knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
IBM Cloud Support Access Group to manage incidents has not been created
```config from cloud.resource where api.name = 'ibm-iam-policy' AND json.rule = type equal ignore case access and roles[?any( role_id is member of (crn:v1:bluemix:public:iam::::role:Administrator,crn:v1:bluemix:public:iam::::role:Editor,crn:v1:bluemix:public:iam::::role:Viewer ) )] exists and resources[?any( attributes[?any( value equal ignore case support and operator is member of (stringEquals, stringMatch))] exists)] exists and subjects[?any( attributes[?any( value contains AccessGroupId)] exists )] exists as X; count(X) less than 1```
This policy identifies IBM Cloud accounts with no access group to manage support incidents. Support cases are used to raise issues with IBM Cloud. Users with access to the IBM Cloud Support Center can create and/or manage support tickets based on their IAM role. Support Center access should be managed and assigned using Access Groups.
```config from cloud.resource where api.name = 'ibm-iam-policy' AND json.rule = type equal ignore case access and roles[?any( role_id is member of (crn:v1:bluemix:public:iam::::role:Administrator,crn:v1:bluemix:public:iam::::role:Editor,crn:v1:bluemix:public:iam::::role:Viewer ) )] exists and resources[?any( attributes[?any( value equal ignore case support and operator is member of (stringEquals, stringMatch))] exists)] exists and subjects[?any( attributes[?any( value contains AccessGroupId)] exists )] exists as X; count(X) less than 1```
Azure Network Security Group allows all traffic on SMTP (TCP Port 25)
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and (protocol equals Tcp or protocol equals *) and (destinationPortRange contains _Port.inRange(25,25) or destinationPortRanges[*] contains _Port.inRange(25,25) ))] exists```
This policy identifies Azure Network Security Groups (NSG) that allow all traffic on SMTP (TCP Port 25). Review your list of NSG rules to ensure that your resources are not exposed. As a best practice, restrict SMTP solely to known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and (protocol equals Tcp or protocol equals *) and (destinationPortRange contains _Port.inRange(25,25) or destinationPortRanges[*] contains _Port.inRange(25,25) ))] exists```
API automation policy ajtmu
```config from cloud.resource where api.name = "aws-ec2-describe-instances" AND json.rule = architecture contains "foo"```
Azure Storage Logging is not Enabled for Queue Service for Read Write and Delete requests
```config from cloud.resource where api.name = 'azure-storage-account-list' as X; config from cloud.resource where api.name = 'azure-storage-account-queue-diagnostic-settings' AND json.rule = properties.logs[*].enabled all true as Y; filter 'not($.X.id contains $.Y.properties.storageAccountId)'; show X;```
```config from cloud.resource where api.name = 'azure-storage-account-list' as X; config from cloud.resource where api.name = 'azure-storage-account-queue-diagnostic-settings' AND json.rule = properties.logs[*].enabled all true as Y; filter 'not($.X.id contains $.Y.properties.storageAccountId)'; show X;```
OCI VCN subnet flow logging is disabled
```config from cloud.resource where api.name = 'oci-networking-subnet' as X; config from cloud.resource where api.name = 'oci-logging-logs' AND json.rule = lifecycleState equals ACTIVE and isEnabled is true and configuration.source.service contains flowlogs as Y; filter 'not ($.X.id contains $.Y.configuration.source.resource)'; show X;```
This policy identifies Virtual Cloud Network (VCN) subnets that have flow logs disabled.

Enabling VCN flow logs enables you to monitor traffic flowing within your virtual network and can be used to detect anomalous traffic. Without the flow logs turned on, it is not possible to get any visibility into network traffic.

It is recommended to enable a VCN flow log on each of your VCN subnets.
