knarayan/cloud_posture_checks huggingface dataset:
AWS Web Application Firewall (AWS WAF) Classic logging is disabled
This policy identifies Classic Web Application Firewalls (AWS WAFs) for which logging is disabled. Enabling WAF logging, logs all web requests inspected by the service which can be used for debugging and additional forensics. The logs will help to understand why certain rules are triggered and why certain web requests are blocked. You can also integrate the logs with any SIEM and log analysis tools for further analysis. It is recommended to enable logging on your Classic Web Application Firewalls (WAFs).

For details:
https://docs.aws.amazon.com/waf/latest/developerguide/classic-logging.html

NOTE: Global (CloudFront) WAF resources are out of scope for this policy.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To enable logging on your reported WAFs, follow below mentioned URL:
https://docs.aws.amazon.com/waf/latest/developerguide/classic-logging.html#logging-management

NOTE: No additional cost to enable logging on AWS WAF (minus Kinesis Firehose and any storage cost).
For Kinesis Firehose or any storage additional charges refer https://aws.amazon.com/cloudwatch/pricing/.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-waf-classic-web-acl-resource' AND json.rule = '(resources.applicationLoadBalancer[*] exists or resources.apiGateway[*] exists or resources.other[*] exists) and loggingConfiguration.resourceArn does not exist'```
GCP Kubernetes Engine Clusters have Network policy disabled
This policy identifies Kubernetes Engine Clusters which have disabled Network policy. A network policy defines how groups of pods are allowed to communicate with each other and other network endpoints. By enabling network policy in a namespace for a pod, it will reject any connections that are not allowed by the network policy.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to GCP Portal
2. Go to Kubernetes Engine (Left Panel)
3. Select Kubernetes clusters
4. From the list of clusters, choose the reported cluster
5. Under 'Networking', Click on EDIT button for 'Calico Kubernetes Network policy'
6. Select 'Enable Calico Kubernetes network policy for control plane'
7. Click on Save
8. Repeat Step 5 and Select 'Enable Calico Kubernetes network policy for nodes'
9. Click on Save.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = networkConfig.datapathProvider does not equal ADVANCED_DATAPATH and (addonsConfig.networkPolicyConfig.disabled is true or networkPolicy.enabled does not exist or networkPolicy.enabled is false )```
Azure Storage Account without Secure transfer enabled
This policy identifies Storage accounts which have Secure transfer feature disabled. The secure transfer option enhances the security of your storage account by only allowing requests to the storage account by a secure connection.

When "secure transfer required" is disabled,REST APIs to access your storage accounts may connect over insecure HTTP which is not advised. Hence, it is highly recommended to enable secure transfer feature on your storage account.

NOTE: Azure storage doesn't support HTTPs for custom domain names, this option is not applied when using a custom domain name. Additionally, this property is not applicable for NFS Azure file shares to work.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To enable secure transfer feature on your storage account, follow below URL:
https://learn.microsoft.com/en-gb/azure/storage/common/storage-require-secure-transfer#require-secure-transfer-for-an-existing-storage-account.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = (properties.supportsHttpsTrafficOnly does not exist or properties.supportsHttpsTrafficOnly is false) as X; config from cloud.resource where api.name = 'azure-storage-file-shares' as Y; filter '($.X.kind does not equal ignore case "FileStorage") or ($.X.kind equal ignore case "FileStorage" and $.Y.id contains $.X.name and $.Y.properties.enabledProtocols does not contain NFS)'; show X;```
pcsup-gcp-policy

This is applicable to gcp cloud and is considered a high severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND resource.status = Active AND json.rule = tags[*].key none equal "application" AND tags[*].key none equal "Application"```
jashah_ms_join_pol

This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' AND json.rule = _AWSCloudAccount.orgHierarchyNames() intersects ("all-accounts") as X; config from cloud.resource where api.name = 'aws-ec2-describe-subnets' AND json.rule = _AWSCloudAccount.orgHierarchyNames() intersects ("all-accounts") as Y; filter '$.X.vpcId equals $.Y.vpcId'; show Y;```
Alibaba Cloud RAM password retry constraint policy is disabled
This policy identifies Alibaba Cloud accounts for which password retry constraint policy is disabled. As a best practice, enable RAM password retry constraint policy to prevent multiple login attempts with an incorrect password within an hour.
This is applicable to alibaba_cloud cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['WEAK_PASSWORD'].
Mitigation of this issue can be done as follows: 1. Log in to Alibaba Cloud Portal
2. Go to Resource Access Management (RAM) service
3. In the left-side navigation pane, click on 'Settings'
4. In the 'Security Settings' tab, In the 'Password Strength Settings' Section, Click on 'Edit Password Rule'
5. In the 'Password Retry Constraint Policy' field, enter the value between 1 to 32 instead of 0 based on your requirement.
6. Click on 'OK'
7. Click on 'Close'.

