knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
This policy identifies Azure Network Security Groups (NSGs) which are overly permissive to all traffic on TCP protocol. A network security group contains a list of security rules that allow or deny inbound or outbound network traffic based on source or destination IP address, port, and protocol. As a best practice, it is recommended to configure NSGs to restrict traffic from known sources, allowing only authorized protocols and ports.
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any((sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and protocol equals Tcp and access equals Allow and direction equals Inbound and destinationPortRange contains *)] exists```
AWS IAM deprecated managed policies in use by User
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-attached-user-policies' AND json.rule = attachedPolicies[*].policyArn contains "arn:aws:iam::aws:policy/AmazonElasticTranscoderFullAccess"```
This policy checks for any usage of deprecated AWS IAM managed policies and returns an alert if it finds one in your cloud resources.

When AWS deprecate an IAM managed policy, a new alternative is released with improved access restrictions. Existing IAM users and roles can continue to use the previous policy without interruption, however new IAM users and roles will use the new replacement policy.

Before you migrate any user or role to the new replacement policy, we recommend you review their differences in the Policy section of AWS IAM console. If you require one or more of the removed permissions, please add them separately to any user or role.

List of deprecated AWS IAM managed policies:

AmazonElasticTranscoderFullAccess (replaced by AmazonElasticTranscoder_FullAccess)
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-attached-user-policies' AND json.rule = attachedPolicies[*].policyArn contains "arn:aws:iam::aws:policy/AmazonElasticTranscoderFullAccess"```
AWS S3 bucket encrypted using Customer Managed Key (CMK) with overly permissive policy
```config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-s3api-get-bucket-acl' AND json.rule = (sseAlgorithm contains "aws:kms" or sseAlgorithm contains "aws:kms:dsse") and kmsMasterKeyID exists as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and keyMetadata.keyManager equals CUSTOMER and policies.default.Statement[?any((Principal.AWS equals * or Principal equals *)and Condition does not exist)] exists as Y; filter '$.X.kmsMasterKeyID contains $.Y.key.keyArn' ; show X;```
This policy identifies Amazon S3 buckets that use Customer Managed Keys (CMKs) for encryption that have a key policy overly permissive. Amazon S3 bucket encryption key overly permissive can result in the exposure of sensitive data and potential compliance violations. As a security best practice, It is recommended to follow the principle of least privilege ensuring that the KMS key policy does not have all the permissions to be able to complete a malicious action.
```config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-s3api-get-bucket-acl' AND json.rule = (sseAlgorithm contains "aws:kms" or sseAlgorithm contains "aws:kms:dsse") and kmsMasterKeyID exists as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and keyMetadata.keyManager equals CUSTOMER and policies.default.Statement[?any((Principal.AWS equals * or Principal equals *)and Condition does not exist)] exists as Y; filter '$.X.kmsMasterKeyID contains $.Y.key.keyArn' ; show X;```
Azure PostgreSQL Database Server 'Allow access to Azure services' enabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-server' AND json.rule = properties.publicNetworkAccess equal ignore case Enabled and firewallRules.value[*].properties.startIpAddress equals "0.0.0.0" and firewallRules.value[*].properties.endIpAddress equals "0.0.0.0"```
This policy identifies Azure PostgreSQL Database Server which has 'Allow access to Azure services' settings enabled. When 'Allow access to Azure services' settings is enabled, PostgreSQL Database server will accept connections from all Azure resources including other subscription resources as well. It is recommended to use firewall rules or VNET rules to allow access from specific network ranges or virtual networks.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-server' AND json.rule = properties.publicNetworkAccess equal ignore case Enabled and firewallRules.value[*].properties.startIpAddress equals "0.0.0.0" and firewallRules.value[*].properties.endIpAddress equals "0.0.0.0"```
AWS RDS database not encrypted using Customer Managed Key
```config from cloud.resource where api.name = 'aws-rds-describe-db-instances' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' as Y; filter '$.X.storageEncrypted is true and $.X.kmsKeyId equals $.Y.key.keyArn and $.Y.keyMetadata.keyManager contains AWS'; show X;```
This policy identifies RDS databases that are encrypted with default KMS keys and not with customer managed keys. As a best practice, use customer managed keys to encrypt the data on your RDS databases and maintain control of your keys and data on sensitive workloads.
```config from cloud.resource where api.name = 'aws-rds-describe-db-instances' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' as Y; filter '$.X.storageEncrypted is true and $.X.kmsKeyId equals $.Y.key.keyArn and $.Y.keyMetadata.keyManager contains AWS'; show X;```
AWS ECS task definition is not configured with read-only access to container root filesystems
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ecs-describe-task-definition' AND json.rule = status equals "ACTIVE" AND containerDefinitions[*].readonlyRootFilesystem any false or containerDefinitions[*].readonlyRootFilesystem does not exist```
This policy identifies the AWS Elastic Container Service (ECS) task definitions with readonlyRootFilesystem parameter set to false or if the parameter does not exist in the container definition within the task definition.

