knarayan/cloud_posture_checks huggingface dataset:
Azure Logic app is not configured with managed identity
This policy identifies Azure Logic apps that are not configured with managed identity.

Managed identity can be used to authenticate to any service that supports Azure AD authentication, without having credentials in your code. Including credentials in code heightens the risk in the event of a security breach and increases the threat surface in case of exploitation and also managed identities eliminate the need for developers to manage credentials.

As a security best practice, it is recommended to set up managed identity rather than embedding credentials within the code.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure portal
2. Navigate to Logic apps
3. Click on the reported Logic app
4. Under 'Setting' section, click on 'Identity'
5. Configure either 'System assigned' or 'User assigned' managed identity based on your requirement.
6. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case Running and kind contains workflowapp and (identity.type does not exist or identity.principalId is empty)```
GCP Kubernetes cluster Application-layer Secrets not encrypted
Application-layer Secrets Encryption provides an additional layer of security for sensitive data, such as Secrets, stored in etcd. Using this functionality, you can use a key, that you manage in Cloud KMS, to encrypt data at the application layer. This protects against attackers who gain access to an offline copy of etcd.

This policy checks your cluster for the Application-layer Secrets Encryption security feature and alerts if it is not enabled.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: At this time, you cannot enable Application-layer Secrets Encryption for an existing cluster.

Creating a new cluster with Application-layer Secrets Encryption.

1. Go to the Kubernetes clusters page in the GCP Console and select CREATE CLUSTER.
2. Click Advanced options.
3. Check Enable Application-layer Secrets Encryption.
4. Select a customer-managed key from the drop down menu, or create a new KMS key.
5. When finished configuring options for the cluster, click Create..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule =  $.databaseEncryption.state equals DECRYPTED```
Copy of AWS VPC subnets should not allow automatic public IP assignment
This policy identifies VPC subnets which allow automatic public IP assignment. VPC subnet is a part of the VPC having its own rules for traffic. Assigning the Public IP to the subnet automatically (on launch) can accidentally expose the instances within this subnet to internet and should be edited to 'No' post creation of the Subnet.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Sign into the AWS console.
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated.
3. Navigate to the 'VPC' service.
4. In the navigation pane, click on 'Subnets'.
5. Select the identified Subnet and choose the option 'Modify auto-assign IP settings' under the Subnet Actions.
6. Disable the 'Auto-Assign IP' option and save it..

