knarayan/cloud_posture_checks huggingface dataset:
AWS Cognito identity pool allows unauthenticated guest access
This policy identifies AWS Cognito identity pools that allow unauthenticated guest access.

AWS Cognito identity pools unauthenticated guest access and allows unauthenticated users to assume a role in your AWS account. These unauthenticated users will be granted permissions of the assumed role which may have more privileges than that are intended. This could lead to unauthorized access or data leakage.

It is recommended to disable unauthenticated guest access for the Cognito identity pools.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To deactivate guest access in an identity pool,
1. Log in to AWS console
2. Navigate to the reported resource region by selecting the region from the dropdown in the top right corner.
3. Navigate to the Amazon Cognito dashboard
4. Under 'Identity pools' section, select the reported identity pool
5. In 'User access' tab, under 'Guest access' section
6. Click on 'Deactivate' button to deactivate the guest access configured.

NOTE: Before you deactivate unauthenticated guest access, it is must to have at-least one authenticated access configured in your identity pool..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cognito-identity-pool' AND json.rule = allowUnauthenticatedIdentities is true```
Azure Network Security Group allows all traffic on NetBIOS DNS (TCP Port 53)
This policy identifies Azure Network Security Groups (NSG) that allow all traffic on DNS TCP port 53. Review your list of NSG rules to ensure that your resources are not exposed. As a best practice, restrict DNS solely to known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Before making any changes, please check the impact to your applications/services. Evaluate whether you want to edit the rule and limit access to specific users, hosts, and services only, deny access, or delete the rule completely.

1. Log in to the Azure Portal.
2. Select 'All services'.
3. Select 'Network security groups', under NETWORKING.
4. Select the Network security group you need to modify.
5. Select 'Inbound security rules' under Settings.
6. Select the rule you need to modify, and edit it to allow specific IP addresses OR set the 'Action' to 'Deny' OR 'Delete' the rule based on your requirement.
7. 'Save' your changes..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and (protocol equals Tcp or protocol equals *) and (destinationPortRange contains _Port.inRange(53,53) or destinationPortRanges[*] contains _Port.inRange(53,53) ))] exists```
AWS IAM password policy does not have an uppercase character
This policy identifies AWS accounts in which IAM password policy does not have an uppercase character. AWS IAM (Identity & Access Management) allows customers to secure AWS console access. As a security best practice, customers must have strong password policies in place.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['WEAK_PASSWORD'].
Mitigation of this issue can be done as follows: 1. Login to the AWS console and navigate to the 'IAM' service.
2. On the left navigation panel, Click on 'Account Settings'
3. check 'Require at least one uppercase letter'.
4. Click on 'Apply password policy'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or requireUppercaseCharacters is false or requireUppercaseCharacters does not exist'```
Azure SQL on Virtual Machine (Linux) with basic authentication
This policy identifies Azure Virtual Machines that are hosted with SQL on them and have basic authentication. 

Azure Virtual Machines with basic authentication could allow attackers to brute force and gain access to SQL database hosted on it, which might lead to information leakage. It is recommended to use SSH keys for authentication to avoid brute force attacks on SQL database hosted virtual machines.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To configure existing Azure Virtual machine with SSH key authentication, Follow below URL:
https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/vmaccess#update-ssh-key

If changes are not reflecting you may need to take backup, Create new virtual machine with SSH key based authentication and delete the reported virtual machine..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-vm-list' AND json.rule = powerState equal ignore case "PowerState/running" and ['properties.storageProfile'].['imageReference'].['publisher'] equal ignore case microsoftsqlserver and (['properties.osProfile'].['linuxConfiguration'] exists and ['properties.osProfile'].['linuxConfiguration'].['disablePasswordAuthentication'] is false)```
GCP Firewall rule allows all traffic on RDP port (3389)
This policy identifies GCP Firewall rules which allow all inbound traffic on RDP port (3389). Allowing access from arbitrary IP addresses to this port increases the attack surface of your network. It is recommended that the RDP port (3389) should be allowed to specific IP addresses.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: If the Firewall rule reported indeed needs to restrict all traffic, follow the instructions below:
1. Login to GCP Console
2. Go to 'VPC Network'
3. Go to the 'Firewall'
4. Click on the reported Firewall rule
5. Click on 'EDIT'
6. Modify Source IP ranges to specific IP
7. Click on 'SAVE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-firewall-rules-list' AND json.rule = disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(ports contains _Port.inRange(3389,3389) or (ports does not exist and (IPProtocol contains tcp or IPProtocol contains udp)))] exists```
PCSUP-23654

