knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-logging-sinks-list' AND json.rule = name contains "pk"```
OCI Event Rule and Notification does not exist for Identity Provider changes
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.identitycontrolplane.createidentityprovider and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.deleteidentityprovider and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateidentityprovider) and actions.actions[*].topicId exists' as X; count(X) less than 1```
This policy identifies the OCI compartments which do not have an Event Rule and Notification that gets triggered for Identity Provider changes. Monitoring and alerting on changes to Identity Provider will help in identifying changes to the security posture. It is recommended that an Event Rule and Notification be configured to catch changes made to Identity Provider.
NOTE: 
1. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.
2. This policy will trigger alert if you have at least one Event Rule and Notification, even if OCI has single or multi compartments.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.identitycontrolplane.createidentityprovider and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.deleteidentityprovider and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateidentityprovider) and actions.actions[*].topicId exists' as X; count(X) less than 1```
AWS Log metric filter and alarm does not exist for unauthorized API calls
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "errorCode=" or $.X.filterPattern contains "errorCode =") and ($.X.filterPattern does not contain "errorCode!=" and $.X.filterPattern does not contain "errorCode !=") and $.X.filterPattern contains "UnauthorizedOperation" and $.X.filterPattern contains "AccessDenied") and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```
This policy identifies the AWS regions which do not have a log metric filter and alarm for unauthorized API calls. Monitoring unauthorized API calls will help reveal application errors and may reduce the time to detect malicious activity. It is recommended that a metric filter and alarm be established for unauthorized API calls.

NOTE: This policy will trigger alert if you have at least one Cloudtrail with the multi trial is enabled, Logs all management events in your account and is not set with specific log metric filter and alarm.
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "errorCode=" or $.X.filterPattern contains "errorCode =") and ($.X.filterPattern does not contain "errorCode!=" and $.X.filterPattern does not contain "errorCode !=") and $.X.filterPattern contains "UnauthorizedOperation" and $.X.filterPattern contains "AccessDenied") and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```
AWS ECS task definition logging configuration disabled
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ecs-describe-task-definition' AND json.rule = status equals ACTIVE and containerDefinitions[?any(logConfiguration.logDriver does not exist)] exists```
This policy identifies AWS ECS task definitions that have logging configuration disabled.

AWS ECS logging involves capturing and storing container logs for monitoring, troubleshooting, and analysis purposes within the Amazon ECS environment. Collecting data from task definitions gives visibility, which can aid in debugging processes and determining the source of issues.

It is recommended to configure logging for an AWS ECS task definition.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ecs-describe-task-definition' AND json.rule = status equals ACTIVE and containerDefinitions[?any(logConfiguration.logDriver does not exist)] exists```
AWS Athena Workgroup data encryption at rest not configured
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-athena-workgroup' AND json.rule = WorkGroup.State equal ignore case enabled and (WorkGroup.Configuration.ResultConfiguration.EncryptionConfiguration does not exist or (WorkGroup.Configuration.EngineVersion.EffectiveEngineVersion contains Athena and WorkGroup.Configuration.EnforceWorkGroupConfiguration is false))```
This policy identifies AWS Athena workgroups not configured with data encryption at rest.

AWS Athena workgroup enables you to isolate queries for you or your group of users from other queries in the same account, to set the query results location and the encryption configuration. By default, Athena workgroup query run results are not encrypted at rest and client side settings can override the workgroup settings. Encrypting workgroups and preventing overrides from the client side helps in protecting the integrity and confidentiality of the data stored on Athena.

It is recommended to set encryption at rest and enable 'override client-side settings' to mitigate the risk of unauthorized access and potential data breaches.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-athena-workgroup' AND json.rule = WorkGroup.State equal ignore case enabled and (WorkGroup.Configuration.ResultConfiguration.EncryptionConfiguration does not exist or (WorkGroup.Configuration.EngineVersion.EffectiveEngineVersion contains Athena and WorkGroup.Configuration.EnforceWorkGroupConfiguration is false))```
Azure Data Explorer cluster disk encryption is disabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kusto-clusters' AND json.rule = properties.state equal ignore case Running and properties.enableDiskEncryption is false```
This policy identifies Azure Data Explorer clusters in which disk encryption is disabled. Enabling encryption at rest on your cluster provides data protection for stored data. It is recommended to enable disk encryption on Data Explorer clusters.

