knarayan/cloud_posture_checks huggingface dataset:
AWS IAM Policy permission may cause privilege escalation
This policy identifies AWS IAM Policy which have permission that may cause privilege escalation. AWS IAM policy having weak permissions could be exploited by an attacker to elevate privileges. It is recommended to follow the principle of least privileges ensuring that AWS IAM policy does not have these sensitive permissions.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['PRIVILEGE_ESCALATION'].
Mitigation of this issue can be done as follows: Refer to the following URL to remove below listed weak permissions from reported AWS IAM Policies,
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#remove-policies-console

Below are the permission which can lead to privilege escalation,
iam:CreatePolicyVersion
iam:SetDefaultPolicyVersion
iam:PassRole
iam:CreateAccessKey
iam:CreateLoginProfile
iam:UpdateLoginProfile
iam:AttachUserPolicy
iam:AttachGroupPolicy
iam:AttachRolePolicy
iam:PutUserPolicy
iam:PutGroupPolicy
iam:PutRolePolicy
iam:AddUserToGroup
iam:UpdateAssumeRolePolicy
iam:*.

Query:
```config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-get-policy-version' AND json.rule = isAttached is true and document.Statement[?any(Effect equals Allow and (Action contains iam:CreatePolicyVersion or Action contains iam:SetDefaultPolicyVersion or Action contains iam:PassRole or Action contains iam:CreateAccessKey or Action contains iam:CreateLoginProfile or Action contains iam:UpdateLoginProfile or Action contains iam:AttachUserPolicy or Action contains iam:AttachGroupPolicy or Action contains iam:AttachRolePolicy or Action contains iam:PutUserPolicy or Action contains iam:PutGroupPolicy or Action contains iam:PutRolePolicy or Action contains iam:AddUserToGroup or Action contains iam:UpdateAssumeRolePolicy or Action contains iam:*))] exists```
GCP Firewall rule allows all traffic on HTTP port (80)
This policy identifies GCP Firewall rules which allow all inbound traffic on HTTP port (80). Allowing access from arbitrary IP addresses to this port increases the attack surface of your network. It is recommended that the HTTP port (80) should be allowed to specific IP addresses.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: If the Firewall rule reported indeed needs to restrict all traffic, follow the instructions below:
1. Login to GCP Console
2. Go to 'VPC Network'
3. Go to the 'Firewall'
4. Click on the reported Firewall rule
5. Click on 'EDIT'
6. Modify Source IP ranges to specific IP
7. Click on 'SAVE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name='gcloud-compute-firewall-rules-list' AND json.rule= disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(ports contains _Port.inRange(80,80) or (ports does not exist and (IPProtocol contains tcp or IPProtocol contains udp)))] exists```
GCP SQL Instances do not have valid SSL configuration
This policy identifies GCP SQL instances that either lack SSL configuration or have SSL certificates that have expired.

If an SQL instance is not configured to use SSL, it may accept unencrypted and insecure connections, leading to potential risks such as data interception and authentication vulnerabilities.

It is a best practice to enable SSL configuration to ensure data security and integrity when communicating with a GCP SQL instance.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To configure SQL instance with SSL configuration,follow the steps mentioned below:

1. Log in to google cloud console
2. Navigate to 'Cloud SQL Instances'
3. Click on the alerted instance and navigate to 'Security' under 'Connections' tab
4. Select one of the following under 'Manage SSL mode':
	 i. Allow only SSL connections
	 ii. Require trusted client certificates

To verify the validity of the current certificate, follow the steps mentioned below:

1. Log in to google cloud console
2. Navigate to 'Cloud SQL Instances'
3. Click on the alerted instance and navigate to 'Security' under 'Connections' tab
4. Verify the expiration date of your server certificate under 'Manage server CA certificates' table

To create a new client certificate, follow the URL mentioned: https://cloud.google.com/sql/docs/mysql/configure-ssl-instance#client-certs.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name='gcloud-sql-instances-list' and json.rule = "(settings.ipConfiguration.sslMode equal ignore case TRUSTED_CLIENT_CERTIFICATE_REQUIRED and _DateTime.ageInDays(serverCaCert.expirationTime) > -1) or settings.ipConfiguration.sslMode equal ignore case ALLOW_UNENCRYPTED_AND_ENCRYPTED"```
OCI Event Rule and Notification does not exist for IAM group changes
This policy identifies the OCI compartments which do not have an Event Rule and Notification that gets triggered for IAM group changes. Monitoring and alerting on changes to IAM group will help in identifying changes to satisfy the least privilege principle. It is recommended that an Event Rule and Notification be configured to catch changes made to IAM group.
