knarayan/cloud_posture_checks huggingface dataset:
AWS MFA is not enabled on Root account
This policy identifies root account which has MFA enabled. Root accounts have privileged access to all AWS services. Without MFA, if the root credentials are compromised, unauthorized users will get full access to your account.

NOTE: This policy does not apply to AWS GovCloud Accounts. As you cannot enable an MFA device for AWS GovCloud (US) account root user. For more details refer: https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-console.html
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MFA'].
Mitigation of this issue can be done as follows: 1. Sign in to the 'AWS Console' using Root credentials.
2. Navigate to the 'IAM' service.
3. On the dashboard, click on 'Activate MFA on your root account', click on 'Manage MFA' and follow the steps to configure MFA for the root account..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-credential-report' AND json.rule = 'user equals "<root_account>" and mfa_active is false and arn does not contain gov:'```
GCP Firewall with Inbound rule overly permissive to All Traffic
This policy identifies GCP Firewall rules which allows inbound traffic on all protocols from public internet. Doing so, may allow a bad actor to brute force their way into the system and potentially get access to the entire network.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: If the Firewall rule reported indeed need to restrict all traffic, follow the instructions below:
1. Login to GCP Console
2. Go to VPC Network
3. Go to the Firewall rules
4. Click on the reported Firewall rule
5. Click Edit
6. Modify Source IP ranges to specific IP and modify Protocols and ports to specific protocol and port
7. Click Save.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name='gcloud-compute-firewall-rules-list' AND json.rule= disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(IPProtocol equals "all")] exists```
Azure Function App client certificate is disabled
This policy identifies Azure Function App which are not set with client certificate. Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Navigate to Function App
3. Click on the reported Function App
4. Under Setting section, Click on 'Configuration'
5. Under 'General Settings' tab, In 'Incoming client certificates', Set 'Client certificate mode' to Require
6. Click on 'Save'

If Function App Hosted in Linux using Consumption (Serverless) Plan follow below steps
Azure CLI Command - \"az functionapp update --set clientCertEnabled=true --name MyFunctionApp --resource-group MyResourceGroup\".

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case "Running" AND kind contains "functionapp" AND kind does not contain "workflowapp" AND kind does not equal "app" AND properties.clientCertEnabled is false```
Azure Microsoft Defender for Cloud is set to Off for Storage
This policy identifies Azure Microsoft Defender for Cloud (previously known as Azure Security Center and Azure Defender) which has defender setting for Storage is set to Off. Enabling Microsoft Defender for Cloud provides the tools needed to harden your resources, track your security posture, protect against cyberattacks, and streamline security management. It is highly recommended to enable Microsoft Defender for Storage.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Go to 'Microsoft Defender for Cloud'
3. Select 'Environment Settings'
4. Click on the subscription name
5. Select the 'Defender plans'
6. Select 'Enable all Microsoft Defender for Cloud plans' if not already enabled
7. On the line in the table for 'Storage' Select 'On' under Plan.
8. Select 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any( name equals StorageAccounts and properties.pricingTier does not equal Standard)] exists```
Azure Virtual Desktop disk encryption not configured with Customer Managed Key (CMK)
This policy identifies Azure Virtual Desktop environments where disk encryption is not configured using a Customer Managed Key (CMK). 

Disk encryption is crucial for protecting data in Azure Virtual Desktop environments. By default, disks may be encrypted with Microsoft-managed keys, which might not meet specific security requirements. Using Customer Managed Keys (CMKs) offers better control over encryption, allowing organizations to manage key rotation, access, and revocation, thereby enhancing data security and compliance.

As a best practice, it is recommended to configure disk encryption for Azure Virtual Desktop with a Customer Managed Key (CMK).
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Note: To enable disk encryption on any disks attached to a VM, you must first stop the VM.

1. Log in to Azure Portal and search for 'Disks'.
2. Select 'Disks'.
4. Select the reported disk.
5. Under 'Settings' select 'Encryption'.
6. For 'Key management', select 'Customer-managed key' from drop-down list.
6. For the disk encryption set, select an existing one. If none are available, create a new disk encryption set.
7. Click on 'Save'..

