knarayan/cloud_posture_checks huggingface dataset:
IBM Cloud VPN Connections for VPC has an IPsec policy that have Perfect Forward Secrecy (PFS) disabled
This policy identifies IBM Cloud VPN Gateway with connections with IPsec policy that has Perfect Forward Secrecy disabled. Perfect Forward Secrecy is an encryption system that changes the keys used to encrypt and decrypt information frequently and automatically. This ensures that derived session keys are not compromised if one of the private keys is compromised in the future. It is recommended to enable Perfect Forward Secrecy.
This is applicable to ibm cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Log in to the IBM Cloud Console
2. Click on 'Menu Icon' and navigate to 'VPC Infrastructure' and then 'VPNs'
3. Select the 'Site-to-site gateways' and select the gateway reported in the alert.
4. In the Gateway 'Overview' page, under 'VPN connections', please note down the 'IPsec policy' name for each connection
5. From left navigation pane select 'VPNs', under 'Site-to-site gateways' select 'IPsec policies'.
6. Select required region, and perform below steps for all above noted down IPsec policies.
7. For each policy click on 'elipsis' menu icon on the right and select 'Edit'.
8. In 'Edit IPsec policy' page, slide the 'Perfect Forward Secrecy' feature to enabled.
9. Click on 'Save'.

Query:
```config from cloud.resource where api.name = 'ibm-vpc-network-vpn-gateway' AND json.rule = status equal ignore case available as X; config from cloud.resource where api.name = 'ibm-vpc-network-vpn-ipsec-policy' AND json.rule = pfs equals disabled as Y; filter '$.X.connections[*].id contains $.Y.connections[*].id'; show X;```
Azure Virtual Machine not protected with Azure Backup
This policy identifies Azure Virtual Machines that are not protected by Azure Backup.

Without Azure Backup, VMs are at risk of data loss due to accidental deletion, corruption, or ransomware attacks. Unprotected VMs may also not comply with organizational data retention policies and regulatory requirements.

As a best practice, it is recommended to configure Azure Backup for all VMs to ensure data protection and enable recovery options in case of unexpected failures or incidents.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal and search for 'Virtual machines'.
2. Select 'Virtual machines'.
3. Select the reported Virtual machine.
4. Under 'Backup + disaster recovery' select 'Backup'.
5. In the 'Backup' pane, select a 'Recovery Services vault'. If no vault exists, click 'Create new' to make a new vault.
6. Choose the appropriate 'Policy sub type'. It's recommended to select 'Enhanced'.
7. Next, select or create a 'Backup Policy' that defines when backups will run and how long they will be kept.
8. From the 'Disks' dropdown, check all the disks you want to back up. Also, check the 'Include future disks' box to ensure new disks are automatically included.
9. Click 'Enable Backup'..

Query:
```config from cloud.resource where api.name = 'azure-recovery-service-backup-protected-item' AND json.rule = properties.workloadType equal ignore case VM as X; config from cloud.resource where api.name = 'azure-vm-list' AND json.rule = powerState contains running as Y; filter 'not $.Y.id equal ignore case $.X.properties.virtualMachineId'; show Y;```
AWS Log metric filter and alarm does not exist for usage of root account
This policy identifies the AWS regions that do not have a log metric filter and alarm for usage of a root account. Monitoring for root account logins will provide visibility into the use of a fully privileged account and an opportunity to reduce its use it. Failure to monitor root account logins may result in a lack of visibility into unauthorized use or attempts to access the root account, posing potential security risks to your AWS environment. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail's configurations.

NOTE: This policy will trigger alert if you have at least one Cloudtrail with the multi trial is enabled, Logs all management events in your account and is not set with specific log metric filter and alarm.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS Console.
2. Navigate to the CloudWatch dashboard.
3. Click on 'Log groups' in the 'Logs' section (Left panel)
4. Select the log group created for your CloudTrail trail event logs (Cloudtrail should be multi-trail enabled with all Management Events captured) and click the Actions Dropdown Button -> Click 'Create Metric Filter' button.
5. In the 'Define Pattern' page, add the 'Filter pattern' value as
{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }
and Click on 'NEXT'.
6. In the 'Assign Metric' page, Choose Filter Name, and Metric Details parameter according to your requirement and click on 'Next'.
7. Under the ‘Review and Create' page, Review details and click 'Create Metric Filter’.
8. To create an alarm based on a log group-metric filter, Refer to the below link 
    https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_alarm_log_group_metric_filter.html.

