knarayan/cloud_posture_checks huggingface dataset:
Azure Virtual Desktop session host is not configured with managed identity
This policy identifies Virtual Desktop session hosts that are not configured with managed identity. Managed identity can be used to authenticate to any service that supports Azure AD authentication, without having credentials in your code. Storing credentials in a code increases the threat surface in case of exploitation and also managed identities eliminate the need for developers to manage credentials. So as a security best practice, it is recommended to have the managed identity to your Virtual Desktop session hosts.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Navigate to Virtual machines dashboard
3. Click on the reported Virtual machine
4. Under Setting section, Click on 'Identity'
5. Configure either 'System assigned' or 'User assigned' managed identity based on your requirement.
6. Click on 'Save'.

Query:
```config from cloud.resource where api.name = 'azure-virtual-desktop-session-host' AND json.rule = session-hosts[*] is not empty and session-hosts[*].properties.resourceId exists as X; config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = powerState equal ignore case "PowerState/running" as Y; filter '$.X.session-hosts[*].properties.resourceId equal ignore case $.Y.id and ($.Y.identity does not exist or $.Y.identity.type equal ignore case None)'; show Y;```
AWS Security Group allows all traffic on SSH port (22)
This policy identifies Security groups that allow all traffic on SSH port 22. Doing so, may allow a bad actor to brute force their way into the system and potentially get access to the entire network. Review your list of security group rules to ensure that your resources are not exposed. As a best practice, restrict SSH solely to known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Before making any changes, please check the impact to your applications/services. If the Security Group reported indeed need to restrict all traffic, follow the instructions below:
1. Log in to the AWS Console
2. Navigate to the 'VPC' service
3. Select the 'Security Group' reported in the alert
4. Click on the 'Inbound Rule'
5. Remove the rule which has 'Source' value as 0.0.0.0/0 or ::/0 and 'Port Range' value as 22 (or range containing 22).

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-ec2-describe-security-groups' AND json.rule = isShared is false and (ipPermissions[?any((ipRanges[*] contains 0.0.0.0/0 or ipv6Ranges[*].cidrIpv6 contains ::/0) and ((toPort == 22 or fromPort == 22) or (toPort > 22 and fromPort < 22)))] exists)```
Azure Activity log alert for Delete security solution does not exist
This policy identifies the Azure accounts in which activity log alert for Delete security solution does not exist. Creating an activity log alert for Delete security solution gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal
2. Click on Monitor (Left Panel)
3. Select 'Alerts'
4. Click on Create > Alert rule
5. In 'Create an alert rule' page, choose the Scope as your Subscription and under the CONDITION section, choose 'Delete Security Solutions (Microsoft.Security/securitySolutions)' and Other fields you can set based on your custom settings.
6. Click on Create.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Security/securitySolutions/delete" as X; count(X) less than 1```
AWS CloudTrail logging is disabled
This policy identifies the CloudTrails in which logging is disabled. AWS CloudTrail is a service that enables governance, compliance, operational & risk auditing of the AWS account. It is a compliance and security best practice to turn on logging for CloudTrail across different regions to get a complete audit trail of activities across various services.

NOTE: This policy will be triggered only when you have CloudTrail configured in your AWS account and logging is disabled.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to AWS Console
2. Navigate to CloudTrail dashboard
3. Click on 'Trails' (Left panel)
4. Click on reported CloudTrail
5. Enable 'Logging' by hovering logging button to 'ON'
OR
If CLoudTrail is not required you can delete by clicking on the delete icon below the logging hover button..

Query:
```config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as X; config from cloud.resource where api.name = 'aws-cloudtrail-get-trail-status' as Y; filter '$.X.name equals $.Y.trail and $.Y.status.isLogging is false'; show X;```
AWS Access key enabled on root account
This policy identifies root accounts for which access keys are enabled. Access keys are used to sign API requests to AWS. Root accounts have complete access to all your AWS services. If the access key for a root account is compromised, an unauthorized users will have complete access to your AWS account.
This is applicable to aws cloud and is considered a high severity issue.
Sample categories of findings relevant here are ['KEYS_AND_SECRETS'].
Mitigation of this issue can be done as follows: 1. Sign in to AWS Console as the root user.
2. Click root account name and on the top right select  'Security Credentials' from the dropdown.
3. For each key in 'Access Keys', click on "X" to delete the keys..