For more details: 
https://learn.microsoft.com/en-us/azure/data-explorer/cluster-encryption-disk
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kusto-clusters' AND json.rule = properties.state equal ignore case Running and properties.enableDiskEncryption is false```
GCP Cloud Function is publicly accessible by allUsers or allAuthenticatedUsers
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-cloud-function-v2' AND json.rule = state equals ACTIVE and iamPolicy.bindings[?any(members[*] is member of ("allAuthenticatedUsers","allUsers"))] exists```
This policy identifies GCP Cloud Functions that are publicly accessible by allUsers or allAuthenticatedUsers. This includes both Cloud Functions v1 and Cloud Functions v2.

Granting permissions to 'allusers' or 'allAuthenticatedUsers' on any resource in GCP makes the resource public. Public access over cloud functions can lead to unauthorized invocations of the function or leakage of sensitive information such as the function's source code. 

Following the least privileged access policy, it is recommended to grant access restrictively and avoid granting permissions to allUsers or allAuthenticatedUsers unless absolutely needed.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-cloud-function-v2' AND json.rule = state equals ACTIVE and iamPolicy.bindings[?any(members[*] is member of ("allAuthenticatedUsers","allUsers"))] exists```
Azure Microsoft Defender for Cloud security contact phone number is not set
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = (securityContacts is empty or securityContacts[?any(properties.phone is empty)] exists) and pricings[?any(properties.pricingTier equal ignore case Standard)] exists```
This policy identifies Subscriptions that are not set with security contact phone number for Azure Microsoft Defender for Cloud (previously known as Azure Security Center and Azure Defender). It is recommended to set security contact phone number to receive notifications when Microsoft Defender for Cloud detects compromised resources.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = (securityContacts is empty or securityContacts[?any(properties.phone is empty)] exists) and pricings[?any(properties.pricingTier equal ignore case Standard)] exists```
AWS Cloudfront Distribution with S3 have Origin Access set to disabled
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = 'origins.items[*].s3OriginConfig exists and origins.items[*].s3OriginConfig.originAccessIdentity is empty and origins.items[*].originAccessControlId is empty'```
This policy identifies the AWS CloudFront distributions which are utilizing S3 bucket and have Origin Access Disabled. The origin access identity feature should be enabled for all your AWS CloudFront CDN distributions in order to restrict any direct access to your objects through Amazon S3 URLs.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = 'origins.items[*].s3OriginConfig exists and origins.items[*].s3OriginConfig.originAccessIdentity is empty and origins.items[*].originAccessControlId is empty'```
OCI Event Rule and Notification does not exist for route tables changes
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.virtualnetwork.changeroutetablecompartment and condition.eventType[*] contains com.oraclecloud.virtualnetwork.createroutetable and condition.eventType[*] contains com.oraclecloud.virtualnetwork.deleteroutetable and condition.eventType[*] contains com.oraclecloud.virtualnetwork.updateroutetable) and actions.actions[*].topicId exists' as X; count(X) less than 1```
This policy identifies the OCI compartments which do not have an Event Rule and Notification that gets triggered for route tables changes. Monitoring and alerting on changes to route tables will help in identifying changes to traffic flowing to or from Virtual Cloud Networks and Subnets. It is recommended that an Event Rule and Notification be configured to catch changes made to route tables.
NOTE: 
1. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.
2. This policy will trigger alert if you have at least one Event Rule and Notification, even if OCI has single or multi compartments.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.virtualnetwork.changeroutetablecompartment and condition.eventType[*] contains com.oraclecloud.virtualnetwork.createroutetable and condition.eventType[*] contains com.oraclecloud.virtualnetwork.deleteroutetable and condition.eventType[*] contains com.oraclecloud.virtualnetwork.updateroutetable) and actions.actions[*].topicId exists' as X; count(X) less than 1```
Alibaba Cloud Security group allow internet traffic to FTP-Data port (20)
