knarayan/cloud_posture_checks huggingface dataset:
Azure Activity log alert for delete policy assignment does not exist
This policy identifies the Azure accounts in which activity log alert for Delete policy assignment does not exist. Creating an activity log alert for Delete policy assignment gives insight into changes done in azure policy - assignments and may reduce the time it takes to detect unsolicited changes.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal
2. Click on Monitor (Left Panel)
3. Select 'Alerts'
4. Click on Create > Alert rule
5. In 'Create an alert rule' page, choose the Scope as your Subscription and under the CONDITION section, choose 'Delete policy assignment (Microsoft.Authorization/policyAssignments)' and Other fields you can set based on your custom settings.
6. Click on Create.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.scopes[*] does not contain resourceGroups and properties.enabled equals true and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Authorization/policyAssignments/delete" as X; count(X) less than 1```
Azure MySQL Database Server using insecure TLS version
This policy identifies Azure MySQL Database Servers which are using insecure TLS version. As a security best practice, use the newer TLS version as the minimum TLS version for Azure MySQL Database Server. Currently, Azure MySQL Database Server supports TLS 1.2 version which resolves the security gap from its preceding versions.

https://docs.microsoft.com/en-gb/azure/mysql/howto-tls-configurations
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To configure TLS settings on reported Azure MySQL Database Server, follow the below-mentioned URL:
https://docs.microsoft.com/en-gb/azure/mysql/howto-tls-configurations.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-mysql-server' AND json.rule = properties.sslEnforcement equals Enabled and properties.minimalTlsVersion does not equal TLS1_2```
AWS Elastic File System (EFS) not encrypted using Customer Managed Key
This policy identifies Elastic File Systems (EFSs) which are encrypted with default KMS keys and not with Keys managed by Customer. It is a best practice to use customer managed KMS Keys to encrypt your EFS data. It gives you full control over the encrypted data.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: AWS EFS Encryption of data at rest can only be enabled during file system creation. So to resolve this alert, create a new EFS with encryption enabled with the customer-managed key, then migrate all required data from the reported EFS to this newly created EFS and delete reported EFS.

To create new EFS with encryption enabled, perform the following:
1. Sign into the AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated
3. Navigate to EFS dashboard
4. Click on 'File systems' (Left Panel)
5. Click on 'Create file system' button
6. On the 'Configure file system access' step, specify EFS details as per your requirements and Click on 'Next Step'
7. On the 'Configure optional settings' step, Under 'Enable encryption' Choose 'Enable encryption of data at rest' and Select customer managed key [i.e. Other than (default)aws/elasticfilesystem] from 'Select KMS master key' dropdown list along with other parameters and Click on 'Next Step'
8. On the 'Review and create' step, Review all your setting and Click on 'Create File System' button

To delete reported EFS which does not has encryption, perform the following:
1. Sign into the AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated
3. Navigate to EFS dashboard
4. Click on 'File systems' (Left Panel)
5. Select the reported file system
6. Click on 'Actions' drop-down
7. Click on 'Delete file system'
8. In the 'Permanently delete file system' popup box, To confirm the deletion enter the file system's ID and Click on 'Delete File System'.

