knarayan/cloud_posture_checks huggingface dataset:
test

This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = 'aws-securityhub-hub' AND json.rule = SubscribedAt exists```
GCP Storage bucket with object versioning disabled
This policy identifies GCP Storage buckets that have object versioning disabled. 

Object versioning is a method of keeping multiple variants of an object in the same storage bucket. Enabling object versioning on storage log buckets will protect your cloud storage data from being overwritten or accidentally deleted.

It is recommended to enable the object versioning feature on all storage buckets.
This is applicable to gcp cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the GCP console
2. Navigate to the Cloud Storage Buckets page. Select 'Buckets' from the left panel
3. Click on the reported bucket
4. Go to the 'Protection' tab
5. Under the 'Object versioning' section, select 'OBJECT VERSIONING OFF'
6. In the 'Turn on object versioning' dialog, select the 'Add recommended lifecycle rules to manage version costs' checkbox if required.
7. Click on 'CONFIRM'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = versioning.enabled is false or versioning does not exist```
AWS CloudTrail log validation is not enabled in all regions
This policy identifies AWS CloudTrails in which log validation is not enabled in all regions. CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was modified after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated
3. Access the 'CloudTrail' service.
4. For each trail reported, under Configuration > Storage Location, make sure 'Enable log file validation' is set to 'Yes'..

Query:
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-cloudtrail-describe-trails' AND json.rule='logFileValidationEnabled is false'```
GCP VM instance with Shielded VM features disabled
This policy identifies VM instances which have Shielded VM features disabled. Shielded VMs are virtual machines (VMs) on Google Cloud Platform hardened by a set of security controls that help defend against rootkits and bootkits. Shielded VM's verifiable integrity is achieved through the use of Secure Boot, virtual trusted platform module (vTPM)-enabled Measured Boot, and integrity monitoring. Shielded VM instances run firmware which is signed and verified using Google's Certificate Authority, ensuring that the instance's firmware is unmodified and establishing the root of trust for Secure Boot.

NOTE: You can only enable Shielded VM options on instances that have Shielded VM support. This policy reports VM instances that have Shielded VM support and are disabled with the Shielded VM features.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to GCP console
2. Navigate VM instances page
3. STOP the reported VM instance before editing the instance
NOTE: Before stoping the instance, Check the VM instance operational requirement.
4. After the instance stops, click 'EDIT'
5. In the Shielded VM section, select 'Turn on vTPM' and 'Turn on Integrity Monitoring'.
Optionally, if you do not use any custom or unsigned drivers on the instance, also select 'Turn on Secure Boot'.
6. Click on 'Save' and then START the instance..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = '(status equals RUNNING and name does not start with "gke-") and shieldedInstanceConfig exists and (shieldedInstanceConfig.enableVtpm is false or shieldedInstanceConfig.enableIntegrityMonitoring is false)'```
IBM Cloud user with IAM policies provide administrative privileges for Databases for MySQL service
This policy identifies IBM Cloud users with administrator role permission for Databases for MySQL service. A user has full platform control as an administrator, including the ability to assign other users access policies and modify deployment passwords. If a user with administrator privilege becomes compromised, it may result in a compromised database. As a security best practice, it is advised to provide the least privilege access, such as allowing only the rights necessary to complete a task, instead of excessive permissions.
This is applicable to ibm cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Log in to the IBM Cloud console.
2. In the IBM Cloud console, click 'Manage' on the title bar > 'Access (IAM)', click on 'Users' in the left panel.
3. Select the user which is reported and you want to edit access for.
4. Go to 'Access' tab and check the 'Access policies' section> Click on three dots on the right corner of a row for the policy which is having Administrator permission on 'Databases for MySQL' service
5. Click on Remove OR Edit to assign limited permission to the policy.
6. Review the policy details that you're about to Edit/Remove, and confirm by clicking Save/Remove..

