knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
This policy identifies GCP accounts where GCP Cloud Asset Inventory is disabled.

GCP Cloud Asset Inventory is a metadata inventory service that allows you to view, monitor, and analyze Google Cloud and Anthos assets across projects and services. This data can prove to be crucial in security analysis, resource change tracking, and compliance auditing.

It is recommended to enable GCP Cloud Asset Inventory for centralized visibility and control over your cloud assets.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-services-list' AND json.rule = services[?any( name ends with "/cloudasset.googleapis.com" and state equals "ENABLED" )] does not exist```
Azure Container Registry with ARM audience token authentication enabled
```config from cloud.resource where api.name = 'azure-container-registry' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.policies.azureADAuthenticationAsArmPolicy.status contains enabled```
This policy identifies Azure Container Registries that permit ARM audience tokens for authentication.

When ARM audience tokens are enabled, they allow authentication intended for broader Azure services, which could introduce potential security risks. Disabling ARM audience tokens ensures that only ACR-specific tokens are valid, enhancing security by limiting authentication exclusively to Azure Container Registry audience tokens.

As a security best practice, it is recommended to disable ARM audience tokens for Azure Container Registries.
```config from cloud.resource where api.name = 'azure-container-registry' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.policies.azureADAuthenticationAsArmPolicy.status contains enabled```
Alibaba Cloud Security group is overly permissive to all traffic
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-security-group' AND json.rule = "permissions is not empty and permissions[?(@.policy=='Accept' && @.direction=='ingress')].sourceCidrIp contains 0.0.0.0/0"```
This policy identifies Security groups that are overly permissive to all traffic. As a best practice, restrict security groups to only allow permitted traffic and limit brute force attacks on your network.
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-security-group' AND json.rule = "permissions is not empty and permissions[?(@.policy=='Accept' && @.direction=='ingress')].sourceCidrIp contains 0.0.0.0/0"```
test_aggr_pk
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-cloudtrail-describe-trails' as X; count(X) less than 1 ```
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-cloudtrail-describe-trails' as X; count(X) less than 1 ```
Azure PostgreSQL flexible server secure transport parameter is disabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-flexible-server' AND json.rule = properties.state equal ignore case Ready and require_secure_transport.value does not equal ignore case on```
This policy identifies PostgreSQL flexible servers for which secure transport (SSL connectivity) parameter is disabled.

Secure transport (SSL connectivity) helps to provide a new layer of security, by connecting server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between server and client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and application.

As a security best practice, it is recommended to enable secure transport parameter for Azure PostgreSQL flexible server.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-flexible-server' AND json.rule = properties.state equal ignore case Ready and require_secure_transport.value does not equal ignore case on```
Azure AKS cluster pool profile count contains less than 3 nodes
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kubernetes-cluster' AND json.rule = 'properties.powerState.code equal ignore case Running and properties.agentPoolProfiles[?any(type equal ignore case AvailabilitySet and count less than 3)] exists'```
This policy identifies AKS clusters that are configured with node pool profile less than 3 nodes. It is recommended to have at least 3 or more than 3 nodes in a node pool for a more resilient cluster. (Clusters smaller than 3 may experience downtime during upgrades.)
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kubernetes-cluster' AND json.rule = 'properties.powerState.code equal ignore case Running and properties.agentPoolProfiles[?any(type equal ignore case AvailabilitySet and count less than 3)] exists'```
Automation Audit Log Cron BUVZK Policy
```config from cloud.resource where cloud.service = 'AWS Auto Scaling' AND api.name = 'aws-describe-auto-scaling-groups' AND json.rule = createdTime does not contain "foo"```
Automation Audit Log Policy
```config from cloud.resource where cloud.service = 'AWS Auto Scaling' AND api.name = 'aws-describe-auto-scaling-groups' AND json.rule = createdTime does not contain "foo"```
OCI Load balancer listener is not configured with SSL certificate
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-loadbalancer' AND json.rule = lifecycleState equals ACTIVE and listeners.* is not empty and listeners.*.sslConfiguration.certificateName is empty and listeners.*.protocol does not equal ignore case HTTP```
This policy identifies Load balancers for which the listener is not configured with an SSL certificate.

Enforcing an SSL connection helps prevent unauthorized users from reading sensitive data that is intercepted as it travels through the network, between clients/applications and cache servers.