ECS root filesystem is the base filesystem that containers run on, providing the necessary environment and isolation for the containerized application.
If a containerized application is compromised, it could enable an attacker to alter the root file system of the host machine, thus compromising the entire system or application. This could lead to significant data loss, system crashes, or a broader security breach. 

It is recommended to limit all ECS containers to have read-only access on ECS task definition to limit the potential impact of a compromised container.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ecs-describe-task-definition' AND json.rule = status equals "ACTIVE" AND containerDefinitions[*].readonlyRootFilesystem any false or containerDefinitions[*].readonlyRootFilesystem does not exist```
AWS EKS cluster public endpoint access overly permissive to all traffic
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-eks-describe-cluster' AND json.rule = resourcesVpcConfig.endpointPublicAccess is true and resourcesVpcConfig.publicAccessCidrs contains "0.0.0.0/0"```
This policy identifies EKS clusters that have an overly permissive public endpoint accessible to all traffic. When you create a new cluster, Amazon EKS creates an endpoint for the managed Kubernetes API server that you use to communicate with your cluster (using Kubernetes management tools such as kubectl). By default, this API server endpoint accepts all connections from public internet, and access to the API server is secured using a combination of AWS Identity and Access Management (IAM) and native Kubernetes Role Based Access Control (RBAC).

Allowing all traffic to EKS cluster may allow a bad actor to brute force their way into the system and potentially get access to the entire network. As a best practice, restrict traffic solely from known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-eks-describe-cluster' AND json.rule = resourcesVpcConfig.endpointPublicAccess is true and resourcesVpcConfig.publicAccessCidrs contains "0.0.0.0/0"```
OCI Event Rule and Notification does not exist for Network Security Groups changes
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment and condition.eventType[*] contains com.oraclecloud.virtualnetwork.createnetworksecuritygroup and condition.eventType[*] contains com.oraclecloud.virtualnetwork.deletenetworksecuritygroup and condition.eventType[*] contains  com.oraclecloud.virtualnetwork.updatenetworksecuritygroup) and actions.actions[*].topicId exists' as X; count(X) less than 1```
This policy identifies the OCI compartments which do not have an Event Rule and Notification that gets triggered for Network Security Group (NSG) changes. Monitoring and alerting on changes to security groups will help in identifying changes to traffic flowing between Virtual Network Cards attached to Compute instances. It is recommended that an Event Rule and Notification be configured to catch changes made to Network Security Groups.
NOTE: 
1. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.
2. This policy will trigger alert if you have at least one Event Rule and Notification, even if OCI has single or multi compartments.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment and condition.eventType[*] contains com.oraclecloud.virtualnetwork.createnetworksecuritygroup and condition.eventType[*] contains com.oraclecloud.virtualnetwork.deletenetworksecuritygroup and condition.eventType[*] contains  com.oraclecloud.virtualnetwork.updatenetworksecuritygroup) and actions.actions[*].topicId exists' as X; count(X) less than 1```
AWS Log metric filter and alarm does not exist for Route table changes
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "eventName=" or $.X.filterPattern contains "eventName =") and ($.X.filterPattern does not contain "eventName!=" and $.X.filterPattern does not contain "eventName !=") and $.X.filterPattern contains CreateRoute and $.X.filterPattern contains CreateRouteTable and $.X.filterPattern contains ReplaceRoute and $.X.filterPattern contains ReplaceRouteTableAssociation and $.X.filterPattern contains DeleteRouteTable and $.X.filterPattern contains DeleteRoute and $.X.filterPattern contains DisassociateRouteTable) and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```
This policy identifies the AWS regions which do not have a log metric filter and alarm for Route table changes. Monitoring changes to route tables will help ensure that all VPC traffic flows through an expected path. It is recommended that a metric filter and alarm be established for changes to route tables.

