knarayan/cloud_posture_checks huggingface dataset:
Low of AWS S3 bucket publicly readable
This policy identifies the S3 buckets that are publicly readable by Get/Read/List bucket operations. These permissions permit anyone, malicious or not, to Get/Read/List bucket operations on your S3 bucket if they can guess the namespace. S3 service does not protect the namespace if ACLs and Bucket policy is not handled properly, with this configuration you may be at risk of compromise of critical data by leaving S3 public.

For more details:
https://docs.aws.amazon.com/AmazonS3/latest/user-guide/set-permissions.html
https://docs.aws.amazon.com/AmazonS3/latest/dev/about-object-ownership.html#ensure-object-ownership 
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Log in to the AWS Console
2. Navigate to the 'S3' service
3. Click on the S3 resource reported in the alert
4. Click on the 'Permissions' tab
5. If Access Control List is set to 'Public' follow the below steps
a. Under 'Access Control List', Click on 'Everyone' and uncheck all items
b. Click on Save changes
6. If 'Bucket Policy' is set to public follow the below steps
a. Under 'Bucket Policy', Select 'Edit Bucket Policy' and consider defining what explicit 'Principal' should have the ability to GET/LIST objects in your S3 bucket. You may also want to specifically limit the 'Principal' ability to perform specific GET/LIST functions, without the wild card.
If 'Bucket Policy' is not required delete the existing 'Bucket Policy'.
b. Click on Save changes

Note: Make sure updating 'Access Control List' or 'Bucket Policy' does not affect S3 bucket data access..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = ((((publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false) or (publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false)) and acl.grantsAsList[?any(grantee equals AllUsers and permission is member of (ReadAcp,Read,FullControl))] exists) or ((policyStatus.isPublic is true and ((publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false) or (publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false))) and (policy.Statement[?any(Effect equals Allow and (Principal equals * or Principal.AWS equals *) and (Action contains s3:* or Action contains s3:Get or Action contains s3:List) and (Condition does not exist))] exists))) and websiteConfiguration does not exist```
GCP Cloud ' Access Approval' is not enabled

This is applicable to gcp cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = 'gcloud-access-approval-project-approval-setting' AND json.rule = enrolledServices[*].cloudProduct does not equal "all"```
aws glue shadow
sdcsc
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = 'aws-glue-job' AND json.rule = Command.BucketName exists and Command.BucketName contains "aws-glue-assets-" as X; config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' AND json.rule = bucketName contains "aws-glue-assets-" as Y; filter 'not ($.X.Command.BucketName equals $.Y.bucketName)' ; show X;```
Azure Network Security Group allows all traffic on RDP Port 3389
This policy identifies any NSG rule that allow all traffic on RDP port 3389. Review your list of NSG rules to ensure that your resources are not exposed. As a best practice, restrict RDP solely to known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Before making any changes, please check the impact to your applications/services. Evaluate whether you want to edit the rule and limit access to specific users, hosts, and services only, deny access, or delete the rule completely.

1. Log in to the Azure Portal.
2. Select 'All services'.
3. Select 'Network security groups', under NETWORKING.
4. Select the Network security group you need to modify.
5. Select 'Inbound security rules' under Settings.
6. Select the rule you need to modify, and edit it to allow specific IP addresses OR set the 'Action' to 'Deny' OR 'Delete' the rule based on your requirement.
7. 'Save' your changes..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and (destinationPortRange contains _Port.inRange(3389,3389) or destinationPortRanges[*] contains _Port.inRange(3389,3389) ))] exists```
IBM Cloud Object Storage bucket is not enabled with IBM Activity Tracker
This policy identifies IBM Cloud Object Storage buckets which have Activity Tracker disabled or not enabled properly. The IBM Cloud Activity Tracker service records user-initiated activities that change the state of a service in IBM Cloud. You can use this service to investigate abnormal activity and critical actions, and to comply with regulatory audit requirements. In addition, you can be alerted about actions as they happen. So, it is recommended to enable Activity tracker to log all read/write data and management events on a bucket.
This is applicable to ibm cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: To configure Activity Tracker on a Cloud Object Storage bucket, please follow the below URL.
Please make sure to select 'Track data events' checkbox and select 'read & write' option 
from the Activity Tracker dropdown:
https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-at#at-console-enable.