It is recommended to implement SSL between the load balancer and your client; so that the load balancer can accept encrypted traffic from a client.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-loadbalancer' AND json.rule = lifecycleState equals ACTIVE and listeners.* is not empty and listeners.*.sslConfiguration.certificateName is empty and listeners.*.protocol does not equal ignore case HTTP```
Azure Cognitive Services account is not configured with managed identity
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cognitive-services-account' AND json.rule = properties.provisioningState equal ignore case Succeeded and (identity.type does not exist or identity.type equal ignore case None)```
This policy identifies Azure Cognitive Services accounts that are not configured with managed identity. Managed identity can be used to authenticate to any service that supports Azure AD authentication, without having credentials in your code. Storing credentials in a code increases the threat surface in case of exploitation and also managed identities eliminate the need for developers to manage credentials. So as a security best practice, it is recommended to have the managed identity to your Cognitive Services account.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-cognitive-services-account' AND json.rule = properties.provisioningState equal ignore case Succeeded and (identity.type does not exist or identity.type equal ignore case None)```
OCI Compute Instance boot volume has in-transit data encryption is disabled
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-compute-instance' AND json.rule = launchOptions.isPvEncryptionInTransitEnabled is false```
This policy identifies the OCI Compute Instances that are configured with disabled in-transit data encryption boot or block volumes. It is recommended that Compute Instance boot or block volumes should be configured with in-transit data encryption to minimize risk for sensitive data being leaked.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-compute-instance' AND json.rule = launchOptions.isPvEncryptionInTransitEnabled is false```
llatorre - RoleAssigment v4
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-assignment' AND json.rule = '((_DateTime.ageInDays($.properties.updatedOn) < 60) and (properties.principalType contains User) and (properties.scope starts with"/subscriptions"))' addcolumn properties.roleDefinition.properties.roleName properties.roleDefinition.properties.type properties.principalId properties.updatedBy```
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-assignment' AND json.rule = '((_DateTime.ageInDays($.properties.updatedOn) < 60) and (properties.principalType contains User) and (properties.scope starts with"/subscriptions"))' addcolumn properties.roleDefinition.properties.roleName properties.roleDefinition.properties.type properties.principalId properties.updatedBy```
AWS IAM password policy does not have a minimum of 16 characters
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or minimumPasswordLength < 16 or minimumPasswordLength does not exist'```
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or minimumPasswordLength < 16 or minimumPasswordLength does not exist'```
GCP Kubernetes cluster shielded GKE node with Secure Boot disabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = nodePools[?any(config.shieldedInstanceConfig.enableSecureBoot does not exist or config.shieldedInstanceConfig.enableSecureBoot is false)] exists```
This policy identifies GCP Kubernetes cluster shielded GKE nodes with Secure Boot disabled. An attacker may seek to alter boot components to persist malware or rootkits during system initialization. It is recommended to enable Secure Boot for Shielded GKE Nodes to verify the digital signature of node boot components.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = nodePools[?any(config.shieldedInstanceConfig.enableSecureBoot does not exist or config.shieldedInstanceConfig.enableSecureBoot is false)] exists```
GCP Storage buckets are publicly accessible to all users
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = iamConfiguration.publicAccessPrevention does not equal ignore case "enforced" and iam.bindings[*] size greater than 0 and iam.bindings[*].members[*] any equal allUsers```
This policy identifies the buckets which are publicly accessible to all users. Enabling public access to Storage buckets enables anybody with a web association to access sensitive information that is critical to business. Access over a whole bucket is controlled by IAM. Access to individual objects within the bucket is controlled by its ACLs.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = iamConfiguration.publicAccessPrevention does not equal ignore case "enforced" and iam.bindings[*] size greater than 0 and iam.bindings[*].members[*] any equal allUsers```
IBM Cloud API key creation is not restricted in account settings
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-iam-identity-account-setting' AND json.rule = restrict_create_platform_apikey does not equal "RESTRICTED"```
This policy identifies IBM cloud accounts where API key creation is not restricted in account settings. By default, all members of an account can create API keys. Enabling API key creation will restrict the users from creating API keys unless correct access is granted explicitly. It is recommended to enable API key creation setting and grant access only on a need basis. 