Query:
```config from cloud.resource where api.name = 'ibm-iam-policy' AND json.rule = type equal ignore case "access" and roles[?any( role_id contains "crn:v1:bluemix:public:iam::::role:Administrator" )] exists and resources[?any( attributes[?any( name equal ignore case "serviceName" and value equal ignore case "databases-for-mysql" and operator is member of ("stringEquals", "stringMatch"))] exists and attributes[?any( name is member of ("region","resourceGroupId","serviceInstance"))] does not exist )] exists and subjects[?any( attributes[?any( name contains "iam_id" and value contains "IBMid")] exists )] exists as X;config from cloud.resource where api.name = 'ibm-iam-user' as Y; filter '$.X.subjects[*].attributes[*].value contains $.Y.iam_id'; show Y;```
OCI Function Application is not configured with Network Security Groups
This policy identifies Function Applications that are not configured with Network Security Groups. 

OCI Function Applications allow you to execute code in response to events without provisioning or managing infrastructure. When these function applications are not configured with NSGs, they are more vulnerable to unauthorized access and potential security breaches. NSGs help isolate and protect your functions by ensuring that only trusted sources can communicate with them.

As a best practice, it is recommended to restrict access to the application traffic by configuring network security groups.
This is applicable to oci cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To configure Network Security Group for your function application, refer below URL:
https://docs.oracle.com/en-us/iaas/Content/Functions/Tasks/functionsusingnsgs.htm
NOTE: Before you update Function Application with Network security group, make sure you have a restrictive Network Security Group already created with only specific traffic ports based on requirement..

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-functions-applications' AND json.rule = lifecycleState equal ignore case ACTIVE and (networkSecurityGroupIds does not exist or networkSecurityGroupIds[*] is empty)```
OCI Default Security List of every VCN allows all traffic on SSH port (22)
This policy identifies OCI Default Security lists associated with every VCN that allow unrestricted ingress access to port 22. It is recommended that no security group allows unrestricted ingress access to port 22. As a best practice, remove unfettered connectivity to remote console services, such as Secure Shell (SSH),  to reduce server's exposure to risk.
This is applicable to oci cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the resource reported in the alert into the Search box at the top of the Console.3. Click the resource reported in the alert from the Resources submenu
4. Under Resources, click Ingress Rules.
5. If you want to add a rule, click Add Ingress Rules
6. If you want to delete an existing rule, click the Actions icon (three dots), and then click Remove.
7. If you wanted to edit an existing rule, click the Actions icon (three dots), and then click Edit..

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-security-list' AND json.rule = (displayName contains "Default Security List for") and (ingressSecurityRules[?any((source equals 0.0.0.0/0) and (((*.destinationPortRange.min == 22 or *.destinationPortRange.max == 22) or (*.destinationPortRange.min < 22 and *.destinationPortRange.max > 22)) or (protocol equals "all") or ((tcpOptions does not exist) and (udpOptions does not exist) and (protocol does not equal 1))))] exists)```
OCI Load balancer not configured with Network Security Groups
This policy identifies Load balancers that are not configured with Network Security Groups.

Without Network Security Groups, load balancers may be exposed to unwanted traffic, increasing the risk of security breaches and unauthorized access. NSGs allow administrators to define security rules that specify the types of traffic allowed to flow in and out of the load balancer, enhancing overall network security.

As a best practice, it is recommended to restrict access to the load balancer by configuring network security groups.
This is applicable to oci cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to OCI console
2. Go to Networking -> Load Balancers
3. Click on the reported load balancer
NOTE: Before you update load balancer with Network security group, make sure you have a restrictive Network Security Group already created with only specific traffic ports based on requirements. 
4. On the 'Load Balancer Details' page, click on the 'Edit' button next to 'Network Security Groups' to make the changes.
5. On the 'Edit Network Security Groups' dialog, select the restrictive Network Security Group and click on the 'Save Changes' button..

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-loadbalancer' AND json.rule = lifecycleState equals ACTIVE and networkSecurityGroupIds[*] does not exist```
OCI File Storage File System access is not restricted to root users
This policy identifies the OCI File Storage File Systems that allow unrestricted access to root users. It is recommended that File Storage File Systems should limit root users access by restricting the privileges, to increase the security of File Systems.
