knarayan/cloud_posture_checks huggingface dataset:
AWS Database Migration Service (DMS) has expired certificates
This policy identifies expired certificates that are in AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) Certificate service is the preferred tool to provision, manage, and deploy your DMS endpoint certificates. As a best practice, it is recommended to delete expired certificates.

For more details:
https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Security.html#CHAP_Security.SSL.ManagingCerts
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the AWS Console
2. In the console, select the specific region from the region drop-down on the top right corner, for which the alert is generated
3. Navigate to 'AWS DMS' service
4. Click on 'Certificates', Choose the reported certificate
5. Make sure the reported certificate is already out of date from the 'Valid to' field
6. Click on 'Delete', to delete the expired certificate..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-dms-certificate' AND json.rule = '_DateTime.ageInDays(validToDate) > -1'```
GCP Kubernetes Engine Clusters network firewall inbound rule overly permissive to all traffic
This policy identifies Firewall rules attached to the cluster network which allows inbound traffic on all protocols from the public internet. Doing so may allow a bad actor to brute force their way into the system and potentially get access to the entire cluster network.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to GCP Portal
2. Go to VPC network (Left Panel)
3. Select Firewall rules
4. Click on the reported firewall rule
5. Click on the 'EDIT' button
6. Change the 'Source IP ranges' other than '0.0.0.0/0'
7. Click on 'Save'.

