knarayan/cloud_posture_checks huggingface dataset:
Azure Activity log alert for Create policy assignment does not exist
This policy identifies the Azure accounts in which activity log alert for Create policy assignment does not exist. Creating an activity log alert for Create policy assignment gives insight into changes done in azure policy - assignments and may reduce the time it takes to detect unsolicited changes.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure Portal
2. Click on Monitor (Left Panel)
3. Select 'Alerts'
4. Click on Create > Alert rule
5. In 'Create an alert rule' page, choose the Scope as your Subscription and under the CONDITION section, choose 'Create policy assignment (Microsoft.Authorization/policyAssignments)' and Other fields you can set based on your custom settings.
6. Click on Create.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Authorization/policyAssignments/write" as X; count(X) less than 1```
AWS CloudFront origin protocol policy does not enforce HTTPS-only
This policy identifies AWS CloudFront which has an origin protocol policy that does not enforce HTTPS-only. Enforcing HTTPS protocol policy between origin and CloudFront will encrypt all communication and will be more secure. As a security best practice, enforce HTTPS-only traffic between a CloudFront distribution and the origin.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: Communication between CloudFront and your Custom Origin should enforce HTTPS-only traffic. Modify the CloudFront Origin's Origin Protocol Policy to HTTPS only.

1. Go to the AWS console CloudFront dashboard.
2. Select your distribution Id.
3. Select the 'Origins' tab.
4. Check the origin you want to modify then select Edit.
5. Change the Origin Protocol Policy to 'https-only.'
6. Select 'Yes, Edit.'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = enabled is true and origins.items[*] contains customOriginConfig and origins.items[?any(customOriginConfig.originProtocolPolicy does not contain https-only and ( domainName contains ".data.mediastore." or domainName contains ".mediapackage." or domainName contains ".elb." ))] exists```
OCI Load balancer not configured with Web application firewall (WAF)
This policy identifies OCI Load balancers that are not configured with a Web application firewall (WAF).

A Web Application Firewall (WAF) helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. Without WAF, load balancers are vulnerable to various web-based attacks, including SQL injection, cross-site scripting (XSS), and other common exploits. This can lead to unauthorized access, data breaches, and other security incidents.

As a best practice, it is recommended to configure Web Application Firewall (WAF) for OCI Load Balancers to enhance security.
This is applicable to oci cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To configure an OCI Load Balancer with a Web Application Firewall (WAF), refer to the following documentation:
https://docs.oracle.com/en/learn/oci-waf-flex-lbaas/index.html#introduction.

Query:
```config from cloud.resource where api.name = 'oci-networking-loadbalancer' AND json.rule = listeners.*.protocol equals HTTP and lifecycleState equals ACTIVE and isPrivate is false as X; config from cloud.resource where api.name = 'oci-loadbalancer-waf' AND json.rule = lifecycleState equal ignore case ACTIVE and (webAppFirewallPolicyId exists and webAppFirewallPolicyId does not equal "null") as Y; filter 'not ($.X.id equals $.Y.loadBalancerId) '; show X;```
AWS EMR cluster is not enabled with termination protection
This policy identifies the AWS EMR Cluster that is not enabled with termination protection.

Termination protection serves as a safeguard against unintentional termination of your clusters. When this feature is enabled, any efforts to terminate the cluster via the AWS Management Console, CLI, or API will be prevented unless the protection is deliberately disabled beforehand. This feature is particularly beneficial for long-running or essential clusters, as accidental termination could lead to data loss or considerable downtime.