Query:
```config from cloud.resource where api.name = 'aws-describe-mount-targets' AND json.rule = fileSystemDescription.encrypted is true as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyManager does not equal CUSTOMER or (keyMetadata.keyManager equals CUSTOMER and keyMetadata.keyState equals Disabled) as Y; filter '$.X.fileSystemDescription.kmsKeyId equals $.Y.key.keyArn'; show X;```
IBM Cloud Object Storage bucket is not enabled with IBM Cloud Monitoring
This policy identifies IBM Cloud Object Storage buckets which have Monitoring disabled or not enabled properly. Use IBM Cloud Monitoring to gain operational visibility into the performance and health of your applications, services, and platforms. So, it is recommended to enable Monitoring to monitor all usage/request metrics of a bucket.
This is applicable to ibm cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Log in to the IBM Cloud Console
2. Click on Menu Icon and navigate to 'Resource list'. From the list of resources, select the object storage instance in which the reported bucket resides.
3. Select the bucket and click on 'Configuration' tab.
4. Navigate to 'Monitoring', click on 'Create' button if it is not enabled already.
5. If already enabled, click on three dots and click 'Edit'.
6. Select 'Usage Metrics' and 'Request Metrics' checkboxes to get all metrics.
7. Click on 'Save'..

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-object-storage-bucket' AND json.rule = metrics_monitoring does not exist or metrics_monitoring.request_metrics_enabled does not equal ignore case "true" or metrics_monitoring.usage_metrics_enabled does not equal ignore case "true"```
Azure SQL Databases with disabled Email service and co-administrators for Threat Detection
This policy identifies Azure SQL Databases which have ADS Vulnerability Assessment 'Also send email notifications to admins and subscription owners' not configured. This setting enables ADS - VA scan reports being sent to admins and subscription owners. It is recommended to enable 'Also send email notifications to admins and subscription owners' setting, which would help in reducing time required for identifying risks and taking corrective measures.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal
2. Go to SQL databases (Left Panel)
3. Choose the reported each DB instance
4. Click on 'Microsoft Defender for Cloud' under 'Security'
5. Click on '(Configure)' next to 'Microsoft Defender for SQL: Enabled at the server-level'
6. In 'VULNERABILITY ASSESSMENT SETTINGS' section, Ensure 'Also send email notifications to admins and subscription owners' is checked
7. 'Save' your changes.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-db-list' AND json.rule = 'securityAlertPolicy does not exist or securityAlertPolicy[*] is empty or (securityAlertPolicy.properties.state equals Enabled and securityAlertPolicy.properties.emailAccountAdmins equals Disabled)'```
AWS DocumentDB Cluster is not enabled with data encryption in transit
This policy identifies Amazon DocumentDB Clusters for which data encryption in transit is disabled. Each DocumentDB Cluster is associated with a Cluster Parameter Group. It is highly recommended to implement in-transit encryption in order to protect data from unauthorized access as it travels through the network, between clients and the cluster.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: To modify the Parameter group
1. Sign in to the AWS console
2. Select the region, from the region drop-down, for which the alert is generated
3. Navigate to Amazon DocumentDB Dashboard
4. Click on the 'Parameter groups' (Left panel)
5. Select the db cluster parameter group which is associated with the DocumentDB cluster on which the alert is generated
6. Select the \"tls\" parameter
7. Click on \"Edit\" button
8. Set value to \"enabled\"
9. Click on \"Modify cluster parameter\" button

To restart the Document DB cluster
1. Sign in to the AWS console
2. Select the region, from the region drop-down, for which the alert is generated
3. Navigate to Amazon DocumentDB Dashboard
4. Click on the 'Clusters' (Left panel)
5. Select the db cluster parameter group which is associated with the DocumentDB cluster on which the alert is generated, and choose the button to the left of its name.
6. Choose \"Actions\", and then \"Reboot\".
7. Click on \"Reboot\" button..

Query:
```config from cloud.resource where api.name = 'aws-docdb-db-cluster-parameter-group' AND json.rule = parameters.tls.ParameterValue equals "disabled" as X; config from cloud.resource where api.name = 'aws-docdb-db-cluster' AND json.rule = Status equals available as Y; filter '$.X.DBClusterParameterGroupName equals $.Y.DBClusterParameterGroup'; show Y;```
AWS WAF Rule Group CloudWatch metrics disabled
This policy identifies the AWS WAF Rule Group having CloudWatch metrics disabled.

AWS WAF rule groups have CloudWatch metrics that provide information about the number of allowed and blocked web requests, counted requests, and requests that pass through without matching any rule in the rule group. These metrics can be used to monitor and analyse the performance of the web access control list (web ACL) and its associated rules.

It is recommended to enable CloudWatch metrics for a WAF rule group to help in monitoring and analysis of web requests.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To enable RuleGroup with CloudWatch metrics please follow below steps:

1. Run the below command to get the ruleGroup details to be used for update
    aws wafv2 list-rule-groups --scope {scopeOfRuleGroup}
2. Get the ruleGroup 'Id' and 'LockToken' values for the ruleGroup to be updated from the output.
3. Run the below command with name and 'Id' obtained from above output
     aws wafv2 get-rule-group --name {ruleGroupName} --scope {scopeOfRuleGroup} --id {IdFromAboveOutput}
4. Get the 'Rules' block output and save it in a file for further reference from above command output
5. Please update 'CloudWatchMetricsEnabled' field to true for every rule in the file saved from above along with providing a metric name at the 'MetricName' field
6. Run the below command to enable CloudWatch metrics on the ruleGroup.
      aws wafv2 update-rule-group 
       --name {ruleGroupName} 
       --scope {scopeOfRuleGroup} 
       --id {ruleGroupId} 
       --lock-token {tokenFromAboveOutput} 
       --rules file://{fileFromAboveOutput}
       --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName= 
          {metricNameForRuleGroup).