NOTE: 
1. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.
2. This policy will trigger alert if you have at least one Event Rule and Notification, even if OCI has single or multi compartments.
This is applicable to oci cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the Event into the Search box at the top of the Console.
3. Click the Event Service from the Services submenu
4. Select the compartment that should host the rule
5. Click Create Rule
6. Provide a Display Name and Description
7. Create a Rule Condition by selecting Identity in the Service Name Drop-down and selecting Group – Create, Group – Delete and Group – Update
8. In the Actions section select Notifications as Action Type
9. Select the Compartment that hosts the Topic to be used.
10. Select the Topic to be used
11. Optionally add Tags to the Rule
12. Click Create Rule.

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.identitycontrolplane.creategroup and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.deletegroup and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updategroup) and actions.actions[*].topicId exists' as X; count(X) less than 1```
IBM Cloud Database PostgreSQL is exposed to public
The policy identifies IBM Cloud Database PostgreSQL instances exposed to the public via public endpoints. When provisioning an IBM Cloud database service, it is generally not recommended to use public endpoints because it can pose a security risk. Public endpoints can make your database accessible to anyone with internet access, potentially leaving your data vulnerable to unauthorized access or malicious attacks. Instead, it is recommended to use private endpoints when provisioning a database service in IBM Cloud.
This is applicable to ibm cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: Refer to the IBM documentation to change the service endpoints from public to private
https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-service-endpoints.

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-postgresql-deployment-info' AND json.rule = deployment.enable_public_endpoints is true```
GCP Cloud Asset Inventory is disabled
This policy identifies GCP accounts where GCP Cloud Asset Inventory is disabled.

GCP Cloud Asset Inventory is a metadata inventory service that allows you to view, monitor, and analyze Google Cloud and Anthos assets across projects and services. This data can prove to be crucial in security analysis, resource change tracking, and compliance auditing.

It is recommended to enable GCP Cloud Asset Inventory for centralized visibility and control over your cloud assets.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the GCP console
2. Under 'APIs and Services', navigate to the 'API Library' (Left Panel)
3. Search and select 'Cloud Asset API'
4. Click 'ENABLE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-services-list' AND json.rule = services[?any( name ends with "/cloudasset.googleapis.com" and state equals "ENABLED" )] does not exist```
Azure Container Registry with ARM audience token authentication enabled
This policy identifies Azure Container Registries that permit ARM audience tokens for authentication.

When ARM audience tokens are enabled, they allow authentication intended for broader Azure services, which could introduce potential security risks. Disabling ARM audience tokens ensures that only ACR-specific tokens are valid, enhancing security by limiting authentication exclusively to Azure Container Registry audience tokens.

As a security best practice, it is recommended to disable ARM audience tokens for Azure Container Registries.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To disable ARM audience tokens for Azure Container Registries, refer to the following link:
https://learn.microsoft.com/en-us/azure/container-registry/container-registry-disable-authentication-as-arm#assign-a-built-in-policy-definition-to-disable-arm-audience-token-authentication---azure-portal.

Query:
```config from cloud.resource where api.name = 'azure-container-registry' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.policies.azureADAuthenticationAsArmPolicy.status contains enabled```
Alibaba Cloud Security group is overly permissive to all traffic
This policy identifies Security groups that are overly permissive to all traffic. As a best practice, restrict security groups to only allow permitted traffic and limit brute force attacks on your network.
This is applicable to alibaba_cloud cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Alibaba Cloud Portal
2. Go to Elastic Compute Service
3. In the left-side navigation pane, choose Network & Security > Security Groups
4. Select the reported security group and then click Add Rules in the Actions column
5. In Inbound tab, Select the rule with 'Action' as Allow, 'Authorization Object' as 0.0.0.0/0, Click Modify in the Actions column
6. Replace the value 0.0.0.0/0 with specific IP address range.
7. Click on 'OK'.