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-object-storage-bucket' AND json.rule = activity_tracking does not exist or activity_tracking.write_data_events does not equal ignore case "true" or activity_tracking.read_data_events does not equal ignore case "true"```
GCP Cloud Function not enabled with VPC connector
This policy identifies GCP Cloud Functions that are not configured with a VPC connector. VPC connector helps function to connect to a resource inside a VPC in the same project. Setting up the VPC connector allows you to set up a secure perimeter to guard against data exfiltration and prevent functions from accidentally sending any data to unwanted destinations. It is recommended to configure the GCP Cloud Function with a VPC connector.

Note: For the Cloud Functions function to access the public traffic with Serverless VPC connector, you have to introduce Cloud NAT.
Link: https://cloud.google.com/functions/docs/networking/network-settings#route-egress-to-vpc
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to GCP console
2. Navigate to 'Cloud Functions' service (Left Panel)
3. Click on the alerting function
4. Click on 'EDIT'
5. Click on 'Runtime, build, connections and security settings’ drop-down to get the detailed view
6. Click on the 'CONNECTIONS' tab
7. Under Section 'Egress settings', select a VPC connector from the dropdown
8. In case VPC connector is not available, select 'Custom' and
9. Click on 'Create a Serverless VPC Connector', follow the link to create a Serverless VPC connector: https://cloud.google.com/vpc/docs/configure-serverless-vpc-access
10. Once the Serverless VPC connector is available, select it from the dropdown
11. Click on 'NEXT'
12. Click on 'DEPLOY'.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-cloud-function' AND json.rule = status equals ACTIVE and vpcConnector does not exist```
Azure Container Registry with repository scoped access token enabled
This policy identifies Azure Container Registries having repository scoped access tokens enabled.

Disable repository-scoped access tokens for your registry to prevent access via tokens. Enhancing security involves disabling local authentication methods, including admin user, repository-scoped access tokens, and anonymous pull. This ensures that container registries rely solely on Microsoft Entra ID identities for authentication.

As a security best practice, it is recommended to disable repository scoped access token for Azure Container Registries.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to your Azure portal 
2. Navigate to 'Container registries' 
3. Select the reported Container Registry 
4. Under 'Repository permissions' select 'Tokens'
5. Click on the active token and make it inactive by unchecking the 'Active status'
6. Click on 'Save'
7. Repeat step 5 & 6 for all the active tokens.