Query:
```config from cloud.resource where cloud.type = 'AWS' and api.name = 'aws-ec2-describe-subnets' AND json.rule = 'mapPublicIpOnLaunch is true'```
Azure Container registries Public access to All networks is enabled
This policy identifies Azure Container registries which has Public access to All networks enabled. Azure ACR is used to store Docker container images which might contain sensitive information. It is highly recommended to restrict public access from allow access from Selected networks or make it Private by disabling the Public access.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['INTERNET_EXPOSURE'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Select 'All services' > 'Container Registries'
3. Select the container registry you need to modify
4. Select 'Networking' under 'Settings'
5. Click on 'Public access' tab and select 'Selected networks' and provide the IPV4 address for which you want access to ACR or select 'Disabled' to disable Public access
6. Click on 'Save'

Note: 'Public access' setting can be toggled to 'Selected networks' or 'Disabled' state only with Premium SKU. For Standard and Basic SKU Public access setting cannot be updated and these resource will reamin accesiable to public..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-container-registry' AND json.rule = ((properties.publicNetworkAccess equals Enabled and properties.networkRuleSet does not exist) or (properties.publicNetworkAccess equals Enabled and properties.networkRuleSet exists and properties.networkRuleSet.defaultAction equals Allow))```
EIP-CSE-IACOHP-AzurePostgreSQL-NetworkAccessibility-eca1500-5

This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-server' AND json.rule = firewallRules.value[*].properties.startIpAddress equals "0.0.0.0" or firewallRules.value[*].properties.endIpAddress equals "0.0.0.0"```
Azure disk data access authentication mode not enabled
This policy identifies if the Data Access Authentication Mode for Azure disks is disabled. This mode is crucial for controlling how users upload or export Virtual Machine Disks by requiring an Azure Entra ID role to authorize such operations.

Without enabling this mode, users can create SAS tokens to export disks without stringent identity-based restrictions. This increases the risk of unauthorized disk access or data exposure, especially in environments handling sensitive data. Enabling the Data Access Authentication Mode ensures that only users with the appropriate Data Operator for Managed Disk role in Azure Entra ID can export or manage disks. This enhances data security by preventing unauthorized disk exports and restricting access to secure download URLs.

As a security best practice, it is recommended to enable data access authentication mode for Azure disks.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Note: To enable data access authentication mode on disks attached to a VM, you must first stop the VM and detach the disk.

1. Log in to Azure Portal and search for 'Disks'
2. Select 'Disks'
3. Select the reported disk
4. Under 'Settings' select 'Disk Export'
5. Check the 'Enable data access authentication mode' under 'Data access authentication mode'
6. Click on 'Save'
7. Re-attach the disk to the virtual machine, and restart it.

Query:
```config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-disk-list' AND json.rule = dataAccessAuthMode does not equal ignore case AzureActiveDirectory and managedBy contains virtualMachines and provisioningState equal ignore case Succeeded```
AWS Lambda execution role having overly permissive inline policy
This policy identifies AWS Lambda Function execution role having overly permissive inline policy embedded. Lambda functions having overly permissive policy could lead to lateral movement in account or privilege being escalated when compromised. It is highly recommended to have the least privileged access policy to protect the Lambda Functions from unauthorized access.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['PRIVILEGE_ESCALATION'].
Mitigation of this issue can be done as follows: Refer to the following URL to give fine-grained and restrictive permissions to IAM Role Inline Policy:
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-edit.html#edit-inline-policy-console.