Query:
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and ($.X.filterPattern does not contain "userIdentity.type!=" or $.X.filterPattern does not contain "userIdentity.type !=") and ($.X.filterPattern contains "userIdentity.type =" or $.X.filterPattern contains "userIdentity.type=") and ($.X.filterPattern contains "userIdentity.invokedBy NOT EXISTS") and ($.X.filterPattern contains "eventType!=" or $.X.filterPattern contains "eventType !=") and ($.X.filterPattern contains root or $.X.filterPattern contains Root) and ($.X.filterPattern contains AwsServiceEvent) and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```
OCI Kubernetes Engine Cluster endpoint is not configured with Network Security Groups
This policy identifies Kubernetes Engine Clusters endpoint that are not configured with Network Security Groups. Network security groups give fine-grained control of resources and help in restricting network access to your cluster node pools. It is recommended to restrict access to the Cluster node pools by configuring network security groups.
This is applicable to oci cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to OCI console
2. Go to Developer Services -> Kubernetes Clusters (OKE)
3. Click on the reported Kubernetes Clusters
4. Click on 'Edit'
5. On 'Edit cluster' page, Select the restrictive Network Security Group by selecting 'Use network security groups to control traffic' option under 'Kubernetes API server endpoint' section.
NOTE: Before you update cluster endpoint with Network security group, make sure you have a restrictive Network Security Group already created with only specific traffic ports based on requirement.
6. Click on 'Save' button.

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-containers-artifacts-kubernetes-cluster' AND json.rule = lifecycleState equal ignore case ACTIVE and endpointConfig exists and (endpointConfig.nsgIds does not exist or endpointConfig.nsgIds equal ignore case "null" or endpointConfig.nsgIds is empty)```
OCI Block Storage Block Volume is not restorable
This policy identifies the OCI Block Storage Volumes that are not restorable. It is recommended to have backups on each block volume, that the block volume can be restored during data loss events.
This is applicable to oci cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the resource reported in the alert into the Search box at the top of the Console.
3. Click the resource reported in the alert from the Resources submenu
4. Click on Block Volume Backups from the Resources pane
5. Click on Create Block Volume Backup (To create the back up).

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-block-storage-volume' as X; config from cloud.resource where api.name = 'oci-block-storage-volume-backup' as Y; filter 'not($.X.id equals $.Y.volumeId)'; show X;```
Azure Activity log alert for Create or update SQL server firewall rule does not exist
This policy identifies the Azure accounts in which activity log alert for Create or update SQL server firewall rule does not exist. Creating an activity log alert for Create or update SQL server firewall rule gives insight into SQL server firewall rule access changes and may reduce the time it takes to detect suspicious activity.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal
2. Click on Monitor (Left Panel)
3. Select 'Alerts'
4. Click on Create > Alert rule
5. In 'Create an alert rule' page, choose the Scope as your Subscription and under the CONDITION section, choose 'Create/Update server firewall rule (Microsoft.Sql/servers/firewallRules)' and Other fields you can set based on your custom settings.
6. Click on Create.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Sql/servers/firewallRules/write" as X; count(X) less than 1```
GCP PostgreSQL instance database flag log_disconnections is disabled
This policy identifies PostgreSQL type SQL instances for which the log_disconnections database flag is disabled. Enabling the log_disconnections setting will create log entries at the end of each session which can be useful in troubleshooting issues and determine any unusual activity across a time period.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to GCP Console
2. Navigate to SQL
3. Click on the PostgreSQL instance ID for which you want to enable the database flag from the list
4. Click 'Edit'
NOTE: If the instance is stopped, You need to START instance first to edit the configurations, then Click on EDIT.
5. Go to the 'Flags' section under 'Configuration options'
6. To set a flag that has not been set on the instance before, click 'Add item', choose the flag 'log_disconnections' from the drop-down menu and set the value as 'on'.
7. If it is already set to 'off' for 'log_disconnections', from the drop-down menu set the value as 'on'
8. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "databaseVersion contains POSTGRES and (settings.databaseFlags[?(@.name=='log_disconnections')] does not exist or settings.databaseFlags[?(@.name=='log_disconnections')].value equals off)"```
Copy of OCI MFA is disabled for IAM users
This policy identifies Identify Access Management (IAM) users for whom Multi Factor Authentication (MFA) is disabled. As a best practice, enable MFA to add an extra layer of protection for increased security of your OCI user’s identity and complete the sign-in process.
This is applicable to oci cloud and is considered a high severity issue.
Sample categories of findings relevant here are ['MFA'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console Page: https://console.ap-mumbai-1.oraclecloud.com/
2. Select Identity from Services menu
3. Select Users from Identity menu.
4. Click on each non-complaint user.
5. Click on Enable Multi-Factor Authentication.