Query:
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-iam-get-account-summary' AND json.rule='not AccountAccessKeysPresent equals 0'```
IBM Cloud OpenShift cluster has Image pull secrets disabled
This policy identifies IBM Cloud OpenShift Clusters with image pull secrets disabled. If Image pull secrets feature Is disabled, it stores registry credentials to connect to container registry. It is recommended to enable image pull secrets feature, which will store an image pull secret for pulling images rather than using credentials.
This is applicable to ibm cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: To enable image pull secrets feature on a OpenShift cluster, refer 
following URLs:
https://cloud.ibm.com/docs/openshift?topic=openshift-registry#imagePullSecret_migrate_api_key
https://cloud.ibm.com/docs/openshift?topic=openshift-registry#update-pull-secret.

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-kubernetes-cluster' AND json.rule = type equal ignore case openshift and state equal ignore case normal and features.pullSecretApplied is false```
GCP SQL server instance database flag external scripts enabled is not set to off
This policy identifies GCP SQL server instances for which database flag 'external scripts enabled' is not set to off. Feature 'external scripts enabled' enables the execution of scripts with certain remote language extensions. When Advanced Analytics Services is installed, setup can optionally set this property to true. As the External Scripts Enabled feature allows scripts external to SQL such as files located in an R library to be executed, which could adversely affect the security of the system. It is recommended to set external scripts enabled database flag for Cloud SQL SQL Server instance to off.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to GCP console
2. Navigate SQL Instances page
3. Click on reported SQL server instance
4. Click on EDIT
5. If the flag has not been set on the instance, 
Under 'Customize your instance' section, go to 'Flags and parameters', click on 'ADD FLAG' in 'New database flag' section, choose the flag 'external scripts enabled' from the drop-down menu and set the value as 'off'
OR
If the flag has been set to other than off, Under 'Flags and parameters', choose the flag 'external scripts enabled' and set the value as 'off'
6. Click on DONE
7. Click on SAVE 
8. If 'Changes requires restart' pop-up appears, click on 'SAVE AND RESTART'.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = 'state equals RUNNABLE and databaseVersion contains SQLSERVER and (settings.databaseFlags[*].name does not contain "external scripts enabled" or settings.databaseFlags[?any(name contains "external scripts enabled" and value contains on)] exists)'```
Azure Network Security Group allows all traffic on Telnet (TCP Port 23)
This policy identifies Azure Network Security Groups (NSG) that allow all traffic on Telnet (TCP Port 23). Review your list of NSG rules to ensure that your resources are not exposed. As a best practice, restrict MySQL solely to known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Before making any changes, please check the impact to your applications/services. Evaluate whether you want to edit the rule and limit access to specific users, hosts, and services only, deny access, or delete the rule completely.