Query:
```config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-container-registry' AND json.rule = properties.provisioningState equal ignore case Succeeded and tokens[?any( properties.status contains enabled )] exists```
OCI Network Security Group allows all traffic on RDP port (3389)
This policy identifies OCI Security groups that allow unrestricted ingress access to port 3389. It is recommended that no security group allows unrestricted ingress access to port 3389. As a best practice, remove unfettered connectivity to remote console services, such as Remote Desktop Protocol (RDP), to reduce server's exposure to risk.
This is applicable to oci cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the resource reported in the alert into the Search box at the top of the Console.
3. Click the resource reported in the alert from the Resources submenu
4. Under Resources, click Security Rules
5. If you want to add a rule, click Add Rules
6. If you want to delete an existing rule, click the Actions icon (three dots), and then click Remove.
7. If you wanted to edit an existing rule, click the Actions icon (three dots), and then click Edit..

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-nsg' AND json.rule = (securityRules[?any((((*.destinationPortRange.min == 3389 or *.destinationPortRange.max == 3389) or (*.destinationPortRange.min < 3389 and *.destinationPortRange.max > 3389)) or (protocol equals "all") or ((tcpOptions does not exist) and (udpOptions does not exist) and (protocol does not equal 1))) and (source equals 0.0.0.0/0 and direction equals INGRESS))] exists)```
IBM Cloud Access group with members having administrator role permission for All Identity and Access enabled services
This policy identifies IBM Cloud Access groups, which have administrator role permission across all Identity and Access enabled services policy with users, service IDs, or trusted profiles. This would allow all members of this group to have administrative privileges. As a security best practice, it is recommended to grant the least privileged access, such as granting only the permissions required to perform a task, instead of providing excessive permissions.
This is applicable to ibm cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Log in to the IBM Cloud console.
2. In the IBM Cloud console, click 'Manage' on the title bar > 'Access (IAM)', click on 'Access groups' in the left panel.
3. Select the access group which is reported in the alert.
4. Review and remove Users/Service IDs/Trusted profiles from the access group.
Refer below link for removing the Member from the access group:
https://cloud.ibm.com/docs/account?topic=account-assign-access-resources&interface=ui#removing-access-console
OR
To remove the overly permissible policy from the access group:
1. Go to 'Access' tab and click on three dots on the right corner of a row for the policy which is having administrator permission on 'All Identity and Access enabled services'.
2. Click on Remove OR Edit to assign limited permission to the policy.
3. Review the policy details that you're about to Edit/Remove, and confirm by clicking Save/Remove..

Query:
```config from cloud.resource where api.name = 'ibm-iam-policy' AND json.rule = type equal ignore case "access" and roles[?any( role_id contains "crn:v1:bluemix:public:iam::::role:Administrator" )] exists and resources[?any(tags does not exist and attributes[?any( value equal ignore case "service" and name equal ignore case "serviceType" and operator is member of ("stringEquals", "stringMatch"))] exists and attributes[?any( name equal ignore case "region")] does not exist )] exists and subjects[?any( attributes[?any( name contains "access_group_id")] exists )] exists as X; config from cloud.resource where api.name = 'ibm-iam-access-group-member' as Y; config from cloud.resource where api.name = 'ibm-iam-access-group' as Z; filter '$.X.subjects[*].attributes[*].value contains $.Y.access_group.id and $.Y.access_group.id equal ignore case $.Z.id'; show Z;```
Azure Guest User Invite not restricted to users with specific admin role
This policy identifies instances in the Microsoft Entra ID configuration where guest user invitations are not restricted to specific administrative roles.

Allowing anyone in the organization, including guests and non-admins, to invite guest users can lead to unauthorized access and potential data breaches. This unrestricted access poses a significant security risk.

As a best practice, it is recommended to configure guest user invites to specific admin roles. This will ensure that only authorized personnel can invite guests, maintaining tighter control over access to cloud resources.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal and search for 'Microsoft Entra ID'
2. Select 'Microsoft Entra ID'
3. Under 'Manage' select 'External Identities'
4. Select 'External collaboration settings'
5. Under 'Guest invite settings' section, select 'Only users assigned to specific admin roles can invite guest users'
6. Select 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-active-directory-authorization-policy' AND json.rule = not (allowInvitesFrom equal ignore case adminsAndGuestInviters OR allowInvitesFrom equal ignore case none)```
Azure Virtual Machine (Linux) does not authenticate using SSH keys
This policy identifies Azure Virtual Machines that have basic authentication, not authenticating using SSH keys. Azure Virtual Machines with basic authentication could allow attackers to brute force and gain unauthorized access, which might lead to potential data leaks. It is recommended to use SSH keys for authentication to avoid brute force attacks on virtual machines.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To configure existing Azure Virtual machine with SSH key authentication, Follow below URL:
https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/vmaccess#update-ssh-key

If changes are not reflecting you may need to take backup, You may need to create new virtual machine with SSH key based authentication and delete the reported virtual machine..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-vm-list' AND json.rule = powerState equal ignore case "PowerState/running" and (['properties.osProfile'].['linuxConfiguration'] exists and ['properties.osProfile'].['linuxConfiguration'].['disablePasswordAuthentication'] is false)```
dnd_test_add_remove_child_policy_hyperion_policy_ss_finding_2
Description-e736aef6-4ad4-4324-9b5b-75dd70620202
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['SSH_BRUTE_FORCE'].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = defaultRootObject is empty```
Alibaba Cloud ActionTrail log OSS bucket is publicly accessible
This policy identifies Object Storage Service (OSS) buckets which are publicly accessible and stores ActionTrail log data. These buckets contain sensitive audit data and only authorized users and applications should have access. As a best practice, make OSS buckets private which stores ActionTrail log data and only authorized user should have access.
This is applicable to alibaba_cloud cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['INTERNET_EXPOSURE'].
Mitigation of this issue can be done as follows: 1. Log in to Alibaba Cloud Portal
2. Go to Object Storage Service
3. In the left-side navigation pane, click on the reported bucket
4. In the 'Basic Settings' tab, In the 'Access Control List (ACL)' Section, Click on 'Configure'
5. For 'Bucket ACL' field, Choose 'Private' option
6. Click on 'Save'.