```config from cloud.resource where api.name = 'oci-networking-subnet' as X; config from cloud.resource where api.name = 'oci-logging-logs' AND json.rule = lifecycleState equals ACTIVE and isEnabled is true and configuration.source.service contains flowlogs as Y; filter 'not ($.X.id contains $.Y.configuration.source.resource)'; show X;```
AWS RDS instance with Multi-Availability Zone disabled
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-rds-describe-db-instances' AND json.rule = dbinstanceStatus equals available and (engine does not contain aurora and engine does not contain sqlserver and engine does not contain docdb) and (multiAZ is false or multiAZ does not exist)```
This policy identifies RDS instances which have Multi-Availability Zone(Multi-AZ) disabled. When RDS DB instance is enabled with Multi-AZ, RDS automatically creates a primary DB Instance and synchronously replicates the data to a standby instance in a different availability zone. These Multi-AZ deployments will improve primary node reachability by providing read replica in case of network connectivity loss or loss of availability in the primary’s availability zone for read/write operations, so by making them the best fit for production database workloads.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-rds-describe-db-instances' AND json.rule = dbinstanceStatus equals available and (engine does not contain aurora and engine does not contain sqlserver and engine does not contain docdb) and (multiAZ is false or multiAZ does not exist)```
GCP Kubernetes Engine Clusters have Alpha cluster feature enabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule =  'enableKubernetesAlpha is true'```
This policy identifies GCP Kubernetes Engine Clusters which have enabled alpha cluster. It is recommended to not use alpha clusters or alpha features for production workloads. Alpha clusters expire after 30 days and do not receive security updates. This cluster will not be covered by the Kubernetes Engine SLA.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule =  'enableKubernetesAlpha is true'```
GCP Default Firewall rule is overly permissive (except http and https)
```config from cloud.resource where cloud.type = 'gcp' AND api.name= 'gcloud-compute-firewall-rules-list' AND json.rule = 'disabled is false and (name equals default-allow-ssh or name equals default-allow-icmp or name equals default-allow-internal or name equals default-allow-rdp) and (deleted is false) and (sourceRanges[*] contains 0.0.0.0/0 or sourceRanges[*] contains ::/0)'```
This policy identifies the Firewall rules that are configured with default firewall rule. The default Firewall rules will apply to all instances by default in the absence of specific custom rules with higher priority. It is a safe practice to not have these rules in the default Firewall.
```config from cloud.resource where cloud.type = 'gcp' AND api.name= 'gcloud-compute-firewall-rules-list' AND json.rule = 'disabled is false and (name equals default-allow-ssh or name equals default-allow-icmp or name equals default-allow-internal or name equals default-allow-rdp) and (deleted is false) and (sourceRanges[*] contains 0.0.0.0/0 or sourceRanges[*] contains ::/0)'```
Azure App Service Web app doesn't have a Managed Service Identity
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = kind starts with app and (identity.type does not exist or (identity.type exists and identity.type does not contain SystemAssigned and identity.type does not contain UserAssigned))```
This policy identifies Azure App Services that are not configured with managed service identity. Managed Service Identity in App Service makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need for username and passwords.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = kind starts with app and (identity.type does not exist or (identity.type exists and identity.type does not contain SystemAssigned and identity.type does not contain UserAssigned))```
AWS KMS customer managed external key expiring in 30 days or less
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-kms-get-key-rotation-status' AND json.rule = 'keyMetadata.origin contains EXTERNAL and keyMetadata.keyManager contains CUSTOMER and keyMetadata.enabled is true and (_DateTime.ageInDays($.keyMetadata.validTo) > -30)'```
This policy identifies KMS customer managed external keys which are expiring in 30 days or less. As a best practice, it is recommended to reimport the same key material and specifying a new expiration date. If the key material expires, AWS KMS deletes the key material and the customer managed external key becomes unusable.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-kms-get-key-rotation-status' AND json.rule = 'keyMetadata.origin contains EXTERNAL and keyMetadata.keyManager contains CUSTOMER and keyMetadata.enabled is true and (_DateTime.ageInDays($.keyMetadata.validTo) > -30)'```
AWS RDS DB cluster is encrypted using default KMS key instead of CMK
```config from cloud.resource where api.name = 'aws-rds-db-cluster' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' as Y; filter '($.X.storageEncrypted is true) and ($.X.kmsKeyId equals $.Y.key.keyArn) and ($.Y.keyMetadata.keyManager does not contain CUSTOMER)' ; show X;```
This policy identifies RDS DB(Relational Database Service Database) clusters which are encrypted using default KMS key instead of CMK (Customer Master Key). As a security best practice CMK should be used instead of default KMS key for encryption to gain the ability to rotate the key according to your own policies, delete the key, and control access to the key via KMS policies and IAM policies.