1. Log in to the Azure Portal
2. Select 'All services'
3. Select 'Network security groups', under Networking
4. Select the Network security group you need to modify
5. Select 'Inbound security rules' under Settings
6. Select the rule you need to modify, and edit it to allow specific IP addresses OR set the 'Action' to 'Deny' OR 'Delete' the rule based on your requirement.
7. 'Save' your changes.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and (protocol equals Tcp or protocol equals *) and (destinationPortRange contains _Port.inRange(23,23) or destinationPortRanges[*] contains _Port.inRange(23,23) ))] exists```
Azure Microsoft Defender for Cloud set to Off for Containers
This policy identifies Azure Microsoft Defender for Cloud which has defender setting for Containers set to Off. Enabling Azure Defender provides advanced security capabilities like providing threat intelligence, anomaly detection, and behavior analytics in the Azure Microsoft Defender for Cloud. It is highly recommended to enable Azure Defender for Containers.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Go to 'Microsoft Defender for Cloud'
3. Select 'Environment Settings'
4. Click on the subscription name
5. Select the 'Defender plans'
6. Select 'Enable all Microsoft Defender for Cloud plans' if not already enabled
7. On the line in the table for 'Containers' Select 'On' under Plan.
8. Select 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any(name equals Containers and properties.pricingTier does not equal Standard)] exists```
Azure Function App doesn't have a Managed Service Identity
This policy identifies Azure Function App which doesn't have a Managed Service Identity. Managed service identity in Function App makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need of username and passwords.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Navigate to Function App
3. Click on the reported Function App
4. Under Setting section, Click on 'Identity'
5. Configure either 'System-assigned' or 'User-assigned' managed identity based on your requirement.
6. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case "Running" AND kind contains "functionapp" AND kind does not contain "workflowapp" AND kind does not equal "app" AND (identity.type does not exist or identity.principalId is empty)```
gvCopy of Azure AD Users can consent to apps accessing company data on their behalf is enabled
This policy identifies Azure Active Directory which have 'Users can consent to apps accessing company data on their behalf' configuration enabled. User profiles contain private information which could be shared with others without requiring any further consent from the user if this configuration is enabled. It is recommended not to allow users to use their identity outside of the cloud environment.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Login to Azure portal.
2. Navigate to 'Azure Active Directory'
3. Select 'Users' under 'Manage'
4. Go to 'User settings'
5. Click on 'Manage how end users launch and view their applications' if not selected
6. Under 'Enterprise applications' select 'No' for 'Users can consent to apps accessing company data on their behalf'
7. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-active-directory-authorization-policy' AND json.rule = defaultUserRolePermissions.permissionGrantPoliciesAssigned[*] contains microsoft-user-default-legacy```
GCP VM instance with the external IP address
This policy identifies GCP VM instances that are assigned a public IP.

Using a public IP with a GCP VM exposes it directly to the internet, increasing the risk of unauthorized access and attacks. This makes the VM vulnerable to threats such as brute force attempts, DDoS attacks, and other malicious activities. To mitigate these risks, it is safer to use private IPs and secure access methods like VPNs or load balancers.

It is recommended to avoid assigning public IPs to VM instances.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the GCP console
2. Navigate to 'Compute Engine' and then 'VM instances'
3. Click on the reported VM instance
4. Stop the VM by clicking on the 'STOP' button. Click the 'STOP' button on the confirmation dialogue
5. Once the the VM has been stopped, click on the 'EDIT' button
6. Under 'Network interfaces', expand the network interface with the public external IP assigned
7. Select 'IPv4 (single-stack)' under IP stack type
8. Select 'None' under 'External IPv4 address'
9. Click on 'Save'
10. Click on 'START/RESUME' from the top menu.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = name does not start with "gke-" and status equals RUNNING and (networkInterfaces[*].accessConfigs exists or networkInterfaces.ipv6AccessConfigs exists)```
AWS Elasticsearch domain publicly accessible
This policy identifies Elasticsearch domains which are publicly accessible. Enabling VPCs for Elasticsearch domains provides flexibility and control over the clusters access with an extra layer of security than Elasticsearch domains that use public endpoints. It also keeps all traffic between your VPC and Elasticsearch domains within the AWS network instead of going over the public Internet.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['INTERNET_EXPOSURE'].
Mitigation of this issue can be done as follows: VPC for AWS Elasticsearch domain can be set only at the time of the creation of domain. So to resolve this alert, create a new domain with VPC, then migrate all required Elasticsearch domain data from the reported Elasticsearch domain to this newly created domain and delete reported Elasticsearch domain.

To set up the new ES domain with VPC, refer the following URL:
https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createupdatedomains.html
To create Elasticsearch domain within VPC, In Network configuration choose VPC access instead of Public access.