Query:
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ram-password-policy' AND json.rule =  'maxLoginAttemps !isType Integer or maxLoginAttemps == 0'```
IBM Cloud Application Load Balancer for VPC has public access enabled
This policy identifies IBM Cloud Application Load Balancer for VPC which has public access enabled. Creating a load balancer with public access will lead to unexpected malicious requests getting sent to the public DNS address assigned. A private load balancer is only accessible from within a specific virtual private cloud (VPC). It is highly recommended to use load balancers of type private to protect from unauthorized access.
This is applicable to ibm cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: A Load balancer can be made private only at the time of creation. To create a private application
load balancer, follow below URL:
https://cloud.ibm.com/docs/vpc?topic=vpc-load-balancer&interface=ui
Make sure to select 'Private' for load balancer 'Type' under 'details' section.

Note: Please make sure to create new load balancer in accordance with alerted resource.
Also update load balancer reference at all the clients/places of usage with newly created
load balancer..

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-loadbalancer' AND json.rule = profile.family equal ignore case "application" and operating_status equal ignore case "online" and is_public is true```
Azure Function App with public access linked to Blob Storage
This policy identifies Azure Function Apps configured with public access and linked to Azure Blob Storage.

Azure Function Apps often access Blob Storage to retrieve or store data. When public access is enabled for the Function App, it exposes the application and, potentially, the associated Blob Storage to unauthorized access, leading to potential security risks.

As a security best practice, it is recommended to evaluate public access for Azure Function Apps and secure Azure Blob Storage.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To restrict access to App Service and secure Azure Blob Storage, refer to the following links for security recommendations:

https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions
https://learn.microsoft.com/en-us/azure/storage/blobs/security-recommendations.

