knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
AWS Elastic Load Balancer (ELB) with IAM certificate expiring in 90 days
```config from cloud.resource where api.name = 'aws-elb-describe-load-balancers' as X; config from cloud.resource where api.name = 'aws-iam-list-server-certificates' as Y; filter '($.X.description.listenerDescriptions[*].listener.sslcertificateId equals $.Y.arn and ((_DateTime.ageInDays($.Y.expiration) > -90 and (_DateTime.ageInDays($.Y.expiration) < 0 or _DateTime.ageInDays($.Y.expiration) == 0)) or (_DateTime.ageInDays($.Y.expiration) > 0)))'; show X;```
This policy identifies Elastic Load Balancers (ELB) which are using IAM certificates expiring in 90 days or using expired certificates. Removing expired IAM certificates eliminates the risk and prevents the damage of credibility of the application/website behind the ELB. As a best practice, it is recommended to reimport expiring certificates while preserving the ELB associations of the original certificate.
```config from cloud.resource where api.name = 'aws-elb-describe-load-balancers' as X; config from cloud.resource where api.name = 'aws-iam-list-server-certificates' as Y; filter '($.X.description.listenerDescriptions[*].listener.sslcertificateId equals $.Y.arn and ((_DateTime.ageInDays($.Y.expiration) > -90 and (_DateTime.ageInDays($.Y.expiration) < 0 or _DateTime.ageInDays($.Y.expiration) == 0)) or (_DateTime.ageInDays($.Y.expiration) > 0)))'; show X;```
Alibaba Cloud RAM policy allows full administrative privileges
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ram-policy' AND json.rule = "(policy.policyType does not contain System) and (defaultPolicyVersion.policyDocument.Statement[?(@.Resource == '*' && @.Effect== 'Allow')].Action equals *)"```
This policy identifies RAM policies with full administrative privileges. RAM policies are the means by which privileges are granted to users, groups or roles. It is recommended to grant the least privilege access like granting only the permissions required to perform a task, instead of allowing full administrative privileges.
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ram-policy' AND json.rule = "(policy.policyType does not contain System) and (defaultPolicyVersion.policyDocument.Statement[?(@.Resource == '*' && @.Effect== 'Allow')].Action equals *)"```
AWS Elastic Load Balancer (Classic) with cross-zone load balancing disabled
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elb-describe-load-balancers' AND json.rule = 'attributes.crossZoneLoadBalancing.enabled is false'```
This policy identifies Classic Elastic Load Balancers which have cross-zone load balancing disabled. When Cross-zone load balancing enabled, classic load balancer distributes requests evenly across the registered instances in all enabled Availability Zones. Cross-zone load balancing reduces the need to maintain equivalent numbers of instances in each enabled Availability Zone, and improves your application's ability to handle the loss of one or more instances.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elb-describe-load-balancers' AND json.rule = 'attributes.crossZoneLoadBalancing.enabled is false'```
GCP Kubernetes Engine Clusters have legacy compute engine metadata endpoints enabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = "nodePools[*].config.metadata does not exist or nodePools[*].config.metadata does not contain disable-legacy-endpoints or nodePools[*].config.metadata.disable-legacy-endpoints does not contain true"```
This policy identifies Google Kubernetes Engine (GKE) clusters that have legacy compute engine metadata endpoints enabled. Because GKE uses instance metadata to configure node VMs, some of this metadata is potentially sensitive and should be protected from workloads running on the cluster. Legacy metadata APIs expose the Compute Engine's instance metadata of server endpoints. As a best practice, disable legacy API and use v1 APIs to restrict a potential attacker from retrieving instance metadata.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = "nodePools[*].config.metadata does not exist or nodePools[*].config.metadata does not contain disable-legacy-endpoints or nodePools[*].config.metadata.disable-legacy-endpoints does not contain true"```
Azure Virtual Network subnet is not configured with a Network Security Group
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-subnet-list' AND json.rule = networkSecurityGroupId does not exist and name does not equal ignore case "GatewaySubnet" and name does not equal ignore case "RouteServerSubnet" and name does not equal ignore case "AzureFirewallSubnet" and name does not equal ignore case "AzureFirewallManagementSubnet" and ['properties.delegations'][*].['properties.serviceName'] does not equal "Microsoft.Netapp/volumes"```
This policy identifies Azure Virtual Network (VNet) subnets that are not associated with a Network Security Group (NSG).

While binding an NSG to a network interface of a Virtual Machine (VM) enables fine-grained control of the VM, associating an NSG to a subnet enables better control over network traffic to all resources within a subnet.

It is recommended to associate an NSG with a subnet so that you can protect your VMs on a subnet-level.