```config from cloud.resource where api.name = 'aws-rds-db-cluster' as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' as Y; filter '($.X.storageEncrypted is true) and ($.X.kmsKeyId equals $.Y.key.keyArn) and ($.Y.keyMetadata.keyManager does not contain CUSTOMER)' ; show X;```
EIP-CSE-IACOHP-AzurePostgreSQL-NetworkAccessibility-eca1500-51
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-server' AND json.rule = firewallRules.value[*].properties.startIpAddress equals "0.0.0.0" or firewallRules.value[*].properties.endIpAddress equals "0.0.0.0"```
AWS Route53 public Hosted Zone query logging is not enabled
```config from cloud.resource where api.name = 'aws-route53-list-hosted-zones' AND json.rule = hostedZone.config.privateZone is false as X; config from cloud.resource where api.name = 'aws-route53-query-logging-config' as Y; filter ' not ($.X.hostedZone.id equals $.Y.HostedZoneId) ' ; show X;```
This policy identifies the AWS Route53 public hosted zones DNS query logging is not enabled.

Enabling DNS query logging for an AWS Route 53 hosted zone enhances DNS security and compliance by providing visibility into DNS queries. When enabled, Route 53 sends these log files to Amazon CloudWatch Logs. Disabling DNS query logging for AWS Route 53 limits visibility into DNS traffic, hampering anomaly detection, compliance efforts, and effective incident response.

It is recommended to enable logging for all public hosted zones to enhance the visibility and compliance requirements.
```config from cloud.resource where api.name = 'aws-route53-list-hosted-zones' AND json.rule = hostedZone.config.privateZone is false as X; config from cloud.resource where api.name = 'aws-route53-query-logging-config' as Y; filter ' not ($.X.hostedZone.id equals $.Y.HostedZoneId) ' ; show X;```
GCP Firewall rule allows all traffic on DNS port (53)
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-firewall-rules-list' AND json.rule = disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(ports contains _Port.inRange(53,53) or (ports does not exist and (IPProtocol contains tcp or IPProtocol contains udp)))] exists```
This policy identifies GCP Firewall rules which allow all inbound traffic on DNS port (53). Allowing access from arbitrary IP addresses to this port increases the attack surface of your network. It is recommended that the DNS port (53) should be allowed to specific IP addresses.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-firewall-rules-list' AND json.rule = disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(ports contains _Port.inRange(53,53) or (ports does not exist and (IPProtocol contains tcp or IPProtocol contains udp)))] exists```
mnm test
```config from cloud.resource where api.name = 'aws-account-management-alternate-contact' group by account as X; filter ' AlternateContactType is not member of ("SECURITY") ' ;```
```config from cloud.resource where api.name = 'aws-account-management-alternate-contact' group by account as X; filter ' AlternateContactType is not member of ("SECURITY") ' ;```
AWS Private CA root certificate authority is enabled
```config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-acm-pca-certificate-authority' AND json.rule = Type equal ignore case ROOT and Status equal ignore case active```
This policy identifies enabled AWS Private CA root certificate authorities.

AWS Private CA enables creating a root CA to issue private certificates for securing internal resources like servers, applications, users, devices, and containers. The root CA should be disabled for daily tasks to minimize risk, as it should only issue certificates for intermediate CAs, allowing it to remain secure while intermediate CAs handle the issuance of end-entity certificates.

It is recommended to disable the AWS Private CA root certificate authority to secure.
```config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-acm-pca-certificate-authority' AND json.rule = Type equal ignore case ROOT and Status equal ignore case active```
Alibaba Cloud MFA is disabled for RAM user
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ram-user' AND json.rule = 'MFADevice is empty'```
This policy identifies Resource Access Management (RAM) users for whom Multi Factor Authentication (MFA) is disabled. As a best practice, enable MFA to add an extra layer of protection for increased security of your Alibaba Cloud account settings and resources.
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ram-user' AND json.rule = 'MFADevice is empty'```
dnd_test_create_hyperion_policy_multi_cloud_child_policies_ss_finding_2
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-active-directory-group' AND json.rule = mail contains 42```
Description-4ee38fa0-9684-4c83-b917-035b88e2e243
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-active-directory-group' AND json.rule = mail contains 42```
OCI Object Storage Bucket has object Versioning disabled
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-object-storage-bucket' AND json.rule = versioning equals Disabled```
This policy identifies the OCI Object Storage buckets that are not configured with a Object Versioning. It is recommended that Object Storage buckets should be configured with Object Versioning to minimize data loss because of inadvertent deletes by an authorized user or malicious deletes.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-object-storage-bucket' AND json.rule = versioning equals Disabled```
Azure Microsoft Defender for Cloud set to Off for Agentless scanning for machines
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = not (pricings[?any(properties.extensions[?any(name equal ignore case AgentlessVmScanning AND isEnabled is true)] exists AND properties.pricingTier equal ignore case Standard )] exists)```
This policy identifies Azure Microsoft Defender for Cloud where the Agentless scanning for machines is set to Off.