This is applicable to all cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where finding.source = 'AWS Inspector' AND finding.type = 'AWS Inspector Security Best Practices'```
GCP Service account is publicly accessible
This policy identifies GCP Service accounts that are publicly accessible.

GCP Service accounts are intended to be used by an application or compute workload, rather than a person. It can be granted permission to perform actions in the GCP project as any other GCP user. Allowing access to 'allUsers' or 'allAuthenticatedUsers' over a service account would allow unwanted access to the public and could lead to a security breach.

As a security best practice, follow the Principle of Least Privilege and grant permissions to entities only on a need basis. It is recommended to avoid granting permission to 'allUsers' or 'allAuthenticatedUsers'.
This is applicable to gcp cloud and is considered a high severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To revoke access from 'allusers'/'allAuthenticatedUsers', follow the below mentioned steps:
1. Login to the GCP console
2. Navigate to the 'IAM and Admin' service (Left Panel)
3. Go to 'Service Accounts'
4. Click on the alerting service account
5. Under the 'PERMISSIONS' tab, select the 'VIEW BY PRINCIPALS' tab
6. Select the entries with 'allUsers' or 'allAuthenticatedUsers' 
7. Click on the 'REMOVE ACCESS' to revoke access from 'allusers'/'allAuthenticatedUsers'
8. Click on 'CONFIRM'.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-iam-service-accounts-list' AND json.rule = ( iamPolicy.bindings[*].members contains "allUsers" or iamPolicy.bindings[*].members contains "allAuthenticatedUsers" ) and ( disabled does not exist or disabled is false )```
AWS ECS cluster with container insights feature disabled
This policy identifies ECS clusters that are disabled with the container insights feature. Container Insights collects metrics at the cluster, task, and service levels. As a best practice, enable container insights to start collecting the data available through these logs for the reported ECS cluster.

For details:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/deploy-container-insights-ECS-cluster.html
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To enable container insights feature in your existing ECS cluster follow below mentioned URL:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/deploy-container-insights-ECS-cluster.html#deploy-container-insights-ECS-existing.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ecs-cluster' AND json.rule = status equals ACTIVE and settings[?any(name equals containerInsights and value equals disabled)] exists```
GCP SQL database instance is not configured with automated backups
This policy identifies the GCP SQL database instances that are not configured with automated backups. Automated backups need to be set for any instance that contains data that should be protected from loss or damage. It is recommended to have all SQL database instances set to enable automated backups.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to GCP Console
2. Navigate to 'SQL'
3. Click on the reported SQL instance
4. From the left menu go to 'Backups'
5. Go to section 'Settings', click on 'EDIT'
6. From the pop-up window 'Edit backups settings' click on 'Automated backups'
7. Provide a time window from the available dropdown
8. Click on 'Save'

