knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
GCP VM instance OS login overrides Project metadata OS login configuration
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-project-info' AND json.rule = commonInstanceMetadata.items[?any(key contains "enable-oslogin" and (value contains "Yes" or value contains "Y" or value contains "True" or value contains "true" or value contains "TRUE" or value contains "1"))] exists as X; config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND json.rule = (metadata.items[?any(key exists and key contains "enable-oslogin" and (value contains "False" or value contains "N" or value contains "No" or value contains "false" or value contains "FALSE" or value contains "0"))] exists and name does not start with "gke-" and status equals RUNNING) as Y;filter'$.Y.zone contains $.X.name';show Y;```
This policy identifies GCP VM instances where OS login configuration is disabled and overriding enabled Project OS login configuration. Enabling OS Login ensures that SSH keys used to connect to instances are mapped with IAM users. Revoking access to IAM user will revoke all the SSH keys associated with that particular user. It facilitates centralized and automated SSH key pair management which is useful in handling cases like a response to compromised SSH key pairs. 

Note: Enabling OS Login on instances disables metadata-based SSH key configurations on those instances. Disabling OS Login restores SSH keys that you have configured in a project or instance metadata.

Reference: https://cloud.google.com/compute/docs/instances/managing-instance-access
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-project-info' AND json.rule = commonInstanceMetadata.items[?any(key contains "enable-oslogin" and (value contains "Yes" or value contains "Y" or value contains "True" or value contains "true" or value contains "TRUE" or value contains "1"))] exists as X; config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND json.rule = (metadata.items[?any(key exists and key contains "enable-oslogin" and (value contains "False" or value contains "N" or value contains "No" or value contains "false" or value contains "FALSE" or value contains "0"))] exists and name does not start with "gke-" and status equals RUNNING) as Y;filter'$.Y.zone contains $.X.name';show Y;```
AWS EMR Studio using the shadow resource bucket for workspace storage
```config from cloud.resource where api.name = 'aws-emr-studio' AND json.rule = DefaultS3Location exists and DefaultS3Location contains "aws-emr-studio-" as X; config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' AND json.rule = bucketName contains "aws-emr-studio-" as Y; filter 'not ($.X.BucketName equals $.Y.bucketName)' ; show X;```
This policy identifies that the AWS EMR Studio using the bucket for workspace storage is not managed from the current account. This could potentially be using the shadow resource bucket for workspace storage.

AWS EMR enables data processing and analysis using big data frameworks like Hadoop, Spark, and Hive. To create an EMR Studio, the EMR service automatically generates an S3 bucket. This S3 bucket follows the naming pattern 'aws-emr-studio-{Account-ID}-{Region}'. An attacker can create an unclaimed bucket with this predictable name and wait for the victim to deploy a new EMR Studio in a new region. This can result in multiple attacks, including cross-site scripting (XSS) when the user opens the compromised notebook in EMR Studio.

It is recommended to verify the expected bucket owner and update the AWS EMR storage location and enforce the aws: ResourceAccount condition in the policy of the service role used by the AWS EMR to check that the AWS account ID of the S3 bucket used by AWS EMR Studio according to your business requirements.
```config from cloud.resource where api.name = 'aws-emr-studio' AND json.rule = DefaultS3Location exists and DefaultS3Location contains "aws-emr-studio-" as X; config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' AND json.rule = bucketName contains "aws-emr-studio-" as Y; filter 'not ($.X.BucketName equals $.Y.bucketName)' ; show X;```
GCP VM instance used by Vertex AI Workbench Instance
```config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND json.rule = status equals "RUNNING" as X; config from cloud.resource where api.name = 'gcloud-vertex-ai-workbench-instance' as Y; filter ' $.Y.labels.resource-name equals $.X.labels.resource-name '; show X;```
This policy identifies GCP VM instances used by Vertex AI Workbench.

Vertex AI Workbench relies on GCP Compute Engine VM instances for backend processing. The selection of the appropriate VM instance type, size, and configuration directly impacts the performance and security of the Workbench. Proper configuration of these VM instances is critical to ensuring the security of the associated Vertex AI environment.

It is recommended to regularly identify and assess the VM instances supporting Vertex AI Workbench to maintain a strong security posture and ensure compliance with best practices.
```config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND json.rule = status equals "RUNNING" as X; config from cloud.resource where api.name = 'gcloud-vertex-ai-workbench-instance' as Y; filter ' $.Y.labels.resource-name equals $.X.labels.resource-name '; show X;```
dnd_test_validate_compliance_hyperion_policy_ss_finding_1
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = defaultRootObject is empty```
Description-d84c12b2-384e-429e-967a-2e9ea515846d
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = defaultRootObject is empty```
Azure user not restricted to create Microsoft Entra Security Group
```config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-active-directory-authorization-policy' AND json.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is true ```
This policy identifies instances in the Microsoft Entra ID configuration where security group creation is not restricted to administrators only.