Query:
```config from cloud.resource where api.name = 'gcloud-container-describe-clusters' as X; config from cloud.resource where api.name = 'gcloud-compute-firewall-rules-list' as Y; filter '$.Y.network contains $.X.network and $.Y.sourceRanges contains 0.0.0.0/0 and $.Y.direction contains INGRESS and $.Y.allowed exists'; show Y;```
Azure Application Gateway does not have the Web application firewall (WAF) enabled
This policy identifies Azure Application Gateways that do not have Web application firewall (WAF) enabled. As a best practice, enable WAF to manage and protect your web applications behind the Application Gateway from common exploits and vulnerabilities.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Select 'Application gateways', and select the application gateway you need to modify
3. Select 'Web Application Firewall' under 'Settings'
4. Change the 'Tier' to 'WAF' or 'WAF V2' and 'Firewall status' to 'Enabled'
5. 'Save' your changes.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-gateway' AND json.rule = (['properties.webApplicationFirewallConfiguration'] does not exist and ['properties.firewallPolicy'] does not exist) or (['properties.webApplicationFirewallConfiguration'].enabled is false and ['properties.firewallPolicy'] does not exist)```
OCI Load balancer listener allows connection requests over HTTP
This policy identifies Oracle Cloud Infrastructure (OCI) Load Balancer listeners that accept connection requests over HTTP instead of HTTPS or HTTP/2 or TCP protocols.

Accepting connections over HTTP can expose data to potential interception and unauthorized access, as HTTP traffic is transmitted in plaintext. OCI Load balancer allow all traffic to be submitted over HTTPS or HTTP/2 or TCP, ensuring all communications are encrypted. These protocols provide encrypted communication channels, safeguarding sensitive information from eavesdropping, tampering, and man-in-the-middle attacks.

As a security best practice, it is recommended to configure the listeners to accept connections through HTTPS, HTTP/2, or TCP, thereby enhancing the protection of data in-transit.
This is applicable to oci cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To remediate we have 2 options:
- Update existing Load balancer listener to redirect HTTP traffic to HTTPS by creating Rule set.
- Delete existing listener associated and Create new listener protocol other than HTTP.

To redirect Load balancer HTTP traffic to HTTPS, follow:
1. Log in to OCI console
2. Open Networking -> Load Balancers
3. Click on the reported load balancer to open the details page
4. From the Resources pane, select 'Rule Sets' and then click on 'Create Rule Set' button
5. Choose name for Rule set and select 'Specify URL Redirect Rules'
6. In Redirect to section: Set 'Protocol' to HTTPS and 'Port' to 443; choose other parameters as per your requirement.
7. Click on 'Create'

To create new listener with protocol other than HTTP, follow:
1. Log in to OCI console
2. Open Networking -> Load Balancers
3. Click on the reported load balancer to open the details page
4. From the Resources pane, select 'Listeners' and then click on 'Create Listener' button
5. In Create Listener dailog, Select other parameters and 'Protocol' other than HTTP as per your requirement.
7. Click on 'Create'

To delete existing listener, follow:
https://docs.oracle.com/en-us/iaas/Content/Balance/Tasks/managinglisteners_topic-Deleting_Listeners.htm.

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-loadbalancer' AND json.rule = lifecycleState equals ACTIVE and listeners.* is not empty and listeners.*.protocol equal ignore case HTTP and ruleSets.*.items[?any(redirectUri.protocol equal ignore case https)] does not exist```
Azure Microsoft Defender for Cloud adaptive application controls monitoring is set to disabled
This policy identifies the Azure Microsoft Defender for Cloud (previously known as Azure Security Center and Azure Defender) policies which have adaptive application controls monitoring set to disabled. Adaptive Application Controls will make sure that only certain applications can run on your VMs in Microsoft Azure. This will prevent any malicious, unwanted, or unsupported software on the VMs.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Go to 'Microsoft Defender for Cloud'
3. Select 'Environment Settings'
4. Choose the reported subscription
5. Click on the 'Security policy' under 'Policy settings' section
6. Click on 'SecurityCenterBuiltIn'
7. Select 'Parameters' tab
8. Set the 'Adaptive application controls for defining safe applications should be enabled on your machines' to 'AuditIfNotExists'
9. If no other changes required then Click on 'Review + save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-policy-assignments' AND json.rule = '((name == SecurityCenterBuiltIn and properties.parameters.adaptiveApplicationControlsMonitoringEffect.value equals Disabled) or (name == SecurityCenterBuiltIn and properties.parameters[*] is empty and properties.displayName does not start with "ASC Default"))'```
GCP Vertex AI Workbench user-managed notebook has vTPM disabled
This policy identifies GCP Vertex AI Workbench user-managed notebooks that have Virtual Trusted Platform Module (vTPM) feature disabled. 

Virtual Trusted Platform Module (vTPM) validates guest VM pre-boot and boot integrity and offers key generation and protection. The vTPM’s root keys and the keys it generates can’t leave the vTPM, thus gaining enhanced protection from compromised operating systems or highly privileged project admins.

It is recommended to enable virtual TPM device on supported virtual machines to facilitate measured Boot and other OS security features that require a TPM.
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the GCP console
2. Navigate to the 'Vertex AI' service (Left Panel)
3. Under 'Notebooks', go to 'Workbench'
4. Open the 'USER-MANAGED NOTEBOOKS' tab
5. Click on the alerting notebook
6. Under the 'SYSTEM' tab, in front of 'VM details', click on the 'View in Compute Engine' link
7. Stop the VM by clicking on the 'STOP' button. Click the 'STOP' button on the confirmation dialogue.
8. Once the the VM has been stopped, click on the 'EDIT' button
9. Under 'Shielded VM', enable 'Turn on vTPM'
10. Click on 'Save'
11. Click on 'START/RESUME' from the top menu.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-vertex-ai-notebook-instance' AND json.rule = state equals "ACTIVE" and shieldedInstanceConfig.enableVtpm is false```
AWS VPC allows unauthorized peering
This policy identifies the VPCs which have unauthorized peering. The recommended best practice is to disallow VPC peering between two VPCs from different AWS accounts, as this potentially enables unauthorized access to private resources.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['PRIVILEGE_ESCALATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS Console
2. Go to AWS VPC console at https://console.aws.amazon.com/vpc/
3. In the left navigation panel, select Peering Connection
4. Choose the reported Peering Connection
5. Click on Actions and select 'Delete VPC Peering Connection'
6. click on Yes, Delete.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-vpc-peering-connections' AND json.rule = $.accepterVpcInfo.ownerId does not equal $.requesterVpcInfo.ownerId and $.status.code equals active```
Azure Storage account soft delete is disabled
This policy identifies Azure Storage accounts which has soft delete disabled. Azure Storage contains important access logs, financial data, personal and other secret information which is accidentally deleted by a user or application could cause data loss or data unavailability. It is recommended to enable soft delete setting in Azure Storage accounts.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To enable Soft delete on your storage account, follow below URL:
https://learn.microsoft.com/en-gb/azure/storage/blobs/soft-delete-blob-enable?tabs=azure-portal#enable-blob-soft-delete.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = deleteRetentionPolicy.blob.enabled is false and (kind does not equal ignore case FileStorage)```
OCI Object Storage bucket is publicly accessible
This policy identifies the OCI Object Storage buckets that are publicly accessible. Monitoring and alerting on publicly accessible buckets will help in identifying changes to the security posture and thus reduces risk for sensitive data being leaked. It is recommended that no bucket be publicly accessible.
This is applicable to oci cloud and is considered a high severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Login to the OCI Console
2. Type the resource reported in the alert into the Search box at the top of the Console.
3. Click the resource reported in the alert from the Resources submenu
4. Click on the Edit Visibility
5. Select Visibility as Private
6. Click Save Changes.

Query:
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-object-storage-bucket' AND json.rule = publicAccessType does not equal NoPublicAccess```
Sol-test  config policy

This is applicable to aws cloud and is considered a critical severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.accountgroup = 'Flowlog-sol' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = bucketName contains "sol-test" ```
AWS OpenSearch attached security group overly permissive to all traffic
This policy identifies AWS OpenSearch attached Security group that are overly permissive to all traffic. Security group enforces IP-based access policies to OpenSearch. As a best practice, restrict traffic solely from known static IP addresses or CIDR range.

This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Before making any changes, please check the impact on your applications/services. If the Security Group reported indeed need to restrict all traffic, follow the instructions below:
1. Log in to the AWS console
2. Navigate to the 'VPC' service
3. Select the 'Security Group' reported in the alert
4. Click on 'Inbound Rules'
5. Remove the rule which has the 'Source' value as 0.0.0.0/0 or ::/0.

Query:
```config from cloud.resource where api.name = 'aws-es-describe-elasticsearch-domain' AND json.rule = vpcoptions.securityGroupIds[*] exists as X; config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = isShared is false and (ipPermissions[*].ipv4Ranges[*].cidrIp equals 0.0.0.0/0 or ipPermissions[*].ipv6Ranges[*].cidrIpv6 equals ::/0) as Y; filter '$.X.vpcoptions.securityGroupIds[*] contains $.Y.groupId'; show Y;```
AWS ECS Cluster S3 Log Encryption Disabled
This policy alerts you when an AWS ECS cluster is detected with S3 log encryption disabled, potentially exposing sensitive data in your logs. By ensuring that the s3EncryptionEnabled field is set to true, you can enhance the security of your cloud environment by protecting log data from unauthorized access and maintaining compliance with data protection regulations.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = 'aws-ecs-cluster' and json.rule = configuration.executeCommandConfiguration.logConfiguration.s3EncryptionEnabled exists and configuration.executeCommandConfiguration.logConfiguration.s3EncryptionEnabled is false```
GCP Firewall rule allows all traffic on MySQL DB port (3306)
This policy identifies GCP Firewall rules which allow all inbound traffic on MySQL DB port (3306). Allowing access from arbitrary IP addresses to this port increases the attack surface of your network. It is recommended that the MySQL DB port (3306) should be allowed to specific IP addresses.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: If the Firewall rule reported indeed needs to restrict all traffic, follow the instructions below:
1. Login to GCP Console
2. Go to 'VPC Network'
3. Go to the 'Firewall'
4. Click on the reported Firewall rule
5. Click on 'EDIT'
6. Modify Source IP ranges to specific IP
7. Click on 'SAVE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-firewall-rules-list' AND json.rule = disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(ports contains _Port.inRange(3306,3306) or (ports does not exist and (IPProtocol contains tcp or IPProtocol contains udp)))] exists```
AWS Lambda IAM policy overly permissive to all traffic
This policy identifies AWS Lambda IAM policies that are overly permissive to all traffic. It is recommended that the Lambda should be granted access restrictions so that only authorized users and applications have access to the service.