NOTE: This policy will trigger alert if you have at least one Cloudtrail with the multi trial is enabled, Logs all management events in your account and is not set with specific log metric filter and alarm.
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "eventName=" or $.X.filterPattern contains "eventName =") and ($.X.filterPattern does not contain "eventName!=" and $.X.filterPattern does not contain "eventName !=") and $.X.filterPattern contains CreateRoute and $.X.filterPattern contains CreateRouteTable and $.X.filterPattern contains ReplaceRoute and $.X.filterPattern contains ReplaceRouteTableAssociation and $.X.filterPattern contains DeleteRouteTable and $.X.filterPattern contains DeleteRoute and $.X.filterPattern contains DisassociateRouteTable) and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```
Azure Activity log alert for Create or update network security group does not exist
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/write" as X; count(X) less than 1```
This policy identifies the Azure accounts in which activity log alert for Create or update network security group does not exist. Creating an activity log alert for Create or update network security group gives insight into network access changes and may reduce the time it takes to detect suspicious activity.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/write" as X; count(X) less than 1```
IBM Cloud Virtual Server Image for Virtual Private Cloud (VPC) using basic Provider Managed Encryption
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-virtual-server-image' AND json.rule = status equals "available" and encryption equal ignore case "none"```
This policy identifies IBM Cloud Virtual Server Images for Virtual Private Cloud (VPC) which are not provisioned with Customer Managed Encryption and are using the basic Provider Managed Encryption. With customer-managed encryption, one can import own root keys to the cloud. This process is commonly called "bring your own key". When the encryption is managed by a cloud service provider, the image may still be vulnerable to unauthorized user access and manipulation. Customer-managed encryption (Key Protect & Hyper Protect Crypto Service) provides better audit records for root key usage, therefore it is recommended to use Customer Managed Encrypted Images.
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-virtual-server-image' AND json.rule = status equals "available" and encryption equal ignore case "none"```
IBM Cloud Secrets Manager has expired arbitrary secrets
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-secret-manager-secret' AND json.rule = 'secret_type equals arbitrary and (expiration_date does not exist or (_DateTime.ageInDays(expiration_date) > -1))'```
This policy identifies IBM Cloud Secrets Manager arbitrary secret which is expired. Arbitrary secrets should be rotated to ensure that data cannot be accessed with an old secret which might have been lost, cracked, or stolen. It is recommended that all arbitrary secrets are set with expiration date and expired secrets should be regularly rotated.
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-secret-manager-secret' AND json.rule = 'secret_type equals arbitrary and (expiration_date does not exist or (_DateTime.ageInDays(expiration_date) > -1))'```
pk-gcp-global
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-logging-bucket' AND json.rule = name contains "pk"```
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-logging-bucket' AND json.rule = name contains "pk"```
AWS Config fails to deliver log files
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-configservice-describe-configuration-recorders' AND json.rule = 'status.recording is true and status.lastStatus contains FAILURE'```
This policy identifies AWS Configs which are failing to deliver its log files to the specified S3 bucket. It happens when it doesn't have sufficient permissions to complete the operation. To deliver information to S3 bucket, AWS Config needs to assume an IAM role that manages the permissions required to access the designated S3 bucket.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-configservice-describe-configuration-recorders' AND json.rule = 'status.recording is true and status.lastStatus contains FAILURE'```
GCP VPC Network subnets have Private Google access disabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-networks-subnets-list' AND json.rule = purpose is not member of (REGIONAL_MANAGED_PROXY, PRIVATE_SERVICE_CONNECT, GLOBAL_MANAGED_PROXY, PRIVATE_NAT) and (privateIpGoogleAccess does not exist or privateIpGoogleAccess is false)```