It is advisable to activate termination protection on AWS EMR clusters to prevent accidental terminations.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To turn termination protection on for the AWS EMR cluster with the console, Perform the following actions:

1. Sign in to the AWS Management Console, and open the Amazon EMR console at https://console.aws.amazon.com/emr
2. Under EMR on EC2 in the left navigation pane, choose 'Clusters'
3. Click on the cluster that is reported
4. On the 'Properties' tab on the cluster details page, Under 'Cluster termination and node replacement' section click 'Edit'
5. Select to use 'Termination protection' check box to turn the feature on or off
6. Select 'Save changes' to confirm.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-emr-describe-cluster' AND json.rule = status.state does not contain TERMINATING and terminationProtected is false```
Azure Database for MySQL flexible server public network access setting is enabled
This policy identifies Azure Database for MySQL flexible servers which have public network access setting enabled.

Publicly accessible MySQL servers are vulnerable to external threats with risk of unauthorized access or may remotely exploit any vulnerabilities.

As a best security practice, it is recommended to configure the MySQL servers with IP-based strict server-level firewall rules or virtual-network rules or private endpoints so that servers are accessible only to restricted entities.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To configure IP-based strict server-level firewall rules on your MySQL server, follow below URL:
https://learn.microsoft.com/en-gb/azure/mysql/flexible-server/how-to-manage-firewall-portal

To configure virtual-network rules on your MySQL server, follow below URL:
https://learn.microsoft.com/en-gb/azure/mysql/flexible-server/how-to-manage-virtual-network-portal

To configure private endpoints on your MySQL server, follow below URL:
https://learn.microsoft.com/en-gb/azure/mysql/flexible-server/how-to-networking-private-link-portal

NOTE: These settings take effect immediately after they're applied. You might experience connection loss if you don't meet the requirements for each setting..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-mysql-flexible-server' AND json.rule = properties.state equal ignore case Ready and firewallRules[*] is empty and properties.network.publicNetworkAccess equal ignore case Enabled```
OCI Hosts test - Ali

This is applicable to oci cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where resource.status = Active AND api.name = 'oci-compute-instance' AND json.rule = lifecycleState exists```
GCP Firewall rule allows all traffic on SMTP port (25)
This policy identifies GCP Firewall rules which allow all inbound traffic on SMTP port (25). Allowing access from arbitrary IP addresses to this port increases the attack surface of your network. It is recommended that the SMTP port (25) should be allowed to specific IP addresses.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: If the Firewall rule reported indeed needs to restrict all traffic, follow the instructions below:
1. Login to GCP Console
2. Go to 'VPC Network'
3. Go to the 'Firewall'
4. Click on the reported Firewall rule
5. Click on 'EDIT'
6. Modify Source IP ranges to specific IP
7. Click on 'SAVE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-firewall-rules-list' AND json.rule = disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(ports contains _Port.inRange(25,25) or (ports does not exist and (IPProtocol contains tcp or IPProtocol contains udp)))] exists```
Azure Key Vault secret has no expiration date (RBAC Key vault)
This policy identifies Azure Key Vault secrets that do not have an expiry date for the RBAC Key vaults. As a best practice, set an expiration date for each secret and rotate the secret regularly.

Before you activate this policy, ensure that you have added the Prisma Cloud Service Principal to each Key Vault: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/connect-your-cloud-platform-to-prisma-cloud/onboard-your-azure-account/azure-onboarding-checklist

Alternatively, run the following command on the Azure cloud shell:
az keyvault list | jq '.[].id' | xargs -I {} az role assignment create --assignee "<Object ID of Prisma Cloud Principal>" --role "Key Vault Reader" --scope {}
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal.
2. Select 'All services' > 'Key vaults'.
3. Select the Key vault instance where the secrets are stored.
4. Select 'Secrets', and select the secret that you need to modify.
5. Select the current version.
6. Set the expiration date.
7. 'Save' your changes..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-key-vault-list' and json.rule = secrets[?any(attributes.exp equals -1 and attributes.enabled contains true)] exists and properties.enableRbacAuthorization is true```
AWS CodeBuild project environment privileged mode is enabled
This policy identifies the CodeBuild projects where the privileged mode is enabled. Privileged mode grants unrestricted access to all devices and runs the Docker daemon inside the container. It is recommended to enable this mode only for building Docker images. It recommended disabling the privileged mode to prevent unintended access to Docker APIs and container hardware, reducing the risk of potential tampering or critical resource deletion.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To disable the Privileged mode for the CodeBuild project:

1. Log in to the AWS Management Console.
2. In the console, select the specific region from the region drop-down in the top right corner, for which the alert is generated.