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-waf-v2-rule-group' AND json.rule = VisibilityConfig.CloudWatchMetricsEnabled is false or Rules[?any( VisibilityConfig.CloudWatchMetricsEnabled is false)] exists```
AWS regions nearing VPC Private Gateway IPSec Limit
This policy identifies if your account is near the private gateway IPSec limitation per VPC per Region. AWS provides a reasonable starting limitation for the maximum number of VPC Private Gateway IPSec connections you can assign in each VPC. If you approach the limit in a particular VPC, this alert indicates that you have nearly exhausted your allocation.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS console.
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated.
3. Navigate to VPC Dashboard
4. Click on 'Site-to-Site VPN Connections' (Left Panel)
5. Choose the VPN connection you want to delete, which more used or required
6. Click on 'Actions' dropdown
7. Click on 'Delete'
8. On 'Delete' popup dialog, Click on 'Delete'
NOTE: If existing VPN Connection is properly associated and exhausted your VPC Site-to-Site VPN Connections limit allocation, you can contact AWS for a service limit increase..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-vpn-connections-summary' AND json.rule = 'vpnConnectionsSummary[*].vpnConnectionsCount greater than 7'```
IBM Cloud Service ID creation is not restricted in account settings
This policy identifies IBM cloud accounts where Service ID creation is not restricted in account settings. By default, all members of an account can create service IDs. Enabling Service ID creation setting will restrict the users from creating service IDs unless correct access is granted explicitly. It is recommended to enable Service ID creation setting and grant access only on a need basis.
This is applicable to ibm cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: Follow the below mentioned URL to enable the restriction to create service IDs:

https://cloud.ibm.com/docs/account?topic=account-restrict-service-id-create&interface=ui#enable-restrict-create-serviceid-ui.

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-iam-identity-account-setting' AND json.rule = restrict_create_service_id does not equal "RESTRICTED" ```
Azure AKS cluster monitoring not enabled
Azure Monitor for containers is a feature designed to monitor the performance of container workloads deployed to either Azure Container Instances or managed Kubernetes clusters hosted on Azure Kubernetes Service (AKS). Monitoring your containers is critical, especially when you're running a production cluster, at scale, with multiple applications.

This policy checks your AKS cluster monitoring add-on setting and alerts if no configuration is found, or monitoring is disabled.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To enable monitoring for your AKS cluster, follow the below URL:
https://learn.microsoft.com/en-us/azure/aks/monitor-aks#configure-monitoring.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kubernetes-cluster' AND json.rule =  properties.addonProfiles.omsagent.config does not exist or properties.addonProfiles.omsagent.enabled is false```
AWS VPC subnets should not allow automatic public IP assignment
This policy identifies VPC subnets which allow automatic public IP assignment. VPC subnet is a part of the VPC having its own rules for traffic. Assigning the Public IP to the subnet automatically (on launch) can accidentally expose the instances within this subnet to internet and should be edited to 'No' post creation of the Subnet.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign into the AWS console.
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated.
3. Navigate to the 'VPC' service.
4. In the navigation pane, click on 'Subnets'.
5. Select the identified Subnet and choose the option 'Modify auto-assign IP settings' under the Subnet Actions.
6. Disable the 'Auto-Assign IP' option and save it..