Query:
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-security-group' AND json.rule = "permissions is not empty and permissions[?(@.policy=='Accept' && @.direction=='ingress')].sourceCidrIp contains 0.0.0.0/0"```
test_aggr_pk

This is applicable to aws cloud and is considered a high severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-cloudtrail-describe-trails' as X; count(X) less than 1 ```
Azure PostgreSQL flexible server secure transport parameter is disabled
This policy identifies PostgreSQL flexible servers for which secure transport (SSL connectivity) parameter is disabled.

Secure transport (SSL connectivity) helps to provide a new layer of security, by connecting server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between server and client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and application.

As a security best practice, it is recommended to enable secure transport parameter for Azure PostgreSQL flexible server.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure Portal
2. Navigate to 'Azure Database for PostgreSQL flexible server'
3. Click on the reported PostgreSQL flexible server
4. Navigate to Settings -> Server parameters
5. Search for parameter 'require_secure_transport' and set VALUE to 'ON' and You can also set min TLS version by setting 'ssl_min_protocol_version' server parameter as per your business requirement.
6. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-flexible-server' AND json.rule = properties.state equal ignore case Ready and require_secure_transport.value does not equal ignore case on```
Azure AKS cluster pool profile count contains less than 3 nodes
This policy identifies AKS clusters that are configured with node pool profile less than 3 nodes. It is recommended to have at least 3 or more than 3 nodes in a node pool for a more resilient cluster. (Clusters smaller than 3 may experience downtime during upgrades.)
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To scale AKS cluster node pool nodes count, follow below URL:
https://learn.microsoft.com/en-gb/azure/aks/scale-cluster?tabs=azure-cli.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kubernetes-cluster' AND json.rule = 'properties.powerState.code equal ignore case Running and properties.agentPoolProfiles[?any(type equal ignore case AvailabilitySet and count less than 3)] exists'```
Automation Audit Log Cron BUVZK Policy
Automation Audit Log Policy
This is applicable to aws cloud and is considered a high severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.service = 'AWS Auto Scaling' AND api.name = 'aws-describe-auto-scaling-groups' AND json.rule = createdTime does not contain "foo"```
OCI Load balancer listener is not configured with SSL certificate
This policy identifies Load balancers for which the listener is not configured with an SSL certificate.

Enforcing an SSL connection helps prevent unauthorized users from reading sensitive data that is intercepted as it travels through the network, between clients/applications and cache servers.

It is recommended to implement SSL between the load balancer and your client; so that the load balancer can accept encrypted traffic from a client.
This is applicable to oci cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To configure SSL to your Load balancer listener follow below URLs details:
For adding certificate - https://docs.oracle.com/en-us/iaas/Content/Balance/Tasks/create_certificate.htm

For editing listener - https://docs.oracle.com/en-us/iaas/Content/Balance/Tasks/managinglisteners_topic-Editing_Listeners.htm.

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-loadbalancer' AND json.rule = lifecycleState equals ACTIVE and listeners.* is not empty and listeners.*.sslConfiguration.certificateName is empty and listeners.*.protocol does not equal ignore case HTTP```
Azure Cognitive Services account is not configured with managed identity
This policy identifies Azure Cognitive Services accounts that are not configured with managed identity. Managed identity can be used to authenticate to any service that supports Azure AD authentication, without having credentials in your code. Storing credentials in a code increases the threat surface in case of exploitation and also managed identities eliminate the need for developers to manage credentials. So as a security best practice, it is recommended to have the managed identity to your Cognitive Services account.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to Azure portal
2. Navigate to 'Azure AI services'
3. Click on the reported Azure AI service
4. Select 'Identity' under 'Resource Management' from left panel
5. Configure either System assigned or User assigned identity
6. Click on Save.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cognitive-services-account' AND json.rule = properties.provisioningState equal ignore case Succeeded and (identity.type does not exist or identity.type equal ignore case None)```
OCI Compute Instance boot volume has in-transit data encryption is disabled
This policy identifies the OCI Compute Instances that are configured with disabled in-transit data encryption boot or block volumes. It is recommended that Compute Instance boot or block volumes should be configured with in-transit data encryption to minimize risk for sensitive data being leaked.
This is applicable to oci cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the resource reported in the alert into the Search box at the top of the Console.
3. Click the resource reported in the alert from the Resources submenu
4. Click Edit
5. Click on Show Advanced Options
6. Select USE IN-TRANSIT ENCRYPTION
7. Click Save Changes

Note : To update the instance properties, the instance must be rebooted..