Query:
```config from cloud.resource where api.name = 'aws-lambda-list-functions' as X; config from cloud.resource where api.name = 'aws-iam-list-roles' AND json.rule = inlinePolicies[*].policyDocument.Statement[?any(Effect equals Allow and (Action equals "*" or Action contains :* or Action[*] contains :*) and (Resource equals "*" or Resource[*] anyStartWith "*"))] exists as Y; filter '$.X.role equals $.Y.role.arn'; show Y;```
llatorre - RoleAssignment v3

This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-assignment' as X; config from cloud.resource where api.name = 'azure-active-directory-user' as Y; filter '((_DateTime.daysBetween($.X.properties.updatedOn,today()) != 8) and ($.X.properties.principalId contains $.Y.id))'; show X;```
AWS Elastic Load Balancer with listener TLS/SSL is not configured
This policy identifies AWS Elastic Load Balancers which have non-secure listeners. As Load Balancers will be handling all incoming requests and routing the traffic accordingly. The listeners on the load balancers should always receive traffic over secure channel with a valid SSL certificate configured.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign into the AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated
3. Navigate to EC2 dashboard
4. Click on 'Load Balancers' (Left Panel)
5. Select the reported ELB
6. On the Listeners tab, Click the 'Edit' button under the available listeners
7. In the Load Balancer Protocol, Select 'HTTPS (Secure HTTP)' or 'SSL (Secure TCP)'
8. In the SSL Certificate column, click 'Change'
9. On 'Select Certificate' popup dialog, Choose a certificate from ACM or IAM or upload a new certificate based on requirement and Click on 'Save'
10. Back to the 'Edit listeners' dialog box, review the secure listeners configuration, then click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elb-describe-load-balancers' AND json.rule = '((description.listenerDescriptions[*].listener.protocol equals HTTPS or description.listenerDescriptions[*].listener.protocol equals SSL) and (description.listenerDescriptions[*].listener.sslcertificateId is empty or description.listenerDescriptions[*].listener.sslcertificateId does not exist)) or description.listenerDescriptions[*].listener.protocol equals HTTP or description.listenerDescriptions[*].listener.protocol equals TCP'```
GCP Kubernetes Engine Clusters have HTTP load balancing disabled
This policy identifies GCP Kubernetes Engine Clusters which have disabled HTTP load balancing. HTTP/HTTPS load balancing provides global load balancing for HTTP/HTTPS requests destined for your instances. Enabling HTTP/HTTPS load balancers will let the Kubernetes Engine to terminate unauthorized HTTP/HTTPS requests and make better context-aware load balancing decisions.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to GCP Portal
2. Go to Kubernetes Engine (Left Panel)
3. Select Kubernetes clusters
4. From the list of clusters, choose the reported cluster
5. Click on EDIT button
6. Set 'HTTP load balancing' to Enabled
7. Click on Save.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = 'addonsConfig.httpLoadBalancing.disabled equals true'```
Azure Custom Role Administering Resource Locks not assigned
This policy identifies Azure Custom Role Administering Resource Locks which are not assigned to any user. Resource locking feature helps to prevent resource being modified or deleted unintentional by any user and prevents damage caused by it. It is recommended to create a custom role for Resource Locks and assign to appropriate user.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Navigate to 'Subscriptions', and select the subscription from the list where you want the custom role
3. Select 'Access control (IAM)'

If already custom role has been created for resource locks, then go to step 16

4. Click on 'Add' from top tab and select 'Add custom role'
5. Enter 'Resource Lock Administrator' in the 'Custom role name' field
6. Enter 'Can Administer Resource Locks' in the 'Description' field
7. Select 'Start from scratch' for 'Baseline permissions'
8. Click 'Next'
9. Select 'Add permissions' from top 'Permissions' tab
10. Search for 'Microsoft.Authorization/locks' in the 'Search for a permission' box
11. Select 'Microsoft.Authorization'
12. Click on 'Permission' checkbox to select all permissions
13. Click on 'Add'
14. Click 'Review+create'
15. Click 'Create' to create custom role for resource locks
16. In 'Access control (IAM)' select 'Add role assignment'
17. Select the custom role created above from 'Role' drop down
18. Select 'User, group, or service principal' from 'Assign access to' drop down
19. Search for user to assign the custom role in 'Select' field
20. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-assignment' AND json.rule = (properties.roleDefinition.properties.type equals CustomRole and (properties.roleDefinition.properties.permissions[?any((actions[*] equals Microsoft.Authorization/locks/delete and actions[*] equals Microsoft.Authorization/locks/read and actions[*] equals Microsoft.Authorization/locks/write) or actions[*] equals Microsoft.Authorization/locks/*)] exists) and (properties.roleDefinition.properties.permissions[?any(notActions[*] equals Microsoft.Authorization/locks/delete or notActions[*] equals Microsoft.Authorization/locks/read or notActions[*] equals Microsoft.Authorization/locks/write or notActions[*] equals Microsoft.Authorization/locks/*)] does not exist)) as X; count(X) less than 1```
AWS IAM policy attached to users
This policy identifies IAM policies attached to user. By default, IAM users, groups, and roles have no access to AWS resources. IAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended that IAM policies be applied directly to groups but not users.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['HIGH_PRIVILEGED_ROLE'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS Console
2. Navigate to the 'IAM' service.
3. Identify the users that were specifically assigned to the reported IAM policy.
4. If a group with a similar policy already exists, put the user into that group. If such a group does not exist, create a new group with relevant policy and assign the user to the group..

Query:
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-iam-list-attached-user-policies' AND json.rule='attachedPolicies isType Array and not attachedPolicies size == 0'```
aws emr shadow

This is applicable to aws cloud and is considered a high severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = 'aws-emr-studio' AND json.rule = DefaultS3Location exists and DefaultS3Location contains "aws-emr-studio-" as X; config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' as Y; filter 'not ($.X.BucketName equals $.Y.bucketName)' ; show X;```
Azure Cache for Redis not configured with data in transit encryption
This policy identifies Azure Cache for Redis which are not configured with data encryption in transit. Enforcing an SSL connection helps prevent unauthorized users from reading sensitive data that is intercepted as it travels through the network, between clients/applications and cache servers, known as data in transit. It is recommended to configure in-transit encryption for Azure Cache for Redis.

Refer to below link for more details:
https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-configure#access-ports
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To configure data in-transit for your existing Azure Cache for Redis follow below URL:
https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-configure#access-ports
.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cache-redis' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.enableNonSslPort is true```
AWS Bedrock Custom model encrypted with Customer Managed Key (CMK) is not enabled for regular rotation
This policy identifies AWS Bedrock Custom model encrypted with Customer Managed Key (CMK) is not enabled for regular rotation.

AWS KMS (Key Management Service) allows customers to create master keys to encrypt the Custom model. Not enabling regular rotation for AWS Bedrock custom model key rotation failure can result in potential compliance violations.

As a security best practice, it is important to rotate the keys periodically so that if the keys are compromised, the data in the underlying service is still secure with the new keys.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: The following steps are recommended to enable the automatic rotation of the KMS key used by the AWS Bedrock Custom model

1. Sign in to the AWS Management Console and open the Amazon Bedrock console at https://console.aws.amazon.com/bedrock/.
2. From the left navigation pane, choose 'Custom models' under 'Foundation models'.
3. In the 'Models' tab, select the model that is reported.
4. Under the 'Custom model encryption KMS key' section, click on the KMS key id link.
 5. Under the 'Key rotation' tab on the navigated KMS key window, click on Edit and enable the Key rotation option under the 'Automatic key rotation' section.
6. Provide the rotation period as per your business and compliance requirements in the 'Rotation period (in days)' section.
7. Click on Save..

Query:
```config from cloud.resource where api.name = 'aws-bedrock-custom-model' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and keyMetadata.keyManager equal ignore case CUSTOMER and keyMetadata.origin equals AWS_KMS and (rotation_status.keyRotationEnabled is false or rotation_status.keyRotationEnabled equals "null") as Y; filter '$.X.modelKmsKeyArn equals $.Y.key.keyArn'; show X;```
AWS DocumentDB cluster deletion protection is disabled
This policy identifies AWS DocumentDB clusters for which deletion protection is disabled. Enabling deletion protection for DocumentDB clusters prevents irreversible data loss resulting from accidental or malicious operations.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS console
2. Select the region, from the region drop-down, for which the alert is generated
3. Navigate to Amazon DocumentDB Dashboard
4. Select the reported DocumentDB cluster
5. From top right 'Actions' drop down list select 'Enable deletion protection'
6. Schedule the modifications and click on 'Modify cluster'
 .