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-iam-identity-account-setting' AND json.rule = restrict_create_platform_apikey does not equal "RESTRICTED"```
GCP User managed service accounts have user managed service account keys
```config from cloud.resource where api.name = 'gcloud-iam-service-accounts-keys-list' as X; config from cloud.resource where api.name = 'gcloud-iam-service-accounts-list' as Y; filter '($.X.name does not contain prisma-cloud and $.X.name contains iam.gserviceaccount.com and $.X.name contains $.Y.email and $.X.keyType contains USER_MANAGED)' ; show X;```
This policy identifies user managed service accounts that use user managed service account keys instead of Google-managed. For user-managed keys, the User has to take ownership of key management activities. Even after owner precaution, keys can be easily leaked by common development malpractices like checking keys into the source code or leaving them in downloads directory or accidentally leaving them on support blogs/channels. So It is recommended to limit the use of User-managed service account keys and instead use Google-managed keys which cannot be downloaded.

Note: This policy might alert the service accounts which are not created using Terraform for cloud account onboarding. These alerts are valid as no user-managed service account should be used for cloud account onboarding.
```config from cloud.resource where api.name = 'gcloud-iam-service-accounts-keys-list' as X; config from cloud.resource where api.name = 'gcloud-iam-service-accounts-list' as Y; filter '($.X.name does not contain prisma-cloud and $.X.name contains iam.gserviceaccount.com and $.X.name contains $.Y.email and $.X.keyType contains USER_MANAGED)' ; show X;```
AWS ElastiCache cluster not associated with VPC
```config from cloud.resource where api.name = 'aws-elasticache-cache-clusters' as X; config from cloud.resource where api.name = 'aws-elasticache-describe-replication-groups' as Y; filter '$.Y.memberClusters contains $.X.cacheClusterId and $.X.cacheClusterStatus equals available and ($.X.cacheSubnetGroupName is empty or $.X.cacheSubnetGroupName does not exist)'; show Y;```
This policy identifies ElastiCache Clusters which are not associated with VPC. It is highly recommended to associate ElastiCache with VPC, as provides virtual network in your own logically isolated area and features such as selecting IP address range, creating subnets, and configuring route tables, network gateways, and security settings.

NOTE: If you created your AWS account before 2013-12-04, you might have support for the EC2-Classic platform in some regions. AWS has deprecated the use of Amazon EC2-Classic for launching ElastiCache clusters. All current generation nodes are launched in Amazon Virtual Private Cloud only. So this policy only applies legacy ElastiCache clusters which are created using EC2-Classic.
```config from cloud.resource where api.name = 'aws-elasticache-cache-clusters' as X; config from cloud.resource where api.name = 'aws-elasticache-describe-replication-groups' as Y; filter '$.Y.memberClusters contains $.X.cacheClusterId and $.X.cacheClusterStatus equals available and ($.X.cacheSubnetGroupName is empty or $.X.cacheSubnetGroupName does not exist)'; show Y;```
Azure Key Vault Firewall is not enabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-key-vault-list' AND json.rule = (properties.publicNetworkAccess does not equal ignore case disabled and properties.networkAcls does not exist) or (properties.publicNetworkAccess does not equal ignore case disabled and properties.networkAcls.defaultAction equal ignore case allow ) ```
This policy identifies Azure Key Vault which has Firewall disabled. Enabling Azure Key Vault Firewall feature prevents unauthorised traffic from reaching your key vault. It is recommend to enable Azure Key Vault Firewall which provides additional layer of protection for your secrets.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-key-vault-list' AND json.rule = (properties.publicNetworkAccess does not equal ignore case disabled and properties.networkAcls does not exist) or (properties.publicNetworkAccess does not equal ignore case disabled and properties.networkAcls.defaultAction equal ignore case allow ) ```
GCP Cloud Run service revision is using default service account with editor role
```config from cloud.resource where api.name = 'gcloud-projects-get-iam-user' AND json.rule = user contains "compute@developer.gserviceaccount.com" and roles[*] contains "roles/editor" as X; config from cloud.resource where api.name = 'gcloud-cloud-run-revisions-list' AND json.rule = spec.serviceAccountName contains "compute@developer.gserviceaccount.com" as Y; filter ' $.X.user equals $.Y.spec.serviceAccountName '; show Y;```
This policy identifies GCP Cloud Run service revisions that are utilizing the default service account with the editor role. 

GCP Compute Engine Default service account is automatically created upon enabling the Compute Engine API. This service account is granted the IAM basic Editor role by default, unless explicitly disabled. Assigning default service account with the editor role to cloud run revisions could lead to privilege escalation. Granting minimal access rights helps in promoting a better security posture.

Following the principle of least privileges, it is recommended to avoid assigning default service account with the editor role to cloud run revision.