Query:
```config from cloud.resource where api.name = 'azure-storage-account-list' as X; config from cloud.resource where api.name = 'azure-app-service-web-apps-configurations' as Y; config from cloud.resource where api.name = 'azure-app-service' AND json.rule = 'kind contains functionapp and kind does not contain workflowapp and kind does not equal app and properties.state equal ignore case running and ((properties.publicNetworkAccess exists and properties.publicNetworkAccess equal ignore case Enabled) or (properties.publicNetworkAccess does not exist)) and config.ipSecurityRestrictions[?any((action equals Allow and ipAddress equals Any) or (action equals Allow and ipAddress equals 0.0.0.0/0))] exists' as Z; filter ' $.Y.properties.azureStorageAccounts contains $.X.name and $.Z.name equal ignore case $.Y.name' ; show Z;```
Azure Logic app does not redirect HTTP requests to HTTPS
This policy identifies Azure Logic apps that fail to redirect HTTP traffic to HTTPS.

By default, Azure Logic app data is accessible through unsecured HTTP traffic. HTTP does not include any encryption and data sent over HTTP is susceptible to interception and eavesdropping. To secure web traffic, use HTTPS which incorporates encryption through SSL/TLS protocols, providing a secure channel over which data can be transmitted safely.

As a security best practice,  it is recommended to configure HTTP to HTTPS redirection to prevent unauthorized parties from being able to read or modify the data in transit.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure portal
2. Navigate to Logic apps
3. Click on the reported Logic app
4. Under 'Setting' section, click on 'Configuration'
5. Under 'General settings' tab, Select 'On' radio button for 'HTTPS Only' option.
6. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case Running and kind contains workflowapp and properties.httpsOnly is false```
GCP Project audit logging is not configured properly across all services and all users in a project
This policy identifies the GCP projects in which cloud audit logging is not configured properly across all services and all users. It is recommended that cloud audit logging is configured to track all Admin activities and read, write access to user data. Logs should be captured for all users and there should be no exempted users in any of the audit config section.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. To read the project's IAM policy and store it in a file run a command:
gcloud projects get-iam-policy [PROJECT_ID] > /tmp/policy.yaml
2. Edit policy in /tmp/policy.yaml, adding or changing only the audit logs configuration to:
auditConfigs:
- auditLogConfigs:
	- logType: DATA_WRITE
	- logType: DATA_READ
service: allServices
Note: Make sure 'exemptedMembers:' is not set, as audit logging should be enabled for all the users.
3. To set audit config run:
gcloud projects set-iam-policy [PROJECT_ID] /tmp/policy.yaml.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-iam-get-audit-config' AND json.rule = 'auditConfigs[*].service does not contain allServices or (auditConfigs[*].auditLogConfigs[*].exemptedMembers exists and auditConfigs[*].auditLogConfigs[*].exemptedMembers is not empty)'```
IBM Cloud Key Protect Key dual authorization for deletion is not enabled
This policy identifies IBM Cloud Key Protect Key that has dual authorization for deletion is disabled. Dual authorization for Key Protect service instances is an extra policy that helps to prevent accidental or malicious deletion of keys in your Key Protect instance. It is recommended that dual authorization for deletion of all keys in a Key Protect instance is enabled.
This is applicable to ibm cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Login to IBM Cloud CLI
2. For setting up the IBM cloud CLI for Key Protect, please refer to the below URL: 
https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-cli#install-cli
3. To change the region where the reported Key Protect instance is located, run the following IBM cloud CLI command:
ibmcloud target -r <TARGET_INSTANCE_REGION> 
4. To enable dual authorization policy for your Key Protect instance key, run the following IBM cloud CLI command:
ibmcloud kp key policy-update dual-auth-delete <Reported KeyID or KEY_ALIAS> --enable --instance-id <TARGET_INSTANCE_ID where the reported key is present>
Reference: https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference#kp-key-policy-update-dual
 5. To enable dual authorization settings at the instance level, Please refer to the below URL.
https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-dual-auth.

Query:
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-key-protect-key' AND json.rule = dualAuthDelete does not exist or dualAuthDelete.enabled is false```
OCI tenancy administrator users are associated with API keys
This policy identifies OCI users who are the members of Administrators group, has API keys associated. It is recommended not to allow OCI users with API keys to have direct tenancy access, to preserve privileged security principle. As a best practice, dissociate the API keys for the OCI Users of Administrators group and use Service-level administrative users with API keys instead.
This is applicable to oci cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['KEYS_AND_SECRETS'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console Page: https://console.ap-mumbai-1.oraclecloud.com/
2. Select Identity from Services menu.
3. Select Users from Identity menu.
4. For each tenancy administrator user who has an API key, select API Keys from the menu in the lower left hand corner.
5. Delete any associated keys from the API Keys table.

Note : The console URL is region specific, your tenancy might have a different home region and thus console URL..

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-iam-group' as X; config from cloud.resource where api.name = 'oci-iam-user' as Y; filter '($.X.name equals Administrators) and ($.X.groupMembers[*].userId contains $.Y.id) and ($.Y.apiKeys[*] size greater than 0)';show Y;```
DemoAggPolicy - AWS S3 Object Versioning is disabled
This policy identifies the S3 buckets which have Object Versioning disabled. S3 Object Versioning is an important capability in protecting your data within a bucket. Once you enable Object Versioning, you cannot remove it; you can suspend Object Versioning at any time on a bucket if you do not wish for it to persist. It is recommended to enable Object Versioning on S3.