This policy identifies GCP VPC Network subnets have disabled Private Google access. Private Google access enables virtual machine instances on a subnet to reach Google APIs and services using an internal IP address rather than an external IP address. Internal (private) IP addresses are internal to Google Cloud Platform and are not routable or reachable over the Internet. You can use Private Google access to allow VMs without Internet access to reach Google APIs, services, and properties that are accessible over HTTP/HTTPS.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-networks-subnets-list' AND json.rule = purpose is not member of (REGIONAL_MANAGED_PROXY, PRIVATE_SERVICE_CONNECT, GLOBAL_MANAGED_PROXY, PRIVATE_NAT) and (privateIpGoogleAccess does not exist or privateIpGoogleAccess is false)```
AWS Glue Data Catalog not encrypted by Customer Managed Key (CMK)
```config from cloud.resource where api.name = 'aws-glue-datacatalog' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyManager does not equal CUSTOMER or (keyMetadata.keyManager equals CUSTOMER and keyMetadata.keyState equals Disabled) as Y; filter '($.X.DataCatalogEncryptionSettings.EncryptionAtRest.CatalogEncryptionMode equals "DISABLED" or $.X.ConnectionPasswordEncryption.ReturnConnectionPasswordEncrypted equals "false") or ($.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId exists and ($.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId equals $.Y.keyMetadata.arn or $.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId starts with "alias/aws/")) or ($.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId exists and ($.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId equals $.Y.keyMetadata.arn or  $.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId starts with "alias/aws/"))' ; show X;```
This policy identifies AWS Glue Data Catalog that is encrypted using the default KMS key instead of CMK (Customer Managed Key) or using the CMK that is disabled.

AWS Glue Data Catalog is a managed metadata repository centralizing schema information for AWS Glue resources, facilitating data discovery and management. To protect sensitive data from unauthorized access, users can specify CMK to get enhanced security, and control over the encryption key and comply with any regulatory requirements.

It is recommended to use a CMK to encrypt the AWS Glue Data Catalog as it provides complete control over the encrypted data.
```config from cloud.resource where api.name = 'aws-glue-datacatalog' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyManager does not equal CUSTOMER or (keyMetadata.keyManager equals CUSTOMER and keyMetadata.keyState equals Disabled) as Y; filter '($.X.DataCatalogEncryptionSettings.EncryptionAtRest.CatalogEncryptionMode equals "DISABLED" or $.X.ConnectionPasswordEncryption.ReturnConnectionPasswordEncrypted equals "false") or ($.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId exists and ($.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId equals $.Y.keyMetadata.arn or $.X.DataCatalogEncryptionSettings.EncryptionAtRest.SseAwsKmsKeyId starts with "alias/aws/")) or ($.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId exists and ($.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId equals $.Y.keyMetadata.arn or  $.X.DataCatalogEncryptionSettings.ConnectionPasswordEncryption.AwsKmsKeyId starts with "alias/aws/"))' ; show X;```
GCP PostgreSQL instance with log_checkpoints database flag is disabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "databaseVersion contains POSTGRES and (settings.databaseFlags[?(@.name=='log_checkpoints')] does not exist or settings.databaseFlags[?(@.name=='log_checkpoints')].value equals off)"```
This policy identifies PostgreSQL instances in which log_checkpoints database flag is not set. Enabling the log_checkpoints database flag would enable logging of checkpoints and restart points to the server log.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "databaseVersion contains POSTGRES and (settings.databaseFlags[?(@.name=='log_checkpoints')] does not exist or settings.databaseFlags[?(@.name=='log_checkpoints')].value equals off)"```
AWS Log metric filter and alarm does not exist for AWS management console authentication failures
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "eventName=" or $.X.filterPattern contains "eventName =") and ($.X.filterPattern does not contain "eventName!=" and $.X.filterPattern does not contain "eventName !=") and $.X.filterPattern contains ConsoleLogin and ($.X.filterPattern contains "errorMessage=" or $.X.filterPattern contains "errorMessage =") and ($.X.filterPattern does not contain "errorMessage!=" and $.X.filterPattern does not contain "errorMessage !=") and $.X.filterPattern contains "Failed authentication") and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```