Query:
```config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = ['Extensions'].['Microsoft.PowerShell.DSC'].['settings'].['properties'].['hostPoolName'] exists and powerState contains running as X; config from cloud.resource where api.name = 'azure-disk-list' AND json.rule = provisioningState equal ignore case Succeeded and (encryption.type does not contain "EncryptionAtRestWithCustomerKey" or encryption.diskEncryptionSetId does not exist) as Y; filter ' $.X.id equal ignore case $.Y.managedBy '; show Y;```
IBM Cloud data disk is not encrypted with customer managed key
This policy identifies IBM Cloud data storage volumes attached to a virtual server instance which are not encrypted with customer managed keys. As a best practice, use customer managed keys to encrypt the data and maintain control of your keys and sensitive data.
This is applicable to ibm cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: A storage volume can be encrypted with customer managed keys only at the time of creation. Please
create a snapshot following below url:
https://cloud.ibm.com/docs/vpc?topic=vpc-snapshots-vpc-create&interface=ui#snapshots-vpc-create-from-vol-details

Please create a storage volume from the above created snapshot with customer managed encryption:
1. Log in to the IBM Cloud Console
2. Click on 'Menu Icon' and navigate to 'VPC Infrastructure' and then 'Virtual server instance'
3. From the list, click on the name of an instance. The instance must be in a Running state.
4. On the Instance details page, scroll to the list of Storage volumes and click 'Attach'.
    A side panel opens for you to define the volume attachment.
5. From the Attach data volume panel, expand the list of Block volumes and select 'Create a data volume'.
6. Select 'Import from snapshot'. Expand the Snapshot list and select a snapshot.
7. Optionally, increase the size of the volume within the specified range.
8. Under 'Encryption' section, select either 'Key protect' or 'Hyper Protect Crypto Services'.
9. Under 'Encryption service instance' and 'Key name', select the instance and key to be used for encryption.
10.Click Save. The side panel closes and messages indicate that the restored volume is being attached to the instance.

Please delete reported data disk following below url:
https://cloud.ibm.com/docs/vpc?topic=vpc-managing-block-storage&interface=ui#delete.

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-block-storage-volume' AND json.rule = volume_attachments[*] size greater than 0 and volume_attachments[*].type equals data and encryption equal ignore case provider_managed```
Azure VM OS disk is not configured with any encryption
This policy identifies VM OS disks that are not configured with any encryption. Azure encrypts OS disks that are not configured with any encryption. Azure offers Server-Side Encryption (SSE) with platform-managed keys [SSE with PMK] by default for managed disks. It is recommended to enable default encryption or you may optionally choose to use a customer-managed key to protect from malicious activity.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure Portal
2. Navigate to 'Disks'
3. Select the reported OS disk you want to modify
4. Select 'Encryption' under 'Settings'
5. Select 'Encryption Type' according to your encryption requirement.
6. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-disk-list' and json.rule = osType exists and managedBy exists and (encryptionSettings does not exist or encryptionSettings.enabled is false) and encryption.type is not member of ("EncryptionAtRestWithCustomerKey","EncryptionAtRestWithPlatformAndCustomerKeys","EncryptionAtRestWithPlatformKey")```
jScheel Wireguard instance allows ANY toPort on 51820
Wireguard instance allows ANY toPort on 51820
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'aws' AND cloud.account = 'jScheel AWS Account' AND api.name = 'aws-ec2-describe-instances' as X; config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[?any( toPort equals 51820 and ipRanges[*] contains "0/0" )] exists as Y; config from cloud.resource where api.name = 'aws-ec2-describe-route-tables' AND json.rule = routes[?any( state equals active and gatewayId contains "igw" and destinationCidrBlock contains "0/0" )] exists as Z; filter ' $.X.securityGroups[*].groupId == $.Y.groupId and $.X.subnetId == $.Z.associations[*].subnetId'; show Z;```
AWS Elastic File System (EFS) with encryption for data at rest is disabled
This policy identifies Elastic File Systems (EFSs) for which encryption for data at rest is disabled. It is highly recommended to implement at-rest encryption in order to prevent unauthorized users from reading sensitive data saved to EFSs.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: AWS EFS Encryption of data at rest can only be enabled during file system creation. So to resolve this alert, create a new EFS with encryption enabled, then migrate all required file data from the reported EFS to this newly created EFS and delete reported EFS.