Agentless scanning uses disk snapshots to detect installed software, vulnerabilities, and plain text secrets without needing agents on each machine. When disabled, your environment risks exposure to software vulnerabilities and unauthorized software, diminishing visibility into security issues. Enabling Agentless scanning improves security by identifying vulnerabilities and sensitive data with minimal performance impact, streamlining management and ensuring strong threat detection and compliance.

As a security best practice, it is recommended to enable Agentless scanning for machines in Azure Microsoft Defender for Cloud.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = not (pricings[?any(properties.extensions[?any(name equal ignore case AgentlessVmScanning AND isEnabled is true)] exists AND properties.pricingTier equal ignore case Standard )] exists)```
Dikla test
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = serverAdmins does not exist or serverAdmins[*] size equals 0 or (serverAdmins[*].properties.administratorType exists and serverAdmins[*].properties.administratorType does not equal ActiveDirectory and serverAdmins[*].properties.login is not empty)```
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = serverAdmins does not exist or serverAdmins[*] size equals 0 or (serverAdmins[*].properties.administratorType exists and serverAdmins[*].properties.administratorType does not equal ActiveDirectory and serverAdmins[*].properties.login is not empty)```
IBM Cloud PostgreSQL Database disk encryption is not enabled with customer managed keys
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-postgresql-deployment-info' AND json.rule = deployment.platform_options.disk_encryption_key_crn is empty```
This policy identifies IBM Cloud PostgreSQL Databases with default disk encryption. Using customer managed keys will increase significant control where keys are managed by customers. It is recommended to use customer managed keys for disk encryption which provides customer control over the lifecycle of the keys.
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-postgresql-deployment-info' AND json.rule = deployment.platform_options.disk_encryption_key_crn is empty```
AWS EKS cluster using the default VPC
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-eks-describe-cluster' as X; config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' as Y; filter ' $.X.resourcesVpcConfig.vpcId contains $.Y.vpcId and $.Y.isDefault is true'; show X;```
This policy identifies AWS EKS clusters which are configured with the default VPC. It is recommended to use a VPC configuration based on your security and networking requirements. You should create your own EKS VPC instead of using the default, so that you can have full control over the cluster network.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-eks-describe-cluster' as X; config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' as Y; filter ' $.X.resourcesVpcConfig.vpcId contains $.Y.vpcId and $.Y.isDefault is true'; show X;```
GCP Log metric filter and alert does not exist for SQL instance configuration changes
```config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ($.X.filter contains "protoPayload.methodName=" or $.X.filter contains "protoPayload.methodName =") and ($.X.filter does not contain "protoPayload.methodName!=" and $.X.filter does not contain "protoPayload.methodName !=") and $.X.filter contains "cloudsql.instances.update"'; show X; count(X) less than 1```
This policy identifies the GCP account which does not have a log metric filter and alert for SQL instance configuration changes. Monitoring SQL instance configuration activities will help in reducing time to detect and correct misconfigurations done on sql server. It is recommended to create a metric filter and alarm to detect activities related to the SQL instance configuration.
```config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '$.Y.conditions[*].metricThresholdFilter contains $.X.name and ($.X.filter contains "protoPayload.methodName=" or $.X.filter contains "protoPayload.methodName =") and ($.X.filter does not contain "protoPayload.methodName!=" and $.X.filter does not contain "protoPayload.methodName !=") and $.X.filter contains "cloudsql.instances.update"'; show X; count(X) less than 1```
Azure AKS enable role-based access control (RBAC) not enforced
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kubernetes-cluster' AND json.rule =  properties.enableRBAC is false```
To provide granular filtering of the actions that users can perform, Kubernetes uses role-based access controls (RBAC). This control mechanism lets you assign users, or groups of users, permission to do things like create or modify resources, or view logs from running application workloads. These permissions can be scoped to a single namespace, or granted across the entire AKS cluster.

This policy checks your AKS cluster RBAC setting and alerts if disabled.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kubernetes-cluster' AND json.rule =  properties.enableRBAC is false```
Azure Network Security Group having Inbound rule overly permissive to all traffic on TCP protocol
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any((sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and protocol equals Tcp and access equals Allow and direction equals Inbound and destinationPortRange contains *)] exists```