.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = settings.backupConfiguration.enabled is false and instanceType is not member of ("READ_REPLICA_INSTANCE","ON_PREMISES_INSTANCE")```
AWS IAM password policy does not have a symbol
Checks to ensure that IAM password policy requires a symbol. AWS IAM (Identity & Access Management) allows customers to secure AWS console access. As a security best practice, customers must have strong password policies in place.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['WEAK_PASSWORD'].
Mitigation of this issue can be done as follows: 1. Login to the AWS console and navigate to the 'IAM' service.
2. On the left navigation panel, Click on 'Account Settings'
3. check 'Require at least one non-alphanumeric character'.
4. Click on 'Apply password policy'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or requireSymbols equals null or requireSymbols is false or requireSymbols does not exist'```
Azure App Service Web app doesn't use latest Python version
This policy identifies App Service Web apps that are not configured with latest Python version. Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. It is recommended to use the latest Python version for web apps in order to take advantage of security fixes, if any.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure Portal
2. Navigate to 'App Services' dashboard
3. Select the reported web app service
4. Under 'Settings' section, Click on 'Configuration'
5. Click on 'General settings' tab, Ensure that Stack is set to Python and Minor version is set to latest version.
6. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'config.isPythonVersionLatest exists and config.isPythonVersionLatest equals false'```
Azure Activity log alert for Delete network security group does not exist
This policy identifies the Azure accounts in which activity log alert for Delete network security group does not exist. Creating an activity log alert for the Delete network security group gives insight into network access changes and may reduce the time it takes to detect suspicious activity.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal
2. Click on Monitor (Left Panel)
3. Select 'Alerts'
4. Click on Create > Alert rule
5. In 'Create an alert rule' page, choose the Scope as your Subscription and under the CONDITION section, choose 'Delete Network Security Group (Microsoft.Network/networkSecurityGroups)' and Other fields you can set based on your custom settings.
6. Click on Create.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/delete" as X; count(X) less than 1```
GCP Vertex AI Workbench user-managed notebook's JupyterLab interface access mode is set to single user
This policy identifies GCP Vertex AI Workbench user-managed notebooks with JupyterLab interface access mode set to single user.

Vertex AI Workbench user-managed notebook can be accessed using the web-based JupyterLab interface. Access mode controls the control access to this interface. Allowing access to only a single user could limit collaboration, increase chances of credential sharing, and hinder security audits and reviews of the resource.

It is recommended to avoid single user access and make use of the service account access mode for user-managed notebooks.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Access mode cannot be changed for existing Vertex AI Workbench user-managed notebooks. A new Vertex AI Workbench user-managed notebook should be created.

To create a new Vertex AI Workbench user-managed notebook with access mode set to service account, please refer to the steps below:
1. Login to the GCP console
2. Under 'Vertex AI', navigate to the 'Workbench' (Left Panel)
3. Select 'USER-MANAGED NOTEBOOKS' tab
4. Click 'CREATE NEW'
5. Click 'ADVANCED OPTIONS'
6. Configure the instance as required
7. Go to 'IAM and security' tab
8. Select 'Service account'
9. Click 'CREATE'.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-vertex-ai-notebook-instance' AND json.rule = state equals "ACTIVE" and ( metadata.proxy-mode equals "mail" or metadata.proxy-user-mail exists )```
GCP PostgreSQL instance database flag log_temp_files is not set to 0
This policy identifies PostgreSQL database instances in which database flag log_temp_files is not set to 0. The log_temp_files flag controls the logging of names and size of temporary files. Configuring log_temp_files to 0 causes all temporary file information to be logged, while positive values log only files whose size is greater than or equal to the specified number of kilobytes. A value of -1 disables temporary file information logging. If all temporary files are not logged, it may be more difficult to identify potential performance issues that may be either poor application coding or deliberate resource starvation attempts.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to GCP console
2. Navigate SQL Instances page
3. Click on reported PostgreSQL instance
4. Click EDIT
NOTE: If the instance is stopped, You need to START instance first to edit the configurations, then Click on EDIT.
5. If the flag has not been set on the instance, 
Under 'Configuration options', click on 'Add item' in 'Flags' section, choose the flag 'log_temp_files' from the drop-down menu and set the value as '0'
OR
If the flag has been set to other than 0, Under 'Configuration options', In 'Flags' section choose the flag 'log_temp_files' and set the value as '0'
6. Click Save.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "databaseVersion contains POSTGRES and (settings.databaseFlags[?(@.name=='log_temp_files')] does not exist or settings.databaseFlags[?(@.name=='log_temp_files')].value does not equal 0)"```
Copy of PCSUP-16458-CLI-Test

