = 'aws-configservice-describe-configuration-recorders' AND json.rule = 'status.recording is true and status.lastStatus equals SUCCESS and recordingGroup.allSupported is true' as X; config from cloud.resource where api.name = 'aws-region' AND json.rule = optInStatus equals opted-in or optInStatus equals opt-in-not-required as Y; filter '$.X.region equals $.Y.regionName'; show X; count(X) less than 1```
bikram-test-public-s3-bucket
bikram-test-public-s3-bucket
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.account = 'Bikram-Personal-AWS Account' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = ((((publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false) or (publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false)) and acl.grantsAsList[?any(grantee equals AllUsers and permission is member of (ReadAcp,Read,FullControl))] exists) or ((policyStatus.isPublic is true and ((publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false) or (publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false))) and (policy.Statement[?any(Effect equals Allow and (Principal equals * or Principal.AWS equals *) and (Action contains s3:* or Action contains s3:Get or Action contains s3:List) and (Condition does not exist))] exists))) and websiteConfiguration does not exist```
Copy of AWS Security Group allows all traffic on SSH port (22)
This policy identifies Security groups that allow all traffic on SSH port 22. Doing so, may allow a bad actor to brute force their way into the system and potentially get access to the entire network. Review your list of security group rules to ensure that your resources are not exposed. As a best practice, restrict SSH solely to known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: Before making any changes, please check the impact to your applications/services. If the Security Group reported indeed need to restrict all traffic, follow the instructions below:
1. Log in to the AWS Console
2. Navigate to the 'VPC' service
3. Select the 'Security Group' reported in the alert
4. Click on the 'Inbound Rule'
5. Remove the rule which has 'Source' value as 0.0.0.0/0 or ::/0 and 'Port Range' value as 22 (or range containing 22).

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-ec2-describe-security-groups' AND json.rule = isShared is false and (ipPermissions[?any((ipRanges[*] contains 0.0.0.0/0 or ipv6Ranges[*].cidrIpv6 contains ::/0) and ((toPort == 1433 or fromPort == 1433) or (toPort > 1433 and fromPort < 1433)))] exists)```
AWS DynamoDB encrypted using AWS owned CMK instead of AWS managed CMK
This policy identifies the DynamoDB tables that use AWS owned CMK (default ) instead of AWS managed CMK (KMS ) to encrypt data. AWS managed CMK provide additional features such as the ability to view the CMK and key policy, and audit the encryption and decryption of DynamoDB tables.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: 1. Sign in to AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated.
3. Navigate to 'DynamoDB' dashboard
4. Select the reported table from the list of DynamoDB tables
5. In 'Overview' tab, go to 'Table Details' section
6. Click on the 'Manage Encryption' link available for 'Encryption Type'
7. On 'Manage Encryption' pop up window, Select 'KMS' as the encryption type..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-dynamodb-describe-table' AND json.rule =  'ssedescription does not exist or (ssedescription exists and ssedescription.ssetype == AES256)'```
Azure Microsoft Defender for Cloud set to Off for DNS
This policy identifies Azure Microsoft Defender for Cloud which has a defender setting for DNS set to Off. Enabling Azure Defender for the cloud provides advanced security capabilities like threat intelligence, anomaly detection, and behavior analytics. Defender for DNS monitors the queries and detects suspicious activities without the need for any additional agents on your resources. It is highly recommended to enable Azure Defender for DNS.

Note: This policy does check for classic Defender for DNS configuration. If Defender for Servers Plan 2 is enabled, the defender setting for DNS will be set by default.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: For customers who are using  Microsoft Defender for Servers Plan 2:

1. Go to Microsoft Defender for Cloud
2. Select Environment Settings
3. Click on the subscription name
4. Select the Defender plans
5. Ensure Status is set to On for Servers Plan 2

For customers who are using Microsoft Defender for Servers Plan 1:

1. Go to Microsoft Defender for Cloud
2. Select Environment Settings
3. Click on the subscription name
4. Select the Defender plans
5. Ensure Status is set to On for DNS..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any(name equals VirtualMachines and properties.pricingTier equal ignore case Standard and properties.subPlan equal ignore case P2)] does not exist or pricings[?any(name equals Dns and properties.deprecated is false and properties.pricingTier does not equal Standard)] exists```
Azure SQL server not configured with Active Directory admin authentication
This policy identifies Azure SQL servers that are not configured with Active Directory admin authentication. Azure Active Directory authentication is a mechanism of connecting to Microsoft Azure SQL Database and SQL Data Warehouse by using identities in Azure Active Directory (Azure AD). With Azure AD authentication, you can centrally manage the identities of database users and other Microsoft services in one central location. It is recommended to configure SQL servers with Active Directory admin authentication. 
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['PRIVILEGE_ESCALATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal
2. Navigate SQL servers dashboard
3. Select reported each SQL server
4. Click on Azure Active Directory (under 'Settings')
5. Click on 'Set admin'
6. Select an Azure Active Directory from available options
7. Click on Select
8. Click on Save.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = serverAdmins does not exist or serverAdmins[*] size equals 0 or (serverAdmins[*].properties.administratorType exists and serverAdmins[*].properties.administratorType does not equal ActiveDirectory and serverAdmins[*].properties.login is not empty)```
GCP Memorystore for Redis instance has AUTH disabled
This policy identifies GCP Memorystore for Redis instances having AUTH disabled.

GCP Memorystore for Redis is a fully managed in-memory data store that simplifies Redis deployment and scaling while ensuring high availability and low-latency access. When AUTH is disabled, any client that can reach the Redis instance over the network can freely connect and perform operations without providing any credentials, creating a significant security risk to your data.