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-docdb-db-cluster' AND json.rule = Status contains available and DeletionProtection is false```
AWS S3 bucket is utilized for AWS Sagemaker training job data
This policy identifies the AWS S3 bucket utilized for AWS Sagemaker training job data.

S3 buckets store the datasets required for training machine learning models in Sagemaker. Proper configuration and access control are essential to ensure the security and integrity of the training data. Improperly configured S3 buckets used for AWS Sagemaker training data can lead to unauthorized access, data breaches, and potential loss of sensitive information.

It is recommended to implement strict access controls, enable encryption, and audit permissions to secure AWS S3 buckets for AWS Sagemaker training data and ensure compliance.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To protect the S3 buckets utilized by the Sagemaker training job, please refer to the following link for recommended best practices
https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html.

Query:
```config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' as X; config from cloud.resource where api.name = 'aws-sagemaker-training-job' as Y; filter '$.Y.InputDataConfig[*].DataSource.S3DataSource.bucketName intersects $.X.bucketName'; show X;```
Azure Storage account is not configured with private endpoint connection
This policy identifies Storage accounts that are not configured with a private endpoint connection. Azure Storage account private endpoints can be configured using Azure Private Link. Private Link allows users to access an Azure Storage account from within the virtual network or from any peered virtual network. When Private Link is combined with restricted NSG policies, it helps reduce the risk of data exfiltration. It is recommended to configure Private Endpoint Connection to Storage account.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Refer following URL for configuring Private endpoints on your Storage account:
https://learn.microsoft.com/en-us/azure/private-link/create-private-endpoint-portal?#create-a-private-endpoint.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = properties.provisioningState equals Succeeded and networkRuleSet.defaultAction equal ignore case Allow and properties.privateEndpointConnections[*] is empty```