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-security-group' AND json.rule = "permissions is not empty and permissions[?(@.policy=='Accept' && @.direction=='ingress' && @.sourceCidrIp=='0.0.0.0/0')].portRange contains _Port.inRange(20,20)"```
This policy identifies Security groups that allow inbound traffic on FTP-Data port (20) from the public internet. As a best practice, restrict security groups to only allow permitted traffic and limit brute force attacks on your network.
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-security-group' AND json.rule = "permissions is not empty and permissions[?(@.policy=='Accept' && @.direction=='ingress' && @.sourceCidrIp=='0.0.0.0/0')].portRange contains _Port.inRange(20,20)"```
IBM Cloud Object Storage bucket is not encrypted with BYOK (bring your own key)
```config from cloud.resource where api.name = 'ibm-key-protect-registration' as X; config from cloud.resource where api.name = 'ibm-object-storage-bucket' AND json.rule = not( locationConstraint contains "ams03" or locationConstraint contains "mon01" or locationConstraint contains "tor01" or locationConstraint contains "sjc03" or locationConstraint contains "sjc04" or locationConstraint contains "sao01" or locationConstraint contains "mil01" or locationConstraint contains "sng01" or locationConstraint contains "che01" ) as Y; filter 'not($.X.resourceCrn equals $.Y.crn)'; show Y;```
This policy identifies IBM Cloud Storage buckets that are not encrypted with BYOK (Bring your own key). Bring your Own Key (BYOK) allows customers to ensure no one outside their organisation has access to the root key and with the support of BYOK, customers can manage the lifecycle of their customer root keys where they can create, rotate, delete those keys. As a security best practice, it is recommended to use BYOK encryption key management system, which provides a significant level of control on the keys when used for encryption.
```config from cloud.resource where api.name = 'ibm-key-protect-registration' as X; config from cloud.resource where api.name = 'ibm-object-storage-bucket' AND json.rule = not( locationConstraint contains "ams03" or locationConstraint contains "mon01" or locationConstraint contains "tor01" or locationConstraint contains "sjc03" or locationConstraint contains "sjc04" or locationConstraint contains "sao01" or locationConstraint contains "mil01" or locationConstraint contains "sng01" or locationConstraint contains "che01" ) as Y; filter 'not($.X.resourceCrn equals $.Y.crn)'; show Y;```
AWS S3 access point Block public access setting disabled
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3-access-point' AND json.rule = networkOrigin equal ignore case internet and (publicAccessBlockConfiguration does not exist or (publicAccessBlockConfiguration.blockPublicAcls is false and publicAccessBlockConfiguration.ignorePublicAcls is false and publicAccessBlockConfiguration.blockPublicPolicy is false and publicAccessBlockConfiguration.restrictPublicBuckets is false))```
This policy identifies AWS S3 access points with the block public access setting disabled.

AWS S3 Access Point simplifies managing data access by creating unique access control policies for specific applications or users within a S3 bucket. The Amazon S3 Block Public Access feature manages access at the account, bucket, and access point levels. Each level's settings can be configured independently but cannot override more restrictive settings at higher levels. Instead, access point settings complement those at the account and bucket levels.

It is recommended to enable the Block public access setting on a S3 access point unless intended for public exposure.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3-access-point' AND json.rule = networkOrigin equal ignore case internet and (publicAccessBlockConfiguration does not exist or (publicAccessBlockConfiguration.blockPublicAcls is false and publicAccessBlockConfiguration.ignorePublicAcls is false and publicAccessBlockConfiguration.blockPublicPolicy is false and publicAccessBlockConfiguration.restrictPublicBuckets is false))```
Azure Cosmos DB key based authentication is enabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cosmos-db' AND json.rule = properties.provisioningState equals Succeeded and properties.disableKeyBasedMetadataWriteAccess is false```
This policy identifies Cosmos DBs that are enabled with key-based authentication. Disabling key-based metadata write access on Azure Cosmos DB prevents any changes to resources from a client connecting using the account keys. It is recommended to disable this feature for organizations who want higher degrees of control and governance for production environments.