For more details:
https://docs.aws.amazon.com/lambda/latest/dg/security-iam.html
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['PRIVILEGE_ESCALATION'].
Mitigation of this issue can be done as follows: 1. Login to AWS console
2. Goto IAM Services
3. Click on 'Policies' in left hand panel
4. Search for the Policy for which the Alert is generated and click on it
5. Under Permissions tab, click on Edit policy
6. Under the Visual editor, for each of the 'lambda' Service, click to expand and perform following.
6.a. Click to expand 'Request conditions'
6.b. Under the 'Source IP', remove the row with the entry '0.0.0.0/0' or '::/0'. Add condition with restrictive IP ranges.
7. Click on Review policy and Save changes.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-get-policy-version' AND json.rule = isAttached is true and document.Statement[?any((Condition.ForAnyValue:IpAddress.aws:SourceIp contains 0.0.0.0/0 or Condition.IpAddress.aws:SourceIp contains 0.0.0.0/0 or Condition.IpAddress.aws:SourceIp contains ::/0 or Condition.ForAnyValue:IpAddress.aws:SourceIp contains ::/0) and Effect equals Allow and Action anyStartWith lambda:)] exists```
AWS Lambda nearing availability code storage limit
This policy identifies Lambda nearing availability code storage limit per region. AWS provides a reasonable starting amount of compute and storage resources that you can use to run and store functions. As a best practice, it is recommended to either remove the functions that you no longer in use or reduce the code size of the functions that you do not want to remove. It will also help you avoid unexpected charges on your bill.
NOTE: As per https://docs.aws.amazon.com/lambda/latest/dg/limits.html. On the date, Lambda account limit per region is 75 GB. This policy will trigger an alert if Lambda account limit per region reached to 90% (i.e. 67500000 KB) of resource availability limit allocated. If you need more Lambda account code storage size per region, You can contact AWS for a service limit increase.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign into the AWS console
2. In the console, select the specific region from region drop down on the top right corner, for which the alert is generated
3. Navigate to the AWS Lambda Dashboard
4. Click on 'Functions', choose each the lambda function 
5. Either remove the function that you no longer use or deduce the code size of the function that if you do not want to remove..