This is applicable to aws cloud and is considered a high severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS console
2. Select the region, from the region drop-down, for which the alert is generated
3. Navigate to AWS Lambda Dashboard
4. Click on the 'Functions' (Left panel)
5. Select the lambda function on which the alert is generated
6. Go to 'Configuration' tab
7. Select 'Function URL'
8. Click on 'Edit'
9. Set 'Auth type' to 'AWS_IAM'
10. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-lambda-list-functions' AND json.rule = authType equal ignore case NONE```
AWS IAM policy overly permissive to STS services
This policy identifies the IAM policies that are overly permissive to STS services. AWS Security Token Service (AWS STS) is a web service that enables you to request temporary credentials for AWS Identity and Access Management (IAM) users or for users that you authenticate (federated users). It is recommended to follow the principle of least privileges ensuring that only restricted STS services for restricted resources.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['PRIVILEGE_ESCALATION'].
Mitigation of this issue can be done as follows: 1. Log in to the AWS Console
2. Navigate to the 'IAM' service
3. Click on the 'Policies' in left hand panel and Click on the reported IAM policy
4. Under Permissions tab, Change the element of the policy document to be more restrictive so that it only allows restricted STS permissions on selected resources instead of wildcards (sts:* and Resource:*) OR Put condition statement with least privilege access..

Query:
```config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-get-policy-version' AND json.rule = isAttached is true and document.Statement[?any(Effect equals Allow and Action contains sts:* and Resource equals * and Condition does not exist)] exists```
AWS IAM SSH keys for AWS CodeCommit have aged more than 90 days without being rotated
This policy identifies all of your IAM SSH public keys which haven't been rotated in the past 90 days. It is recommended to verify that they are rotated on a regular basis in order to protect your AWS CodeCommit repositories.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to AWS Console
2. Goto IAM and select Users
3. Choose the reported user
4. Goto Security Credential
5. Delete the SSH Key ID and upload a new SSH Key
Key creation steps: https://docs.aws.amazon.com/codecommit/latest/userguide/setting-up-ssh-unixes.html.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-ssh-public-keys' AND json.rule = '(_DateTime.ageInDays($.uploadDate) > 91) and status==Active'```
Azure Storage account not configured with SAS expiration policy
This policy identifies Azure Storage accounts not configured with SAS expiration policy.

A Shared Access Signature (SAS) expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning. If Azure Storage logging with Azure Monitor is enabled, then an entry is written to the Azure Storage logs. It is recommended that you limit the interval for a SAS in case it is compromised.

For more details:
https://learn.microsoft.com/en-us/azure/storage/common/sas-expiration-policy
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To configure an expiration policy for shared access signatures for the reported Storage account, follow bellow URL:
https://learn.microsoft.com/en-us/azure/storage/common/sas-expiration-policy.

Query:
```config from cloud.resource where cloud.type = 'azure' and api.name= 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.allowSharedKeyAccess is true and properties.sasPolicy does not exist```
GCP Cloud Function v1 is using unsecured HTTP trigger
This policy identifies GCP Cloud Functions v1 that are using unsecured HTTP trigger.

Using HTTP triggers for cloud functions poses significant security risks, including vulnerability to interception, tampering, and various attacks like man-in-the-middle. Conversely, HTTPS triggers provide encrypted communication, safeguarding sensitive data and ensuring confidentiality. HTTPS also supports authentication mechanisms, enhancing overall security and trust.

It is recommended to enable 'Require HTTPS' for HTTP triggers for all cloud functions v1.
This is applicable to gcp cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: 1. Login to GCP console
2. Navigate to 'Cloud Functions' service
3. Click on the alerting function
4. Click on 'EDIT'
5. Under section 'Trigger', click on 'EDIT' for HTTP trigger
6. Select the checkbox against the field 'Require HTTPS'
7. Click on 'SAVE'
8. Click on 'NEXT'
9. Click on 'DEPLOY'.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-cloud-function-v2' AND json.rule = state equals "ACTIVE" AND environment equals "GEN_1" AND serviceConfig.securityLevel exists AND serviceConfig.securityLevel does not equal "SECURE_ALWAYS"```