Note : The console URL is region specific, your tenancy might have a different home region and thus console URL..

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-iam-user' AND json.rule = lifecycleState equal ignore case ACTIVE and capabilities.canUseConsolePassword is true and isMfaActivated is false```
AWS Config Recording is disabled
AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. AWS config uses configuration recorder to detect changes in your resource configurations and capture these changes as configuration items. It continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. This policy generates alerts when AWS Config recorder is not enabled.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS Management Console
2. Select the specific region from the top down, for which the alert is generated
3. Navigate to service 'Config' from the 'Services' dropdown.
If AWS Config set up exists,
a. Go to Settings
b. Click on 'Turn On' button under 'Recording is Off' section,
c. provide required information for bucket and role with proper permission
If AWS Config set up doesn't exist
a. Click on 'Get Started'
b. For Step 1, Tick the check box for 'Record all resources supported in this region' under section 'Resource types to record'
c. Under section 'Amazon S3 bucket', select bucket with permission to Config services
d. Under section 'AWS Config role', select a role with permission to Config services
e. Click on 'Next'
f. For Step 2, Select required rule and click on 'Next' otherwise click on 'Skip'
g. For Step 3, Review the created 'Settings' and click on 'Confirm'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-configservice-describe-configuration-recorders' AND json.rule = 'status.recording is true and status.lastStatus equals SUCCESS and recordingGroup.allSupported is true' as X; count(X) less than 1```
GCP Firewall rule allows all traffic on Microsoft-DS port (445)
This policy identifies GCP Firewall rules which allow all inbound traffic on Microsoft-DS port (445). Allowing access from arbitrary IP addresses to this port increases the attack surface of your network. It is recommended that the Microsoft-DS port (445) should be allowed to specific IP addresses.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: If the Firewall rule reported indeed needs to restrict all traffic, follow the instructions below:
1. Login to GCP Console
2. Go to 'VPC Network'
3. Go to the 'Firewall'
4. Click on the reported Firewall rule
5. Click on 'EDIT'
6. Modify Source IP ranges to specific IP
7. Click on 'SAVE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-firewall-rules-list' AND json.rule = disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(ports contains _Port.inRange(445,445) or (ports does not exist and (IPProtocol contains tcp or IPProtocol contains udp)))] exists```
Alibaba Cloud data disk is configured with delete automatic snapshots feature
This policy identifies data disks that are configured with delete automatic snapshots feature. Disabling the delete automatic snapshots while releasing disk feature prevents the irreversible data loss from accidental or malicious operations.
This is applicable to alibaba_cloud cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Alibaba Cloud Portal
2. Go to Elastic Compute Service
3. In the left-side navigation pane, click on 'Disks' which is under 'Storage & Snapshots'
4. Select the reported disk
5. Select More and click on Modify Disk Property
6. On Modify Disk Property popup window, Uncheck 'Delete Automatic Snapshots While Releasing Disk' checkbox
7. Click on 'OK'.

Query:
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-disk' AND json.rule = 'deleteAutoSnapshot is true'```
AWS CodeBuild project not configured with logging configuration
This policy identifies AWS CodeBuild project environments without a logging configuration.

AWS CodeBuild is a fully managed service for building, testing, and deploying code. Logging is a crucial security feature that allows for future forensic work in the event of a security incident. Correlating abnormalities in CodeBuild projects with threat detections helps boost confidence in their accuracy.