It is recommended to enable authentication (AUTH) on the GCP Memorystore for Redis to ensure only authorized clients can connect.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the Google Cloud Management Console. Navigate to the 'Memorystore for Redis' page
2. Under 'Instances', click on the reported instance.
3. Select 'EDIT' on the top navigation bar
4. Under 'Edit Redis instance' page, under 'Security', select the 'Enable AUTH' checkbox
5. Click on 'SAVE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-redis-instances-list' AND json.rule = state equal ignore case ready and authEnabled is false```
AWS EMR cluster Master Security Group allows all traffic to port 8088
This policy identifies AWS EMR cluster which has Master Security Group which allows all traffic to port 8088. Exposing port 8088 to all traffic exposes web interfaces of the master node of an EMR Cluster. This configuration is highly susceptible to EMR cluster hijacking attacks. It is highly recommended limiting the access for the EMR cluster attached Master Security Group to your IP only or configure SSH Tunnel.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Before making any changes, please check the impact to your applications/services.

1. Log in to the AWS Console
2. Select Clusters in left side pane
3. Select the EMR Cluster reported in the alert
4. Select the Security groups for Master link under Security and access
5. Choose ElasticMapReduce-master from the list 
6. Click on the 'Inbound Rule'
7. Delete the rule which has 'Source' value as 0.0.0.0/0 or ::/0 and 'Port Range' value as 8088 (or range containing 8088).

Query:
```config from cloud.resource where api.name = 'aws-emr-describe-cluster' AND json.rule = status.state does not contain TERMINATING as X; config from cloud.resource where api.name= 'aws-ec2-describe-security-groups' AND json.rule = isShared is false and (ipPermissions[?any((ipRanges[*] contains 0.0.0.0/0 or ipv6Ranges[*].cidrIpv6 contains ::/0) and ((toPort == 8088 or fromPort == 8088) or (toPort > 8088 and fromPort < 8088)))] exists) as Y; filter '$.X.ec2InstanceAttributes.emrManagedMasterSecurityGroup equals $.Y.groupId or $.X.ec2InstanceAttributes.additionalMasterSecurityGroups[*] contains $.Y.groupId'; show X;```
AWS API Gateway REST API not configured with AWS Web Application Firewall v2 (AWS WAFv2)
This policy identifies AWS API Gateway REST API which is not configured with AWS Web Application Firewall. As a best practice, enable the AWS WAF service on API Gateway REST API to protect against application layer attacks. To block malicious requests to your API Gateway REST API, define the block criteria in the WAF web access control list (web ACL).
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the AWS console
2. Make sure your the reported API Gateway REST API requires WAF based on your requirement and Note down the API Gateway REST API name

Follow steps given in below URL to associate API Gateway REST API to WAF Web ACL ,
https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.html.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-apigateway-get-stages' AND json.rule = webAclArn does not exist or webAclArn does not start with arn:aws:wafv2```
AWS Network Firewall delete protection is disabled
This policy identifies the AWS Network Firewall for which delete protection is disabled.

AWS Network Firewall manages inbound and outbound traffic for the AWS resources within Virtual Private Clouds (VPCs). The deletion protection setting protects against accidental deletion of the firewall. Deletion of a firewall increases the risk of unauthorized access, data breaches, and compliance issues. 

It is recommended to enable deletion protection for a network firewall to safeguard against accidental deletion.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To enable delete protection on an AWS Network Firewall, perform the following actions:

1. Log into the AWS console
2. Select the specific region from the drop-down in the top right corner for which the alert is generated
3. Navigate to VPC Dashboard
4. In the navigation pane, Under 'Network Firewall', choose 'Firewalls'
5. On the Firewalls page, select the reported firewall
6. In the 'Firewall details' tab, under the 'Change protections' section, click on 'Edit'
7. In the pop-up window, choose the 'Enable' checkbox under the 'Delete protection' option
8. Click on 'Save' to save the changes.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-networkfirewall-firewall' AND json.rule = FirewallStatus.Status equals READY and Firewall.DeleteProtection is false```
GCP VPC Flow logs for the subnet is set to Off
This policy identifies the subnets in VPC Network which have Flow logs disabled. Flow logs enable the capturing of information about the IP traffic going to and from network interfaces in VPC Subnets.  It is recommended to enable the flow logs which can be used for network monitoring, forensics, real-time security analysis.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to GCP Portal
2. Goto VPC Network (on Left Panel)
3. Select the reported VPC network and then click on the alerted subnet
4. On 'Subnet details' page, click on 'EDIT'
5. Set 'Flow Logs' to value 'On'
6. Click on 'SAVE'
For more information, refer : https://cloud.google.com/vpc/docs/using-flow-logs#enable-subnet.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-networks-subnets-list' AND json.rule = purpose does not contain INTERNAL_HTTPS_LOAD_BALANCER and purpose does not contain REGIONAL_MANAGED_PROXY and purpose does not contain GLOBAL_MANAGED_PROXY and purpose does not contain PRIVATE_SERVICE_CONNECT and (enableFlowLogs is false or enableFlowLogs does not exist)```
AWS IAM password policy does not have a lowercase character
Checks to ensure that IAM password policy requires a lowercase character. AWS IAM (Identity & Access Management) allows customers to secure AWS console access. As a security best practice, customers must have strong password policies in place.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['WEAK_PASSWORD'].
Mitigation of this issue can be done as follows: 1. Login to the AWS console and navigate to the 'IAM' service.
2. On the left navigation panel, Click on 'Account Settings'
3. check 'Require at least one lowercase letter'.
4. Click on 'Apply password policy'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or requireLowercaseCharacters is false or requireLowercaseCharacters does not exist'```