For more information,
https://learn.microsoft.com/en-gb/archive/blogs/igorpag/azure-network-security-groups-nsg-best-practices-and-lessons-learned
https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview#limitations

Note: This policy will not report for subnets used by Azure Firewall Subnet, Azure Firewall Management Subnet, Gateway Subnet, NetApp File Share, Route Server Subnet, Private endpoints and Private links as Azure recommends not to configure Network Security Group (NSG) for these services.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-subnet-list' AND json.rule = networkSecurityGroupId does not exist and name does not equal ignore case "GatewaySubnet" and name does not equal ignore case "RouteServerSubnet" and name does not equal ignore case "AzureFirewallSubnet" and name does not equal ignore case "AzureFirewallManagementSubnet" and ['properties.delegations'][*].['properties.serviceName'] does not equal "Microsoft.Netapp/volumes"```
Azure Application Insights configured with overly permissive network access
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-insights-component' AND json.rule = properties.provisioningState equals Succeeded and (properties.publicNetworkAccessForQuery equals Enabled or properties.publicNetworkAccessForIngestion equals Enabled)```
This policy identifies Application Insights configured with overly permissive network access.

Virtual network access configuration in Application Insights allows you to restrict data ingestion and queries coming from  public networks.

It is recommended to configure the Application Insights with virtual networks access configuration set to restrict, so that the Application Insight is accessible only to restricted Azure Monitor Private Link Scopes.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-insights-component' AND json.rule = properties.provisioningState equals Succeeded and (properties.publicNetworkAccessForQuery equals Enabled or properties.publicNetworkAccessForIngestion equals Enabled)```
Azure Microsoft Defender for Cloud is set to Off for Azure SQL Databases
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any( name equals SqlServers and properties.pricingTier does not equal Standard)] exists```
This policy identifies Azure Microsoft Defender for Cloud (previously known as Azure Security Center and Azure Defender) which has defender setting for Azure SQL Databases is set to Off. Enabling Microsoft Defender for Cloud provides the tools needed to harden your resources, track your security posture, protect against cyberattacks, and streamline security management. It is highly recommended to enable Microsoft Defender for Azure SQL Databases.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any( name equals SqlServers and properties.pricingTier does not equal Standard)] exists```
AWS CloudTrail logs should integrate with CloudWatch for all regions
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudtrail-describe-trails' as X; config from cloud.resource where api.name = 'aws-cloudtrail-get-trail-status' as Y; filter '(($.X.name == $.Y.trail) and ($.X.cloudWatchLogsLogGroupArn is not empty and $.X.cloudWatchLogsLogGroupArn exists) and $.X.isMultiRegionTrail is false and ($.Y.status.latestCloudWatchLogsDeliveryTime exists))'; show X;```
This policy identifies the Cloudtrails which is not integrated with cloudwatch for all regions. CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs within a specified S3 bucket for long term analysis, realtime analysis can be performed by configuring CloudTrail to send logs to CloudWatch Logs. For a trail that is enabled in all regions in an account, CloudTrail sends log files from all those regions to a CloudWatch Logs log group. It is recommended that CloudTrail logs be sent to CloudWatch Logs.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudtrail-describe-trails' as X; config from cloud.resource where api.name = 'aws-cloudtrail-get-trail-status' as Y; filter '(($.X.name == $.Y.trail) and ($.X.cloudWatchLogsLogGroupArn is not empty and $.X.cloudWatchLogsLogGroupArn exists) and $.X.isMultiRegionTrail is false and ($.Y.status.latestCloudWatchLogsDeliveryTime exists))'; show X;```
Azure Network Security Group allows all traffic on SQL Server (TCP Port 1433)
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and (protocol equals Tcp or protocol equals *) and (destinationPortRange contains _Port.inRange(1433,1433) or destinationPortRanges[*] contains _Port.inRange(1433,1433) ))] exists```