To delete reported ES domain, refer the following URL:
https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-gsg-deleting.html.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-es-describe-elasticsearch-domain' AND json.rule = processing is false and vpcoptions.vpcid does not exist```
AWS EBS Snapshot with access for unmonitored cloud accounts
This policy identifies EBS Snapshot with access for unmonitored cloud accounts.The EBS Snapshots which have either the read / write permission opened up for Cloud Accounts which are NOT part of Cloud Accounts monitored by Prisma Cloud. These accounts with read / write privileges should be reviewed and confirmed that these are valid accounts of your organisation (or authorised by your organisation) and are not active under Prisma Cloud monitoring.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS console.
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated.
3. Access the EC2 service, navigate to 'Snapshots' under 'Elastic Block Store' in left hand menu.
4. Select the identified 'EBS Snapshot' and select the tab 'Permissions'.
5. Review and delete the AWS Accounts which should not have read access..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-snapshots' AND json.rule = 'snapshot.state equals completed and createVolumePermissions[*].userId size != 0 and _AWSCloudAccount.isRedLockMonitored($.createVolumePermissions[*].userId) is false'```
Alibaba Cloud OSS bucket accessible to public
This policy identifies Object Storage Service (OSS) buckets which are publicly accessible. Alibaba Cloud OSS allows customers to store and retrieve any type of content from anywhere on the web. Often, customers have legitimate reasons to expose the OSS bucket to the public, for example, to host website content. However, these buckets often contain highly sensitive enterprise data which if left open to the public may result in sensitive data leaks.
This is applicable to alibaba_cloud cloud and is considered a high severity issue.
Sample categories of findings relevant here are ['INTERNET_EXPOSURE'].
Mitigation of this issue can be done as follows: 1. Log in to Alibaba Cloud Portal
2. Go to Object Storage Service
3. In the left-side navigation pane, click on the reported bucket
4. In the 'Basic Settings' tab, In the 'Access Control List (ACL)' Section, Click on 'Configure'
5. For 'Bucket ACL' field, Choose 'Private' option
6. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-oss-bucket-info' AND json.rule =  'cannedACL equals PublicRead or cannedACL equals PublicReadWrite'```
Alibaba Cloud ECS instance release protection is disabled
This policy identifies ECS instances for which release protection is disabled. Enabling release protection for these ECS instances prevents irreversible data loss resulting from accidental or malicious operations.
Note: This attribute applies to Pay-As-You-Go instances only. Release protection can only restrict the manual release operation and does not apply for release operation done by Alibaba Cloud.
This is applicable to alibaba_cloud cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to Alibaba Cloud Portal
2. Go to Elastic Compute Service
3. In the left-side navigation pane, click 'Instances'
4. Select the reported ECS instance, select More -> Instance Settings -> Change Release Protection Setting -> Release Protection (Toggle to enable)
5. Click on 'OK'.

Query:
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-instance' AND json.rule = status equals Running and instanceChargeType equals PostPaid and deletionProtection is false```
aws-test-policy

This is applicable to aws cloud and is considered a high severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-get-policy-version' AND json.rule = isAttached is true and document.Statement[?any(Effect equals Allow and (Action contains iam:CreatePolicyVersion or Action contains iam:SetDefaultPolicyVersion or Action contains iam:PassRole or Action contains iam:CreateAccessKey or Action contains iam:CreateLoginProfile or Action contains iam:UpdateLoginProfile or Action contains iam:AttachUserPolicy or Action contains iam:AttachGroupPolicy or Action contains iam:AttachRolePolicy or Action contains iam:PutUserPolicy or Action contains iam:PutGroupPolicy or Action contains iam:PutRolePolicy or Action contains iam:AddUserToGroup or Action contains iam:UpdateAssumeRolePolicy or Action contains iam:*))] exists```
OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK)
This policy identifies the OCI Block Storage Volumes that are not encrypted with a Customer Managed Key (CMK). It is recommended that Block Storage Volumes should be encrypted with a Customer Managed Key (CMK), using  Customer Managed Key (CMK), provides an additional level of security on your data by allowing you to manage your own encryption key lifecycle management for the Block Storage Volume.
This is applicable to oci cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the resource reported in the alert into the Search box at the top of the Console.
3. Click the resource reported in the alert from the Resources submenu
4. Click Assign next to Encryption Key: Oracle managed key.
5. Select a Vault from the appropriate compartment
6. Select a Master Encryption Key
7. Click Assign.

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-block-storage-volume' AND json.rule = kmsKeyId is member of ("null")```