This is applicable to oci cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['PRIVILEGE_ESCALATION'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the resource reported in the alert into the Search box at the top of the Console.
3. Click the resource reported in the alert from the Resources submenu
4. Click on the export path reported in the alert
5. Click on Edit NFS Export Options
6. Update the NFS Export Options where Squash is set Root and update Squash UID and Squash GID to 65534.

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-file-storage-export' AND json.rule = exportOptions[?any( identitySquash equals ROOT and (anonymousGid does not equal 65534 or anonymousUid does not equal 65534))] exists```
IBM Cloud Key Protect root key automatic key rotation is not enabled
This policy identifies IBM Cloud Key Protect root keys that are not enabled with automatic key rotation. As a security best practice, it is important to rotate the keys periodically. So that if the keys are compromised, the data in the underlying service is still secure with the new keys.
This is applicable to ibm cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Log in to the IBM Cloud console.
2. Click on Menu Icon and navigate to 'Resource list', From the list of resources, under security section, select your provisioned instance of Key Protect, in which the reported root key resides.
3. Select the key and click on the three dots on the right corner of the row to open the list of options for the key for which you want to set the rotation policy.
4. Click on 'Rotate'
5. In order to set the rotation policy, Under 'Manage rotation policy' section, enable the 'Rotation policy' checkbox and select the day intervals for the key rotation as per the requirement.
6. Click on the 'Set policy' button to establish this policy..

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-key-protect-key' AND json.rule = extractable is false and state equals 1 and ((policy[*].rotation exists and policy[*].rotation.enabled is false ) or policy[*].rotation does not exist)```
GCP project is configured with legacy network
This policy identifies the projects which have configured with legacy networks. Legacy networks have a single network IPv4 prefix range and a single gateway IP address for the whole network. Subnetworks cannot be created in a legacy network. Legacy networks can have an impact on high network traffic projects and subject to the single point of failure.
This is applicable to gcp cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: For each Google Cloud Platform project,
Follow the documentation and delete the reported network which is in the legacy mode:
https://cloud.google.com/vpc/docs/using-legacy.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-networks-list' AND json.rule = 'autoCreateSubnetworks does not exist'```
GCP API key not restricted to use by specified Hosts and Apps
This policy identifies GCP API key not restricted to use by specified Hosts and Apps. Unrestricted keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API key usage to trusted hosts, HTTP referrers and apps.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to google cloud console
2. Navigate to 'Credentials', Under service 'APIs & Services' (Left Panel)
3. In the section 'API Keys', Click on the reported 'API Key Name'
4. In the 'Key restrictions' section, set the application restrictions to any of HTTP referrers, IP Adresses, Android Apps, iOS Apps.
5. Click 'SAVE'.
Note: Do not set 'HTTP referrers' to wild-cards (* or *.[TLD] or *.[TLD]/*). 
Do not set 'IP addresses' restriction to any overly permissive IP (0.0.0.0 or 0.0.0.0/0 or ::0 or ::/0).

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-api-key' AND json.rule = (restrictions.browserKeyRestrictions does not exist and restrictions.serverKeyRestrictions does not exist and restrictions.androidKeyRestrictions does not exist and restrictions.iosKeyRestrictions does not exist) or (restrictions.browserKeyRestrictions exists and (restrictions.browserKeyRestrictions[?any(allowedReferrers[*] equals "*")] exists or restrictions.browserKeyRestrictions[?any(allowedReferrers[*] equals "*.[TLD]")] exists or restrictions.browserKeyRestrictions[?any(allowedReferrers[*] equals "*.[TLD]/*")] exists)) or (restrictions.serverKeyRestrictions exists and (restrictions.serverKeyRestrictions[?any(allowedIps[*] equals 0.0.0.0)] exists or restrictions.serverKeyRestrictions[?any(allowedIps[*] equals 0.0.0.0/0)] exists or restrictions.serverKeyRestrictions[?any(allowedIps[*] equals ::/0)] exists  or restrictions.serverKeyRestrictions[?any(allowedIps[*] equals ::0)] exists))```
Demo AWS Security Group overly permissive to all traffic
This policy identifies Security groups that are overly permissive to all traffic. Doing so, may allow a bad actor to brute force their way into the system and potentially get access to the entire network. Review your list of security group rules to ensure that your resources are not exposed. As a best practice, restrict traffic solely from known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
This is applicable to aws cloud and is considered a high severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: Before making any changes, please check the impact on your applications/services. If the Security Group reported indeed need to restrict all traffic, follow the instructions below:
1. Log in to the AWS Console
2. Navigate to the 'VPC' service
3. Select the 'Security Group' reported in the alert
4. Click on the 'Inbound Rule'
5. Remove the rule which has 'Source' value as 0.0.0.0/0 or ::/0..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-ec2-describe-security-groups' and json.rule = groupName contains "ahazra" ```
Azure SQL server TDE protector is not encrypted with BYOK (Use your own key)
This policy identifies Bring Your Own Key(BYOK) support for Transparent Data Encryption(TDE) in SQL server. The data encryption key(DEK) can be protected with an asymmetric key that is stored in the Key Vault which allows user control of TDE encryption keys and restricts who can access them and when.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure Portal
2. Navigate to 'SQL servers' dashboard, and select the SQL server instance you want to modify
3. In the left navigation, select 'Transparent data encryption'
4. Select Customer-managed key > Select a key > Change key
- In Key vault, select an existing key vault or create new key vault
- In Key, select an existing key or create a new key
- In Version, select an existing version or create new version
OR
Select Customer-managed key > Enter a key identifier
- In Key identifier add key vault URI, if URI is already noted.
5. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-sql-server-list' AND json.rule = sqlEncryptionProtectors[*].kind != azurekeyvault and sqlEncryptionProtectors[*].properties.serverKeyType != AzureKeyVault and sqlEncryptionProtectors[*].properties.uri !exists```
Azure Activity Log alert for Create or Update Public IP does not exist

This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals does not equal Microsoft.Network/publicIPAddresses/write and properties.condition.allOf[?(@.field=='category')].['equals'] contains Administrative" as X; count(X) less than 1```
Azure Spring Cloud app end-to-end TLS is disabled
This policy identifies Azure Spring Cloud apps in which end-to-end TLS is disabled. Enabling end-to-end TLS/SSL will secure traffic from ingress controller to apps. After you enable end-to-end TLS and load a cert from the key vault, all communications within Azure Spring Cloud are secured with TLS. As a security best practice, it is recommended to have an end-to-end TLS to secure Spring Cloud apps traffic.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal
2. Go to Azure Spring Cloud dashboard
3. Choose Azure Spring Cloud service for which Azure Spring Cloud app is reported
4. Under the 'Settings', click on 'Apps'
5. Click on reported Azure Spring Cloud app
6. Under the 'Settings', click on 'Ingress-to-app TLS'
7. Set 'Yes' to 'Ingress-to-app TLS'.

Query:
```config from cloud.resource where api.name = 'azure-spring-cloud-service' AND json.rule = properties.powerState equals Running and sku.tier does not equal Basic as X; config from cloud.resource where api.name = 'azure-spring-cloud-app' AND json.rule = properties.provisioningState equals Succeeded and properties.enableEndToEndTLS is false as Y; filter '$.X.name equals $.Y.serviceName'; show Y;```
Alibaba Cloud Security group allow internet traffic to SMTP port (25)
This policy identifies Security groups that allow inbound traffic on SMTP port (25) from the public internet. As a best practice, restrict security groups to only allow permitted traffic and limit brute force attacks on your network.
This is applicable to alibaba_cloud cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Alibaba Cloud Portal
2. Go to Elastic Compute Service
3. In the left-side navigation pane, choose Network & Security > Security Groups
4. Select the reported security group and then click Add Rules in the Actions column
5. In Inbound tab, Select the rule having 'Action' as Allow, 'Authorization Object' as 0.0.0.0/0 and 'Port Range' value as 25, Click Modify in the Actions column
6. Replace the value 0.0.0.0/0 with specific IP address range.
7. Click on 'OK'.

Query:
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-security-group' AND json.rule = "permissions is not empty and permissions[?(@.policy=='Accept' && @.direction=='ingress' && @.sourceCidrIp=='0.0.0.0/0')].portRange contains _Port.inRange(25,25)"```
GCP VM Instances enabled with Pre-Emptible termination
Checks to verify if any VM instance is initiated with the flag 'Pre-Emptible termination' set to True. Setting this instance to True implies that this VM instance will shut down within 24 hours or can also be terminated by a Service Engine when high demand is encountered. While this might save costs, it can also lead to unexpected loss of service when the VM instance is terminated.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Once a VM instance is started with Pre-Emptible set to Yes, it cannot be changed. If this instance with Pre-Emptible set is a critical resource, then spin up a new VM instance with necessary services, processes, and updates so that there will be no interruption of services..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = 'scheduling.preemptible equals true and (status equals RUNNING and name does not start with "gke-")'```