3. Navigate to 'Developer Tools' from the 'Services' dropdown and select the 'CodeBuild'.
4. In the navigation pane, choose 'Build projects'.
5. Select the reported Build project and choose Edit, then click ‘Environment'.
6. On the Edit Environment page, expand the configuration by clicking the 'Override image' button.
7. Uncheck the checkbox 'Enable this flag if you want to build Docker images or want your builds to get elevated privileges.' under the 'Privileged' section.
8. When you have finished changing your CodeBuild environment configuration, click ‘Update environment’..

Query:
```config from cloud.resource where api.name = 'aws-code-build-project' AND json.rule = environment.privilegedMode exists and environment.privilegedMode is true```
GCP SQL MySQL DB instance point-in-time recovery backup (Binary logs) is not enabled
This policy identifies Cloud SQL MySQL DB instances whose point-in-time recovery backup is not enabled. In case of an error, point-in-time recovery helps you recover an instance to a specific point in time. It is recommended to enable automated backups with point-in-time recovery to prevent any data loss in case of an unwanted scenario.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Follow the below mentioned URL to enable point-in-time recovery backup (Binary logs) for the reported MySQL instance:

https://cloud.google.com/sql/docs/mysql/backup-recovery/pitr.

Query:
```config from cloud.resource where api.name='gcloud-sql-instances-list' AND json.rule='$.settings.backupConfiguration.binaryLogEnabled is false and $.databaseVersion contains MYSQL'```
AWS Elastic IP not in use
This policy identifies unused Elastic IP (EIP) addresses in your AWS account. Any Elastic IP in your AWS account is adding charges to your monthly bill, although it is not associated with any resources. As a best practice, it is recommended to associate/remove Elastic IPs that are not associated with any resources, it will also help you avoid unexpected charges on your bill.

For more details:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html#using-instance-addressing-eips-associating
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the AWS Console
2. In the console, select the specific region from the region drop-down on the top right corner, for which the alert is generated.
3. Navigate to the VPC dashboard 
4. Go to 'Elastic IPs', from the left panel
5. Select the reported Elastic IP
- If Elastic IP is not required; release IP by selecting 'Release Elastic IP address' from the 'Actions' dropdown.
- If Elastic IP is required; associate IP by selecting 'Associate Elastic IP address' from the 'Actions' dropdown..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-elastic-address' AND json.rule = associationId does not exist```
AWS Security group changes are not monitored

This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "eventName=" or $.X.filterPattern contains "eventName =") and ($.X.filterPattern does not contain "eventName!=" and $.X.filterPattern does not contain "eventName !=") and $.X.filterPattern contains AuthorizeSecurityGroupIngress and $.X.filterPattern contains AuthorizeSecurityGroupEgress and $.X.filterPattern contains RevokeSecurityGroupIngress and $.X.filterPattern contains RevokeSecurityGroupEgress and $.X.filterPattern contains CreateSecurityGroup and $.X.filterPattern contains DeleteSecurityGroup) and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```
GCP PostgreSQL instance database flag log_parser_stats is not set to off
This policy identifies PostgreSQL database instances in which database flag log_parser_stats is not set to off. The PostgreSQL planner/optimizer is responsible to parse and verify the syntax of each query received by the server. The log_parser_stats flag enables a crude profiling method for logging parser performance statistics. Even though it can be useful for troubleshooting, it may increase the number of logs significantly and have performance overhead. It is recommended to set log_parser_stats as off.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to GCP console
2. Navigate SQL Instances page
3. Click on reported PostgreSQL instance
4. Click EDIT
5. If the flag has not been set on the instance, 
Under 'Customize your instance', click on 'ADD FLAG' in 'Flags' section, choose the flag 'log_parser_stats' from the drop-down menu and set the value as 'off'
OR
If the flag has been set to other than off, Under 'Customize your instance', In 'Flags' section choose the flag 'log_parser_stats' and set the value as 'off'
6. Click on 'DONE' and then 'SAVE'.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "state equals RUNNABLE and databaseVersion contains POSTGRES and (settings.databaseFlags[*].name does not contain log_parser_stats or settings.databaseFlags[?any(name contains log_parser_stats and value contains on)] exists)"```
Azure Logic App does not utilize HTTP 2.0 version
This policy identifies Azure Logic apps that are not utilizing HTTP 2.0 version.