This policy identifies Azure Network Security Groups (NSG) that allow all traffic on SQL Server (TCP Port 1433). Review your list of NSG rules to ensure that your resources are not exposed. As a best practice, restrict SQL Server solely to known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and (protocol equals Tcp or protocol equals *) and (destinationPortRange contains _Port.inRange(1433,1433) or destinationPortRanges[*] contains _Port.inRange(1433,1433) ))] exists```
Medium of AWS S3 bucket publicly readable
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = ((((publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false) or (publicAccessBlockConfiguration.ignorePublicAcls is false and accountLevelPublicAccessBlockConfiguration.ignorePublicAcls is false)) and acl.grantsAsList[?any(grantee equals AllUsers and permission is member of (ReadAcp,Read,FullControl))] exists) or ((policyStatus.isPublic is true and ((publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration does not exist) or (publicAccessBlockConfiguration does not exist and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false) or (publicAccessBlockConfiguration.restrictPublicBuckets is false and accountLevelPublicAccessBlockConfiguration.restrictPublicBuckets is false))) and (policy.Statement[?any(Effect equals Allow and (Principal equals * or Principal.AWS equals *) and (Action contains s3:* or Action contains s3:Get or Action contains s3:List) and (Condition does not exist))] exists))) and websiteConfiguration does not exist```
OCI Oracle Autonomous Database (ADB) access is not restricted to allowed sources or deployed within a Virtual Cloud Network
```config from cloud.resource where api.name = 'oci-database-autonomous-database' AND json.rule = lifecycleState contains AVAILABLE AND whitelistedIps is member of ("null") AND privateEndpoint is member of ("null")```
This policy identifies Oracle Autonomous Databases (ADBs) that are not restricted to specific sources or not deployed within a Virtual Cloud Network (VCN). 

Autonomous Database automates critical database management tasks, and restricting its access to corporate IP addresses or VCNs is crucial for enhancing security. Deploying Autonomous Databases within a VCN and configuring access control rules ensure that only authorized sources can connect, significantly reducing the risk of unauthorized access. This protection is vital for maintaining the integrity and security of the databases.

As best practice, it is recommended to have new Autonomous Database instances deployed within a VCN, and existing instances should have access control rules set to restrict connectivity to approved sources.
```config from cloud.resource where api.name = 'oci-database-autonomous-database' AND json.rule = lifecycleState contains AVAILABLE AND whitelistedIps is member of ("null") AND privateEndpoint is member of ("null")```
aweawoie
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kubernetes-cluster' AND json.rule = properties.powerState.code equal ignore case Running and properties.apiServerAccessProfile.enablePrivateCluster is false and (properties.apiServerAccessProfile.authorizedIPRanges does not exist or properties.apiServerAccessProfile.authorizedIPRanges is empty)```
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kubernetes-cluster' AND json.rule = properties.powerState.code equal ignore case Running and properties.apiServerAccessProfile.enablePrivateCluster is false and (properties.apiServerAccessProfile.authorizedIPRanges does not exist or properties.apiServerAccessProfile.authorizedIPRanges is empty)```
AWS MQ is publicly accessible
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-mq-broker' AND json.rule = 'brokerState equals RUNNING and publiclyAccessible is true'```
This policy identifies the AWS MQ brokers which are publicly accessible. It is advisable to use MQ brokers privately only from within your AWS Virtual Private Cloud (VPC). Ensure that the AWS MQ brokers provisioned in your AWS account are not publicly accessible from the Internet to avoid sensitive data exposure and minimize security risks. 
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-mq-broker' AND json.rule = 'brokerState equals RUNNING and publiclyAccessible is true'```
API automation policy vwptv
```config from cloud.resource where api.name = "aws-ec2-describe-instances" AND json.rule = architecture contains "foo"```
GCP Secrets Manager secret has no expiration date
```config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcloud-secretsmanager-secret' AND json.rule = expireTime does not exist```
This policy identifies GCP Secret Manager secrets that have no expiration date.