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-lambda-get-region-summary' AND json.rule = 'lambdaCodeSize.size > 67500000'```
GCP API key not restricting any specific API
This policy identifies GCP API keys that are not restricting any specific APIs. API keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. It is recommended to restrict API keys to use (call) only APIs required by an application.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to google cloud console
2. Navigate to 'Credentials', Under service 'APIs & Services'
3. In the section 'API Keys', Click on the reported 'API Key Name'
4. In the 'Key restrictions' section go to 'API restrictions'.
5. Select the 'Restrict key' and from the drop-down, choose an API.
6. Click 'SAVE'.
Note: Do not set 'API restrictions' to 'Google Cloud APIs', as this option allows access to all services offered by Google cloud..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-api-key' AND json.rule = restrictions.apiTargets does not exist```
GCP SQL server instance database flag remote access is not set to off
This policy identifies GCP SQL server instances for which database flag remote access is not set to off. The remote access option controls the execution of stored procedures from local or remote servers on which instances of SQL Server are running. 'Remote access' functionality can be abused to launch a Denial-of-Service (DoS) attack on remote servers by off-loading query processing to a target. It is recommended to set the remote access database flag for SQL Server instance to off.
This is applicable to gcp cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to GCP console
2. Navigate SQL Instances page
3. Click on reported SQL server instance
4. Click on EDIT
5. If the flag has not been set on the instance, 
Under 'Customize your instance' section, go to 'Flags and parameters', click on 'ADD FLAG' in 'New database flag' section, choose the flag 'remote access' from the drop-down menu and set the value as 'off'
OR
If the flag has been set to other than off, Under 'Flags and parameters', choose the flag 'remote access' and set the value as 'off'
6. Click on DONE
7. Click on SAVE.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = 'databaseVersion contains SQLSERVER and state equals RUNNABLE and (settings.databaseFlags[*].name does not contain "remote access" or settings.databaseFlags[?any(name contains "remote access" and value contains on)] exists)'```
GCP Memorystore for Redis instance not encrypted with CMEK
This policy identifies Memorystore for Redis instances not encrypted with CMEK.

GCP Memorystore for Redis is a fully managed in-memory data store that simplifies Redis deployment and scaling while ensuring high availability and low-latency access. By using CMEK with Redis instance, you retain complete control over the encryption keys protecting your sensitive data, ensuring that only authorized users with access to these keys can decrypt and access the information. Without CMEK, data is encrypted with Google-managed keys, which may not provide the level of control required for handling sensitive data in certain industries.

It is recommended to encrypt Redis instance data using a Customer-Managed Encryption Key (CMEK).
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Encryption cannot be changed for existing Memorystore for Redis instances. A new Memorystore for Redis instance should be created to use CMEK for encryption.

To create a new Memorystore for Redis instance with CMEK encryption, please refer to the steps below:

1. Sign in to the Google Cloud Management Console. Navigate to the 'Memorystore for Redis' page
2. Click on the 'CREATE INSTANCE'
3. Provide all the other details as per the requirements
4. Under 'Security', under 'Encryption' select the 'Cloud KMS key' checkbox
5. Select the KMS key you prefer
5. Click on the 'CREATE INSTANCE'..

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-redis-instances-list' AND json.rule = state equal ignore case ready and not(customerManagedKey contains cryptoKeys)```