Query:
```config from cloud.resource where api.name = 'alibaba-cloud-action-trail' as X; config from cloud.resource where api.name = 'alibaba-cloud-oss-bucket-info' as Y; filter '$.X.isLogging is true and $.X.ossBucketName equals $.Y.bucket.name and $.Y.cannedACL does not contain Private'; show Y;```
AWS S3 CloudTrail bucket for which access logging is disabled
This policy identifies S3 CloudTrail buckets for which access is disabled. S3 Bucket access logging generates access records for each request made to your S3 bucket. An access log record contains information such as the request type, the resources specified in the request worked, and the time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the AWS Console and navigate to the 'S3' service.
2. Click on the the S3 bucket that was reported.
3. Click on the 'Properties' tab.
4. Under the 'Server access logging' section, select 'Enable' option and provide s3 bucket of your choice in the 'Target bucket'
5. Click on 'Save Changes'.

Query:
```config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as X; config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' AND json.rule = loggingConfiguration.targetBucket does not exist as Y; filter '$.X.s3BucketName equals $.Y.bucketName'; show Y;```
Azure VM OS disk is encrypted with the default encryption key instead of ADE/CMK
This policy identifies the OS disks which are encrypted with the default encryption key instead of ADE/CMK. Azure encrypts OS disks by default Server-Side Encryption (SSE) with platform-managed keys [SSE with PMK]. It is recommended to use either SSE with Azure Disk Encryption [SSE with PMK+ADE] or Customer Managed Key [SSE with CMK] which improves on platform-managed keys by giving you control of the encryption keys to meet your compliance need.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: To enable SSE with Azure Disk Encryption [SSE with PMK+ADE],
Follow https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-prerequisites based VM the data disk is assigned.

To enable SSE with Customer Managed Key [SSE with CMK],
Follow https://docs.microsoft.com/en-us/azure/virtual-machines/disks-enable-customer-managed-keys-portal.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-disk-list' and json.rule = 'osType exists and managedBy exists and (encryptionSettings does not exist or encryptionSettings.enabled == false) and encryption.type is not member of ("EncryptionAtRestWithCustomerKey", "EncryptionAtRestWithPlatformAndCustomerKeys")'```
Azure Machine Learning compute instance not running latest OS Image Version
This policy identifies Azure Machine Learning compute instances not running on the latest available image version.

Running compute instances on outdated image versions increases security risks. Without the latest security patches and updates, these instances are more vulnerable to attacks, which can compromise machine learning models and data.

As a best practice, it is recommended to recreate or update Azure Machine Learning compute instances to the latest image version, ensuring they have the most recent security patches and updates.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To ensure your Azure Machine Learning compute instances are running the latest available image version, follow these remediation steps:

1. Recreate the Compute Instance. This will ensure it is provisioned with the latest VM image, including all recent updates and security patches.
- Steps:
  1. Backup Important Data:
     - Store notebooks in the `User files` directory to persist them.
     - Mount data to persist files.
  2. Re-create the Instance:
     - Delete the existing compute instance.
     - Provision a new compute instance with latest OS image version.
  3. Restore Data:
     - Restore notebooks and mounted data to the newly created instance.

Note: This will result in the loss of data and customizations stored on the instance's OS and temporary disks..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-machine-learning-compute' AND json.rule = properties.provisioningState equal ignore case "Succeeded" and properties.properties.state equal ignore case "Running" and properties.properties.osImageMetadata.isLatestOsImageVersion is false```