To create a new EFS with encryption enabled, perform the following:
1. Sign in to the AWS console
2. In the console, select the specific region from the region drop-down on the top right corner, for which the alert is generated
3. Navigate to the EFS dashboard
4. Click on 'File systems' (Left Panel)
5. Click on the 'Create file system' button
6. On the 'Create file system' pop-up window, 
7. Click on 'Customize' button to replicate the configurations of alerted file system as required
8. Ensure 'Enable encryption of data at rest' is selected
9. On the 'Review and create' step, Review all your setting and click on the 'Create' button

To delete reported EFS which does not has encryption, perform the following:
1. Sign in to the AWS console
2. In the console, select the specific region from the region drop-down on the top right corner, for which the alert is generated
3. Navigate to the EFS dashboard
4. Click on 'File systems' (Left Panel)
5. Select the reported file system
6. Click on 'Delete' button
7. In the 'Delete file system' popup box, To confirm the deletion enter the file system's ID and Click on 'Confirm'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-describe-mount-targets' AND json.rule = 'fileSystemDescription.encrypted is false'```
API automation policy buecs

This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = "aws-ec2-describe-instances" AND json.rule = architecture contains "foo"```
OCI Event Rule and Notification does not exist for user changes
This policy identifies the OCI compartments which do not have an Event Rule and Notification that gets triggered for IAM User changes. Monitoring and alerting on changes to IAM User will help in identifying changes to the security posture. It is recommended that a Event Rule and Notification be configured to catch changes made to Identity and Access Management (IAM) Users.
NOTE: 
1. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.
2. This policy will trigger alert if you have at least one Event Rule and Notification, even if OCI has single or multi compartments.
This is applicable to oci cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the Event into the Search box at the top of the Console.
3. Click the Event Service from the Services submenu
4. Select the compartment that should host the rule
5. Click Create Rule
6. Provide a Display Name and Description
7. Create a Rule Condition by selecting Identity in the Service Name Drop-down and selecting: User – Create, User – Delete, User – Update, User Capabilities – Update, User State – Update
8. In the Actions section select Notifications as Action Type
9. Select the Compartment that hosts the Topic to be used.
10. Select the Topic to be used
11. Optionally add Tags to the Rule
12. Click Create Rule.

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.identitycontrolplane.createuser and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.deleteuser and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateuser and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateusercapabilities and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateuserstate) and actions.actions[*].topicId exists' as X; count(X) less than 1```
Azure Container Registry using the deprecated classic registry
This policy identifies an Azure Container Registry (ACR) that is using the classic SKU. The initial release of the Azure Container Registry (ACR) service that was offered as a classic SKU is being deprecated and will be unavailable after April 2019. As a best practice, upgrade your existing classic registry to a managed registry.

For more information, visit https://docs.microsoft.com/en-us/azure/container-registry/container-registry-upgrade
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal.
2. Select 'All services' > 'Container Registries'
3. Select the container registry you need to modify.
4. Select 'Upgrade to managed registry'.
5. Select 'OK' to confirm the upgrade..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-container-registry' AND json.rule =  skuName contains "Classic"```
AWS IAM password policy allows password reuse
This policy identifies IAM policies which allow password reuse . AWS IAM (Identity & Access Management) allows customers to secure AWS console access. As a security best practice, customers must have strong password policies in place.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['WEAK_PASSWORD'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS console and navigate to the 'IAM' service.
2. Click on 'Account Settings', check  'Prevent password reuse'..

Query:
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or passwordReusePrevention equals null or passwordReusePrevention !isType Integer or passwordReusePrevention < 1'```
IBM Cloud VPC ACL allow ingress rule from 0.0.0.0/0 to SSH port