Azure Logic app using HTTP 1.0 for its connection is considered not secure as HTTP 2.0 version has additional performance improvements on the head-of-line blocking problem of old HTTP version, header compression, and prioritisation of requests. HTTP 2.0 no longer supports HTTP 1.1's chunked transfer encoding mechanism, as it provides its own, more efficient, mechanisms for data streaming.

As a security best practice,  it is recommended to configure HTTP 2.0 version for Logic apps connections.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure portal
2. Navigate to Logic apps
3. Click on the reported Logic app
4. Under 'Setting' section, click on 'Configuration'
5. Under 'General settings' tab, Set 'HTTP version' to '2.0'
6. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case Running and kind contains workflowapp and config.http20Enabled is false```
dnd_test_create_hyperion_policy_system_policy_as_child_policies_ss_finding_1
Description-d2b8d109-2e3d-4743-8da0-41e105b5cecc
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['SSH_BRUTE_FORCE'].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = defaultRootObject is empty```
AWS RDS instance with copy tags to snapshots disabled
This policy identifies RDS instances that have copy tags to snapshots disabled. Copy tags to snapshots copies all the user-defined tags from the DB instance to snapshots. Copying tags allow you to add metadata and apply access policies to your Amazon RDS resources.

NOTE: Setting Copy tags to snapshots for an Aurora DB instance has no effect on the DB setting. So Aurora DB instances are excluded from policy check.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign into the AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated
3. Navigate to Amazon RDS console
4. Choose DB Instances, and then select the reported DB instance
5. Click on 'Modify'
6. In 'Additional Configuration' section, In 'Backup' sub-section select the 'Copy tags to snapshots'
7. Click on 'Continue'
8. On the 'Summary of Modifications' panel, review the configuration changes. From 'Scheduling of Modifications' section, select whether changes to 'Apply immediately' or 'Apply during the next scheduled maintenance window'.
9. On the confirmation page, Review the changes and Click on 'Modify DB Instance' to save your changes..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-rds-describe-db-instances' AND json.rule = dbinstanceStatus equals available and (copyTagsToSnapshot is false or copyTagsToSnapshot does not exist) and engine does not contain aurora and engine does not contain docdb and engine does not contain neptune```
AWS Elastic Load Balancer v2 (ELBv2) listener that allow connection requests over HTTP
This policy identifies Elastic Load Balancers v2 (ELBv2) listener that are configured to accept connection requests over HTTP instead of HTTPS. As a best practice, use the HTTPS protocol to encrypt the communication between the application clients and the application load balancer.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS console
2. Select the region, from the region drop-down, in which the alert is generated
3. Navigate to EC2 dashboard
4. Click on 'Load Balancers' (Left Panel)
5. Select the reported ELB
6. Click on 'Listeners' tab
7.'Edit' the 'Listener ID' rule that uses HTTP
8. Select 'HTTPS' in the 'Protocol : port' section, Choose appropriate Default action, Security policy and Default SSL certificate parameters as per your requirement.
9. Click on 'Update'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elbv2-describe-load-balancers' AND json.rule = state.code contains active and listeners[?any(protocol equals HTTP and defaultActions[?any(type equals redirect and redirectConfig.protocol equals HTTPS)] does not exist )] exists```