It is recommended to enable logging configuration on CodeBuild projects for monitoring and troubleshooting purposes.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS console. Navigate to the CodeBuild service
2. In the left navigation pane, select 'Build Projects' under 'Build'
3. Go to your AWS CodeBuild project
4. Select the 'Project details' tab, and under the 'Logs' section, select 'Edit'
5. Under the 'Edit Logs' page, based on the requirement, select either 'CloudWatch logs' or 'S3 logs'
6. For CloudWatch logging, provide a log group name
7. For S3 logging, provide the bucket name
8. Click on 'Update logs'..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-code-build-project' AND json.rule = not(logsConfig.cloudWatchLogs.status equal ignore case enabled or logsConfig.s3Logs.status equal ignore case enabled)```
GCP App Engine Identity-Aware Proxy is disabled
This policy identifies GCP App Engine applications for which Identity-Aware Proxy(IAP) is disabled.  IAP is used to enforce access control policies for applications and resources. It works with signed headers or the App Engine standard environment Users API to secure your app. It is recommended to enable Identity-Aware Proxy for securing the App engine.

Reference: https://cloud.google.com/iap/docs/concepts-overview
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['PRIVILEGE_ESCALATION'].
Mitigation of this issue can be done as follows: To enabled IAP for a GCP project follow the below steps provided,

Link: https://cloud.google.com/iap/docs/app-engine-quickstart#enabling_iap.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-app-engine-application' AND json.rule = servingStatus equals SERVING and (iap does not exist or iap.enabled does not exist or iap.enabled is false)```
AWS SQS queue encryption using default KMS key instead of CMK
This policy identifies SQS queues which are encrypted with default KMS keys and not with Customer Master Keys(CMKs). It is a best practice to use customer managed Master Keys to encrypt your SQS queue messages. It gives you full control over the encrypted messages data.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS console
2. Select the region, from the region drop-down, in which the alert is generated
3. Navigate to Simple Queue Service (SQS) dashboard
4. Choose the reported Simple Queue Service (SQS)
5. Click on 'Queue Actions' and Choose 'Configure Queue' from the dropdown 
6. On 'Configure' popup, Under 'Server-Side Encryption (SSE) Settings' section; Choose an 'AWS KMS Customer Master Key (CMK)' from the drop-down list or copy existing key ARN instead of (Default) alias/aws/sqs key.
7. Click on 'Save Changes'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-sqs-get-queue-attributes' AND json.rule = 'attributes.KmsMasterKeyId exists and attributes.KmsMasterKeyId contains alias/aws/sqs'```
Moses Policy Test 3
Test 3
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = 'aws-ec2-elastic-address' and resource.status = Deleted AND json.rule = domain exists```
Azure PostgreSQL database server with connection throttling parameter is disabled
This policy identifies PostgreSQL database servers for which server parameter is not set for connection throttling. Enabling connection_throttling helps the PostgreSQL Database to Set the verbosity of logged messages which in turn generates query and error logs with respect to concurrent connections, that could lead to a successful Denial of Service (DoS) attack by exhausting connection resources. A system can also fail or be degraded by an overload of legitimate users. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to Azure console.
2. Navigate to 'Azure Database for PostgreSQL servers' dashboard
3. Click on the alerted database name
4. Go to 'Server parameters' under 'Settings' block
5. From the list of parameters find 'connection_throttling' and set it to on
6. Click on 'Save' button from top menu to save the change..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-server' AND json.rule = "configurations.value[?(@.name=='connection_throttling')].properties.value equals OFF or configurations.value[?(@.name=='connection_throttling')].properties.value equals off"```
AWS IAM password policy does not have a minimum of 14 characters
Checks to ensure that IAM password policy requires minimum of 14 characters. AWS IAM (Identity & Access Management) allows customers to secure AWS console access. As a security best practice, customers must have strong password policies in place.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['WEAK_PASSWORD'].
Mitigation of this issue can be done as follows: 1. Login to the AWS console and navigate to the 'IAM' service.
2. On the left navigation panel, Click on 'Account Settings'
3. In the 'Minimum password length' field, put 14 or more (As per preference).
4. Click on 'Apply password policy'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or minimumPasswordLength < 14 or minimumPasswordLength does not exist'```