Query:
```config from cloud.resource where cloud.type = 'AWS' and api.name = 'aws-ec2-describe-subnets' AND json.rule = 'mapPublicIpOnLaunch is true'```
AWS CloudFront distribution with access logging disabled
This policy identifies CloudFront distributions which have access logging disabled. Enabling access log on distributions creates log files that contain detailed information about every user request that CloudFront receives. Access logs are available for web distributions. If you enable logging, you can also specify the Amazon S3 bucket that you want CloudFront to save files in.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign into the AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated
3. Navigate to CloudFront Distributions Dashboard
4. Click on the reported distribution
5. On 'General' tab, Click on 'Edit' button
6. On 'Edit Distribution' page, Set 'Logging' to 'On', choose a 'Bucket for Logs' and 'Log Prefix' as desired
7. Click on 'Yes, Edit'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = 'logging.enabled is false and logging.bucket is empty'```
Azure PostgreSQL database server with log disconnections parameter disabled
This policy identifies PostgreSQL database servers for which server parameter is not set for log disconnections. Enabling log_disconnections helps PostgreSQL Database to Logs end of a session, including duration, which in turn generates query and error logs. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to Azure console.
2. Navigate to 'Azure Database for PostgreSQL servers' dashboard
3. Click on the alerted database name
4. Go to 'Server parameters' under 'Settings' block
5. From the list of parameters find 'log_disconnections' and set it to on
6. Click on 'Save' button from top menu to save the change..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-server' AND json.rule = "configurations.value[?(@.name=='log_disconnections')].properties.value equals OFF or configurations.value[?(@.name=='log_disconnections')].properties.value equals off"```
Alibaba Cloud RAM password history check policy is disabled
This policy identifies Alibaba Cloud accounts for which password history check policy is disabled. As a best practice, enable RAM password history check policy to prevent RAM users from reusing a specified number of previous passwords.
This is applicable to alibaba_cloud cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['WEAK_PASSWORD'].
Mitigation of this issue can be done as follows: 1. Log in to Alibaba Cloud Portal
2. Go to Resource Access Management (RAM) service
3. In the left-side navigation pane, click on 'Settings'
4. In the 'Security Settings' tab, In the 'Password Strength Settings' Section, Click on 'Edit Password Rule'
5. In the 'Password History Check Policy' field, enter the value between 1 to 24 instead of 0 based on your requirement.
6. Click on 'OK'
7. Click on 'Close'.

Query:
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ram-password-policy' AND json.rule =  'passwordReusePrevention !isType Integer or passwordReusePrevention == 0'```
mosh-stam2

This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: mosh_ recommendation.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-acm-describe-certificate' AND json.rule = config.remoteDebuggingEnabled is true```
AWS Secrets Manager secret not encrypted by Customer Managed Key (CMK)
This policy identifies AWS Secrets Manager secrets that are encrypted using the default KMS key instead of CMK (Customer Managed Key) or using a CMK that is disabled.

AWS Secrets Manager secrets are a secure storage solution for sensitive information like passwords, API keys, and tokens in the AWS cloud. Secrets Manager secrets are encrypted by default by AWS managed key but users can specify CMK to get enhanced security, control over the encryption key, and also comply with any regulatory requirements.

As a security best practice, using CMK to encrypt your Secrets Manager secrets is advisable as it gives you full control over the encrypted data.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To change the encryption key for a Secrets Manager secret:
1. Open the Secrets Manager console at https://console.aws.amazon.com/secretsmanager/.
2. From the list of secrets, choose the reported secret.
3. On the secret details page, in the Secrets details section, choose Actions, and then choose 'Edit encryption key'.
4. in the 'Encryption key' section choose the Customer Managed Key created and managed by you in AWS Key Management Service (KMS) based on your business requirement.
5. Click 'Save' button to save the changes.
Note: When using customer-managed CMKs to encrypt Secrets Manager secret, Ensure authorized entities have access to the key and its associated operations..

Query:
```config from cloud.resource where api.name = 'aws-secretsmanager-describe-secret' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyManager does not equal CUSTOMER or (keyMetadata.keyManager equals CUSTOMER and keyMetadata.keyState equals Disabled) as Y; filter '($.X.kmsKeyId does not exist ) or ($.X.kmsKeyId exists and $.X.kmsKeyId equals $.Y.keyMetadata.arn)'; show X;```
AWS DynamoDB table point-in-time recovery (PITR) disabled
This policy identifies AWS DynamoDB tables that does not have point-in-time recovery (backup) enabled.

AWS DynamoDB enables you to back up your table data continuously by using point-in-time recovery (PITR) with per-second granularity. This helps in protecting your data against accidental write or delete operations.

It is recommended to enable point-in-time recovery functionality on the DynamoDB table to protect data.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To enable Point-in-Time Recovery (PITR) for a DynamoDB table, you can follow these steps:

1. Sign in to the AWS Management Console.
2. Navigate to the DynamoDB service.
3. Click on the 'Tables' in the left navigation pane.
4. Select the table you want to enable Point-in-Time Recover (PITR) for.
5. Switch to the 'Backups' tab and click on 'Edit' next to Point-in-time recovery.
6. Click on the 'Turn on point-in-time recovery' check box and Click on 'Save changes'..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-dynamodb-describe-table' AND json.rule = tableStatus equal ignore case ACTIVE AND continuousBackupsDescription.pointInTimeRecoveryDescription.pointInTimeRecoveryStatus does not equal ENABLED```