This policy identifies IBM Cloud VPC Access Control List which are having ingress rule that allows traffic from 0.0.0.0/0 to SSH port. Doing so, may allow a bad actor to brute force their way into the system and potentially get access to the entire network. It is recommended to review VPC ACL rules to ensure that your resources are not exposed. As a best practice, restrict SSH solely to known static IP addresses.
This is applicable to ibm cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: Before making any changes, please check the impact to your applications/services. If the VPC ACL reported indeed need to restrict all traffic, follow the instructions below:
1. Log in to the IBM Cloud Console
2. Click on 'Menu Icon' and navigate to 'VPC Infrastructure' and then 'Access Control Lists'
3. Select the 'Access Control Lists' reported in the alert
4. Under 'Inbound rules'
5. Click on three dots on the right corner of a row containing rule that has a port range value of ALL or a port range that includes port 22 and has a Source of 0.0.0.0/0
6. Click on 'Delete'.

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-network-acl' AND json.rule = rules[?any( source equals "0.0.0.0/0" and direction equals "inbound" and action equals "allow" and ( (protocol equals "tcp" and (( destination_port_max greater than 22 and destination_port_min less than 22 ) or ( destination_port_max equals 22 and destination_port_min equals 22 ))) or protocol equals "all" ))] exists```
OCI IAM policy with full administrative privileges across the tenancy to non Administrator
This policy identifies IAM policies with full administrative privileges across the tenancy to non Administrators. IAM policies are the means by which privileges are granted to users, groups, or services. It is recommended to practice the Principle of least privilege, which limits users' access rights to strictly required to do their jobs.
This is applicable to oci cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['PRIVILEGE_ESCALATION'].
Mitigation of this issue can be done as follows: 1. Log in to OCI console
2. Go to Identity -> Policies
3. In the compartment dropdown, choose the root compartment. Open the reported policy to view the policy statement.
4. Remove policy statement that allows any group other than Administrators or any service access to manage all resources in the tenancy..

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-iam-policy' AND json.rule = lifecycleState equals ACTIVE and (statements[*] contains "to manage all-resources in tenancy" or statements[*] contains "to manage all-resources IN TENANCY") and name does not contain "Tenant Admin Policy"```
Azure Container Registry does not use a dedicated resource group
Placing your Azure Container Registry (ACR) in a dedicated Azure resource group, allows you to minimize the risk of accidentally deleting the collection of images in the registry when you delete the container instance resource group.
This policy identifies ACRs that reside in resource groups that contains non-ACR resources. For more information about ACR best practices, visit https://docs.microsoft.com/en-us/azure/container-registry/container-registry-best-practices
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To remediate this alert, move all non-ACR resources to another resource group. To move resources to another resource group follow below URL:
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription.

Query:
```config from cloud.resource where cloud.type='azure' and api.name= 'azure-container-registry'   as X; config from cloud.resource where api.name = 'azure-resource-group' as Y; filter ' $.X.resourceGroupName equals $.Y.name and $.Y.isDedicatedContainerRegistryGroup is false' ; show X;```
Azure App service HTTP logging is disabled
This policy identifies Azure App services that have HTTP logging disabled. 

By enabling HTTP logging for your app service, you can collect log information and use it to monitor and troubleshoot your app, as well as identify any potential security issues or threats. This can help to ensure that your app is running smoothly and is secure from potential attacks. 

As best practice, it is recommended to enable HTTP logging on your app service.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal
2. Go to App Services dashboard
3. Click on the reported App service
4. Under the 'Monitoring' menu, click on 'App Service logs'
5. Under 'Web server logging', select Storage to store logs on blob storage, or File System to store logs on the App Service file system.
6. In Retention Period (Days), set the number of days the logs should be retained.
7. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case Running and config.httpLoggingEnabled exists and config.httpLoggingEnabled is false```
Azure 'Notify about alerts with the following severity' is Set to 'High'

This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-defender-for-cloud-security-contact' AND json.rule = properties.alertNotifications.state does not equal ignore case ON and properties.alertNotifications.minimalSeverity equal ignore case High```