This is applicable to aws cloud and is considered a high severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Log into your AWS Console and select the S3 service.
2. Choose the reported S3 bucket and click the Properties tab in the upper right frame.
3. Expand the Versioning option
4. Click Enable Versioning
5. Click Save.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = 'versioningConfiguration.status!=Enabled'```
GCP Memorystore for Redis instance does not use in transit encryption
This policy identifies GCP Memorystore for Redis instances with no in transit encryption.

GCP Memorystore for Redis is a fully managed in-memory data store that simplifies Redis deployment and scaling while ensuring high availability and low-latency access. When in-transit encryption is disabled, all data transmitted between your clients and Redis flows as plaintext over the network, making it vulnerable to man-in-the-middle attacks and packet sniffing, potentially exposing sensitive information like session tokens, personal data, or business secrets.

It is recommended to enable In transit encryption for GCP Memorystore for Redis to prevent malicious actors from intercepting sensitive data.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: In-transit encryption cannot be changed for existing Memorystore for Redis instances. A new Memorystore for Redis instance instance should be created.

To create a new Memorystore for Redis instance with In-transit encryption , please refer to the steps below:

1. Sign in to the Google Cloud Management Console. Navigate to the 'Memorystore for Redis' page
2. Click on the 'CREATE INSTANCE'
3. Provide all the other details as per the requirements
4. Under 'Security', select the 'Enable in-transit encryption' checkbox
5. Click on the 'CREATE INSTANCE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-redis-instances-list' AND json.rule = state equal ignore case ready and transitEncryptionMode does not equal ignore case SERVER_AUTHENTICATION```
Azure storage account infrastructure encryption is disabled
The policy identifies Azure storage accounts for which infrastructure encryption is disabled.

Infrastructure double encryption adds a second layer of encryption using service-managed keys. When infrastructure encryption is enabled for a storage account or an encryption scope, data is encrypted twice. Once at the service level and once at the infrastructure level - with two different encryption algorithms and two different keys. Infrastructure encryption is recommended for scenarios where double encrypted data is necessary for compliance requirements.

It is recommended to enable infrastructure encryption on Azure storage accounts so that encryption can be implemented at the layer closest to the storage device or network wires.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Configuring Infrastructure double encryption for Azure Storage accounts is only allowed during storage account creation. Once the storage account is provisioned, you cannot change the storage encryption.

To create an Azure Storage account with Infrastructure double encryption, follow the below URL:
https://learn.microsoft.com/en-us/azure/storage/common/infrastructure-encryption-enable

NOTE: Using Infrastructure double encryption will have performance impact on the read and write speeds of Azure storage accounts due to the additional encryption process..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded and (properties.encryption.requireInfrastructureEncryption does not exist or properties.encryption.requireInfrastructureEncryption is false)```
OCI VCN Security list has stateful security rules
This policy identifies the OCI Virtual Cloud Networks (VCN) security lists that have stateful ingress rules configured in their security lists. It is recommended that Virtual Cloud Networks (VCN) security lists are configured with stateless ingress rules to slow the impact of a denial-of-service (DoS) attack.
This is applicable to oci cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the resource reported in the alert into the Search box at the top of the Console.
3. Click the resource reported in the alert from the Resources submenu
4. Click on Ingress rule where Stateless column is set to No
5. Click on Edit
6. Select the checkbox STATELESS
7. Click on Save Changes.

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-security-list' AND json.rule = ingressSecurityRules[?any( isStateless is false )] exists```
GCP Firewall rule allows all traffic on NetBIOS-SSN port (139)
This policy identifies GCP Firewall rules which allow all inbound traffic on NetBIOS-SSN port (139). Allowing access from arbitrary IP addresses to this port increases the attack surface of your network. It is recommended that the NetBIOS-SSN port (139) should be allowed to specific IP addresses.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: If the Firewall rule reported indeed needs to restrict all traffic, follow the instructions below:
1. Login to GCP Console
2. Go to 'VPC Network'
3. Go to the 'Firewall'
4. Click on the reported Firewall rule
5. Click on 'EDIT'
6. Modify Source IP ranges to specific IP
7. Click on 'SAVE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-firewall-rules-list' AND json.rule = disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(ports contains _Port.inRange(139,139) or (ports does not exist and (IPProtocol contains tcp or IPProtocol contains udp)))] exists```
AWS RDS event subscription disabled for DB security groups
This policy identifies RDS event subscriptions for which DB security groups event subscription is disabled. You can create an Amazon RDS event notification subscription so that you can be notified when an event occurs for given DB security groups.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign into the AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated
3. Navigate to Amazon RDS Dashboard
4. Click on 'Event subscriptions' (Left Panel)
5. Choose the reported Event subscription
6. Click on 'Edit'
7. On 'Edit event subscription' page, Under 'Details' section; Select 'Yes' for 'Enabled' and Make sure you have subscribed your DB to 'All instances' and 'All event categories'
8. Click on 'Edit'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-rds-describe-event-subscriptions' AND json.rule = 'sourceType equals db-security-group and ((status does not equal active or enabled is false) or (status equals active and enabled is true and (sourceIdsList is not empty or eventCategoriesList is not empty)))'```