NOTE: Enabling this feature can have an impact on your application. Make sure that you understand the impact before enabling it.

Refer for more details:
https://docs.microsoft.com/en-us/azure/cosmos-db/role-based-access-control#check-list-before-enabling
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cosmos-db' AND json.rule = properties.provisioningState equals Succeeded and properties.disableKeyBasedMetadataWriteAccess is false```
AWS CloudTrail is not enabled on the account
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-cloudtrail-describe-trails' as X; count(X) less than 1```
Checks to ensure that CloudTrail is enabled on the account. AWS CloudTrail is a service that enables governance, compliance, operational & risk auditing of the AWS account. It is a compliance and security best practice to turn on CloudTrail to get a complete audit trail of activities across various services. 
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-cloudtrail-describe-trails' as X; count(X) less than 1```
GCP SQL server instance database flag 3625 (trace flag) is not set to on
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "databaseVersion contains SQLSERVER and state equals RUNNABLE and (settings.databaseFlags[*].name does not contain 3625 or settings.databaseFlags[?any(name contains 3625 and value contains off)] exists)"```
This policy identifies GCP SQL server instance for which database flag 3625 (trace flag) is not set to on. Trace flag can help prevent the disclosure of sensitive information by masking the parameters of some error messages using '*', for users who are not members of the sysadmin fixed server role. It is recommended to set 3625 (trace flag) database flag for Cloud SQL SQL Server instance to on.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "databaseVersion contains SQLSERVER and state equals RUNNABLE and (settings.databaseFlags[*].name does not contain 3625 or settings.databaseFlags[?any(name contains 3625 and value contains off)] exists)"```
Alibaba Cloud RAM password policy does not have a lowercase character
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ram-password-policy' AND json.rule =  'requireLowercaseCharacters does not exist or requireLowercaseCharacters is false'```
This policy identifies Alibaba Cloud accounts that do not have a lowercase character in the password policy. As a security best practice, configure a strong password policy for secure access to the Alibaba Cloud console.
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ram-password-policy' AND json.rule =  'requireLowercaseCharacters does not exist or requireLowercaseCharacters is false'```
AWS Log metric filter and alarm does not exist for AWS Config configuration changes
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "eventName=" or $.X.filterPattern contains "eventName =") and ($.X.filterPattern does not contain "eventName!=" and $.X.filterPattern does not contain "eventName !=") and ($.X.filterPattern contains "eventSource=" or $.X.filterPattern contains "eventSource =") and ($.X.filterPattern does not contain "eventSource!=" and $.X.filterPattern does not contain "eventSource !=") and $.X.filterPattern contains config.amazonaws.com and $.X.filterPattern contains StopConfigurationRecorder and $.X.filterPattern contains DeleteDeliveryChannel and $.X.filterPattern contains PutDeliveryChannel and $.X.filterPattern contains PutConfigurationRecorder) and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```
This policy identifies the AWS regions which do not have a log metric filter and alarm for AWS Config configuration changes. Monitoring changes to AWS Config configuration will help ensure sustained visibility of configuration items within the AWS account. It is recommended that a metric filter and alarm be established for detecting changes to AWS Config's configurations.

NOTE: This policy will trigger alert if you have at least one Cloudtrail with the multi trial is enabled, Logs all management events in your account and is not set with specific log metric filter and alarm.
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "eventName=" or $.X.filterPattern contains "eventName =") and ($.X.filterPattern does not contain "eventName!=" and $.X.filterPattern does not contain "eventName !=") and ($.X.filterPattern contains "eventSource=" or $.X.filterPattern contains "eventSource =") and ($.X.filterPattern does not contain "eventSource!=" and $.X.filterPattern does not contain "eventSource !=") and $.X.filterPattern contains config.amazonaws.com and $.X.filterPattern contains StopConfigurationRecorder and $.X.filterPattern contains DeleteDeliveryChannel and $.X.filterPattern contains PutDeliveryChannel and $.X.filterPattern contains PutConfigurationRecorder) and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```