```config from cloud.resource where api.name = 'gcloud-projects-get-iam-user' AND json.rule = user contains "compute@developer.gserviceaccount.com" and roles[*] contains "roles/editor" as X; config from cloud.resource where api.name = 'gcloud-cloud-run-revisions-list' AND json.rule = spec.serviceAccountName contains "compute@developer.gserviceaccount.com" as Y; filter ' $.X.user equals $.Y.spec.serviceAccountName '; show Y;```
GCP Log metric filter and alert does not exist for Project Ownership assignments/changes
```config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '($.Y.conditions[*].metricThresholdFilter contains $.X.name) and ($.X.filter contains "protoPayload.serviceName=" or $.X.filter contains "protoPayload.serviceName =") and ($.X.filter does not contain "protoPayload.serviceName !=" and $.X.filter does not contain "protoPayload.serviceName!=") and $.X.filter contains "cloudresourcemanager.googleapis.com" and ($.X.filter contains "ProjectOwnership OR projectOwnerInvitee" or $.X.filter contains "ProjectOwnership or projectOwnerInvitee") and ($.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.action=" or $.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.action =") and ($.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.action!=" and $.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.action !=") and ($.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.role=" or $.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.role =") and ($.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.role!=" and $.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.role !=") and $.X.filter contains "REMOVE" and $.X.filter contains "ADD" and $.X.filter contains "roles/owner"'; show X; count(X) less than 1```
This policy identifies the GCP account which does not have a log metric filter and alert for Project Ownership assignments/changes. Project Ownership Having highest level of privileges on a project, to avoid misuse of project resources project ownership assignment/change actions mentioned should be monitored and alerted to concerned recipients.
```config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '($.Y.conditions[*].metricThresholdFilter contains $.X.name) and ($.X.filter contains "protoPayload.serviceName=" or $.X.filter contains "protoPayload.serviceName =") and ($.X.filter does not contain "protoPayload.serviceName !=" and $.X.filter does not contain "protoPayload.serviceName!=") and $.X.filter contains "cloudresourcemanager.googleapis.com" and ($.X.filter contains "ProjectOwnership OR projectOwnerInvitee" or $.X.filter contains "ProjectOwnership or projectOwnerInvitee") and ($.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.action=" or $.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.action =") and ($.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.action!=" and $.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.action !=") and ($.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.role=" or $.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.role =") and ($.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.role!=" and $.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.role !=") and $.X.filter contains "REMOVE" and $.X.filter contains "ADD" and $.X.filter contains "roles/owner"'; show X; count(X) less than 1```
pkodoth - AWS S3 bucket not configured with secure data transport policy
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = "(((((acl.grants[?(@.grantee=='AllUsers')] size > 0) or policyStatus.isPublic is true) and publicAccessBlockConfiguration does not exist) or ((acl.grants[?(@.grantee=='AllUsers')] size > 0) and publicAccessBlockConfiguration.ignorePublicAcls is false) or (policyStatus.isPublic is true and publicAccessBlockConfiguration.restrictPublicBuckets is false)) and websiteConfiguration does not exist) and ((policy.Statement[*].Condition.Bool.aws:SecureTransport does not exist) or ((policy.Statement[?(@.Principal=='*' || @.Principal.AWS=='*')].Action contains s3: or policy.Statement[?(@.Principal=='*' || @.Principal.AWS=='*')].Action[*] contains s3:) and (policy.Statement[?(@.Principal=='*' && @.Effect=='Allow')].Condition.Bool.aws:SecureTransport contains false or policy.Statement[?(@.Principal.AWS=='*' && @.Effect=='Allow')].Condition.Bool.aws:SecureTransport contains false or policy.Statement[?(@.Principal=='*' && @.Effect=='Allow')].Condition.Bool.aws:SecureTransport contains FALSE or policy.Statement[?(@.Principal.AWS=='*' && @.Effect=='Allow')].Condition.Bool.aws:SecureTransport contains FALSE or policy.Statement[?(@.Principal=='*' && @.Effect=='Deny')].Condition.Bool.aws:SecureTransport contains true or policy.Statement[?(@.Principal.AWS=='*' && @.Effect=='Deny')].Condition.Bool.aws:SecureTransport contains true or policy.Statement[?(@.Principal=='*' && @.Effect=='Deny')].Condition.Bool.aws:SecureTransport contains TRUE or policy.Statement[?(@.Principal.AWS=='*' && @.Effect=='Deny')].Condition.Bool.aws:SecureTransport contains TRUE)))"```