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-compute-instance' AND json.rule = launchOptions.isPvEncryptionInTransitEnabled is false```
llatorre - RoleAssigment v4

This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: Go to investigate and identify the user that was assigned this role:
config from cloud.resource where api.name = 'azure-active-directory-user' AND json.rule = id contains <principalId_from_the_json_output>

Go to investigate and identify who assigned this role:
config from cloud.resource where api.name = 'azure-active-directory-user' AND json.rule = id contains <updatedby_from_the_json_output>.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-assignment' AND json.rule = '((_DateTime.ageInDays($.properties.updatedOn) < 60) and (properties.principalType contains User) and (properties.scope starts with"/subscriptions"))' addcolumn properties.roleDefinition.properties.roleName properties.roleDefinition.properties.type properties.principalId properties.updatedBy```
AWS IAM password policy does not have a minimum of 16 characters

This is applicable to aws cloud and is considered a high severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or minimumPasswordLength < 16 or minimumPasswordLength does not exist'```
GCP Kubernetes cluster shielded GKE node with Secure Boot disabled
This policy identifies GCP Kubernetes cluster shielded GKE nodes with Secure Boot disabled. An attacker may seek to alter boot components to persist malware or rootkits during system initialization. It is recommended to enable Secure Boot for Shielded GKE Nodes to verify the digital signature of node boot components.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Note: Once a Node pool is provisioned, it cannot be updated to enable Secure Boot. You must create new Node pools within the cluster with Secure Boot enabled. You will also need to migrate workloads from existing non-conforming Node pools to the newly created Node pool, then delete the non-conforming pools.

To create a nodepool with Secure Boot enabled follow the below steps,

1. Log in to gcloud console
2. Navigate to service 'Kubernetes Engine'
3. Select the alerted cluster and click 'ADD NODE POOL'
4. Ensure that the 'Enable secure boot' checkbox is checked under the ‘Shielded options' in section 'Security'
5. Click on 'CREATE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = nodePools[?any(config.shieldedInstanceConfig.enableSecureBoot does not exist or config.shieldedInstanceConfig.enableSecureBoot is false)] exists```
GCP Storage buckets are publicly accessible to all users
This policy identifies the buckets which are publicly accessible to all users. Enabling public access to Storage buckets enables anybody with a web association to access sensitive information that is critical to business. Access over a whole bucket is controlled by IAM. Access to individual objects within the bucket is controlled by its ACLs.
This is applicable to gcp cloud and is considered a high severity issue.
Sample categories of findings relevant here are ['PRIVILEGE_ESCALATION'].
Mitigation of this issue can be done as follows: To remove public access from a bucket, either enable "Public access prevention" or edit/remove any permissions granted to 'allUsers' on a bucket.

To edit/remove permissions granted over the bucket, follow the instructions below:
1. Login to GCP Portal
2. Go to the Cloud Storage Buckets page.
3. Go to Buckets
4. Click on the Storage bucket for which alert has been generated
5. Select the Permissions tab near the top of the page.
6. Edit/remove any permissions granted to 'allUsers'
 
To prevent public access over the bucket, follow the instructions below:
1. Login to GCP Portal
2. Go to the Cloud Storage Buckets page.
3. Go to Buckets
4. Click on the Storage bucket for which alert has been generated
5. Select the Permissions tab near the top of the page.
6. In the Public access card, click "Prevent public access" to enforce public access prevention..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = iamConfiguration.publicAccessPrevention does not equal ignore case "enforced" and iam.bindings[*] size greater than 0 and iam.bindings[*].members[*] any equal allUsers```