GCP Secret Manager securely stores and controls access to API keys, passwords, certificates, and other sensitive data. Without an expiration date, secrets remain vulnerable indefinitely. Setting an expiration date limits the potential damage of a security breach, as compromised credentials will eventually become invalid.

It is recommended to configure secrets with an expiration date to reduce the risk of long-lived secrets being compromised or abused.
```config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcloud-secretsmanager-secret' AND json.rule = expireTime does not exist```
dnd_test_create_hyperion_policy_without_asset_type_finding_1
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = defaultRootObject is empty```
Description-bf90f2fb-d709-4040-a033-b74ef4a2f6d8
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = defaultRootObject is empty```
comcast-policy
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix does not equal 96.116.133.104/32 or sourceAddressPrefix does not equal 96.116.134.8/32 or sourceAddressPrefix does not equal 96.118.251.38/32 or sourceAddressPrefix does not equal 96.118.251.70/32 or sourceAddressPrefix does not equal 2001:558:fc0c::f816:3eff:fe2b:7e9f/128 or sourceAddressPrefix does not equal 2001:558:fc0c::f816:3eff:fe2d:f8c0/128 or sourceAddressPrefix does not equal 2001:558:fc18:2:f816:3eff:fea9:fec9/128 or sourceAddressPrefix does not equal 2001:558:fc18:2:f816:3eff:fe86:aa73/128) and (destinationPortRange contains _Port.inRange(22,22) or destinationPortRanges[*] contains _Port.inRange(22,22) ))] exists```
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix does not equal 96.116.133.104/32 or sourceAddressPrefix does not equal 96.116.134.8/32 or sourceAddressPrefix does not equal 96.118.251.38/32 or sourceAddressPrefix does not equal 96.118.251.70/32 or sourceAddressPrefix does not equal 2001:558:fc0c::f816:3eff:fe2b:7e9f/128 or sourceAddressPrefix does not equal 2001:558:fc0c::f816:3eff:fe2d:f8c0/128 or sourceAddressPrefix does not equal 2001:558:fc18:2:f816:3eff:fea9:fec9/128 or sourceAddressPrefix does not equal 2001:558:fc18:2:f816:3eff:fe86:aa73/128) and (destinationPortRange contains _Port.inRange(22,22) or destinationPortRanges[*] contains _Port.inRange(22,22) ))] exists```
Azure Service bus namespace configured with overly permissive authorization rules
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-service-bus-namespace' AND json.rule = authorizationRules[*] size greater than 1 and authorizationRules[?any(name does not equal RootManageSharedAccessKey and properties.rights contains Manage)] exists```
This policy identifies Azure Service bus namespaces configured with overly permissive authorization rules. Service Bus clients should not use a namespace level access policy that provides access to all queues and topics in a namespace. It is recommended to follow the least privileged security model, should create access policies at the entity level for queues and topics to provide access to only the specific entity. All authorization rules except RootManageSharedAccessKey should be removed from the Service bus namespace.


```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-service-bus-namespace' AND json.rule = authorizationRules[*] size greater than 1 and authorizationRules[?any(name does not equal RootManageSharedAccessKey and properties.rights contains Manage)] exists```
AWS Elastic Load Balancer (ELB) not in use
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elb-describe-load-balancers' AND json.rule = 'instancesAttached is false'```
This policy identifies unused Elastic Load Balancers (ELBs) in your AWS account. Any Elastic Load Balancer in your AWS account is adding charges to your monthly bill, although it is not used by any resources. As a best practice, it is recommended to remove ELBs that are not associated with any instances, it will also help you avoid unexpected charges on your bill.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elb-describe-load-balancers' AND json.rule = 'instancesAttached is false'```
GCP SQL database is assigned with public IP
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = backendType equals SECOND_GEN and ipAddresses[*].type contains PRIMARY```
This policy identifies GCP SQL databases which are assigned with public IP.  To lower the organisation's attack surface, Cloud SQL databases should not have public IPs. Private IPs provide improved network security and lower latency for your application. It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs. 
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = backendType equals SECOND_GEN and ipAddresses[*].type contains PRIMARY```
Azure Microsoft Defender for Cloud set to Off for Open-Source Relational Databases
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any(name equals OpenSourceRelationalDatabases and properties.pricingTier does not equal Standard)] exists```
This policy identifies Azure Microsoft Defender for Cloud which has defender setting for Open-Source Relational Databases set to Off. Enabling Azure Defender for cloud provides advanced security capabilities like threat intelligence, anomaly detection, and behaviour analytics. Microsoft Defender for Cloud detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. It is highly recommended to enable Azure Defender for Open-Source Relational Databases.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any(name equals OpenSourceRelationalDatabases and properties.pricingTier does not equal Standard)] exists```
llatorre - RoleAssigment v2
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-assignment' as X; config from cloud.resource where api.name = 'azure-active-directory-user' as Y; filter '((_DateTime.ageInDays($.X.properties.updatedOn) < 1) and (($.X.properties.principalId contains $.Y.id)))'; show X;```
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-assignment' as X; config from cloud.resource where api.name = 'azure-active-directory-user' as Y; filter '((_DateTime.ageInDays($.X.properties.updatedOn) < 1) and (($.X.properties.principalId contains $.Y.id)))'; show X;```
API automation policy pkifp
```config from cloud.resource where api.name = "aws-ec2-describe-instances" AND json.rule = architecture contains "foo"```
AWS KMS Key scheduled for deletion
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-kms-get-key-rotation-status' AND json.rule = 'keyMetadata.keyState contains PendingDeletion'```
This policy identifies KMS Keys which are scheduled for deletion. Deleting keys in AWS KMS is destructive and potentially dangerous. It deletes the key material and all metadata associated with it and is irreversible. After a key is deleted, you can no longer decrypt the data that was encrypted under that key, which means that data becomes unrecoverable. You should delete a key only when you are sure that you don't need to use it anymore. If you are not sure, It is recommended that to disable the key instead of deleting it.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-kms-get-key-rotation-status' AND json.rule = 'keyMetadata.keyState contains PendingDeletion'```