When the ability to create security groups is enabled, all users in the directory can create new groups and add members to them. Unless there is a specific business need for this broad access, it is best to limit the creation of security groups to administrators only.

As a best practice, it is recommended to restrict the ability to create Microsoft Entra Security Groups to administrators only.
```config from cloud.resource where cloud.type = 'azure' and api.name = 'azure-active-directory-authorization-policy' AND json.rule = defaultUserRolePermissions.allowedToCreateSecurityGroups is true ```
AWS route table with VPC peering overly permissive to all traffic
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-route-tables' AND json.rule = "routes[*].vpcPeeringConnectionId exists and routes[?(@.destinationCidrBlock=='0.0.0.0/0' || @.destinationIpv6CidrBlock == '::/0')].vpcPeeringConnectionId starts with pcx"```
This policy identifies VPC route tables with VPC peering connection  which are overly permissive to all traffic. Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-route-tables' AND json.rule = "routes[*].vpcPeeringConnectionId exists and routes[?(@.destinationCidrBlock=='0.0.0.0/0' || @.destinationIpv6CidrBlock == '::/0')].vpcPeeringConnectionId starts with pcx"```
GCP PostgreSQL instance database flag log_error_verbosity is not set to default or stricter
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "state equals RUNNABLE and databaseVersion contains POSTGRES and (settings.databaseFlags[*].name does not contain log_error_verbosity or settings.databaseFlags[?any(name contains log_error_verbosity and value contains verbose)] exists)"```
This policy identifies PostgreSQL database instances in which database flag log_error_verbosity is not set to default. The flag log_error_verbosity controls the amount of detail written in the server log for each message that is logged. Valid values are TERSE, DEFAULT, and VERBOSE. It is recommended to set log_error_verbosity to default or terse.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "state equals RUNNABLE and databaseVersion contains POSTGRES and (settings.databaseFlags[*].name does not contain log_error_verbosity or settings.databaseFlags[?any(name contains log_error_verbosity and value contains verbose)] exists)"```
Azure Storage account diagnostic setting for table is disabled
```config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded as X; config from cloud.resource where api.name = 'azure-storage-account-table-diagnostic-settings' AND json.rule = properties.logs[*].enabled all true as Y; filter 'not($.X.name equal ignore case $.Y.StorageAccountName)'; show X;```
This policy identifies Azure Storage account tables that have diagnostic logging disabled.

By enabling diagnostic settings, you can capture various types of activities and events occurring within these storage account tables. These logs provide valuable insights into the operations, performance, and security of the storage account tables.

As a best practice, it is recommended to enable diagnostic logs on all storage account tables.
```config from cloud.resource where api.name = 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded as X; config from cloud.resource where api.name = 'azure-storage-account-table-diagnostic-settings' AND json.rule = properties.logs[*].enabled all true as Y; filter 'not($.X.name equal ignore case $.Y.StorageAccountName)'; show X;```
Check BC
```config from cloud.resource where api.name = 'gcloud-compute-ssl-policies' AND json.rule = (profile equals MODERN or profile equals CUSTOM) and minTlsVersion does not equal "TLS_1_2" as X; config from cloud.resource where api.name = 'gcloud-compute-target-https-proxies' AND json.rule = sslPolicy exists as Y; filter "$.X.selfLink contains $.Y.sslPolicy"; show Y;```
```config from cloud.resource where api.name = 'gcloud-compute-ssl-policies' AND json.rule = (profile equals MODERN or profile equals CUSTOM) and minTlsVersion does not equal "TLS_1_2" as X; config from cloud.resource where api.name = 'gcloud-compute-target-https-proxies' AND json.rule = sslPolicy exists as Y; filter "$.X.selfLink contains $.Y.sslPolicy"; show Y;```
AWS Elastic Load Balancer (Classic) SSL negotiation policy configured with insecure ciphers
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elb-describe-load-balancers' AND json.rule = "policies[*].policyAttributeDescriptions[?(@.attributeName=='DHE-RSA-AES128-SHA'|| @.attributeName=='DHE-DSS-AES128-SHA' || @.attributeName=='CAMELLIA128-SHA' || @.attributeName=='EDH-RSA-DES-CBC3-SHA' || @.attributeName=='DES-CBC3-SHA' || @.attributeName=='ECDHE-RSA-RC4-SHA' || @.attributeName=='RC4-SHA' || @.attributeName=='ECDHE-ECDSA-RC4-SHA' || @.attributeName=='DHE-DSS-AES256-GCM-SHA384' || @.attributeName=='DHE-RSA-AES256-GCM-SHA384' || @.attributeName=='DHE-RSA-AES256-SHA256' || @.attributeName=='DHE-DSS-AES256-SHA256' || @.attributeName=='DHE-RSA-AES256-SHA' || @.attributeName=='DHE-DSS-AES256-SHA' || @.attributeName=='DHE-RSA-CAMELLIA256-SHA' || @.attributeName=='DHE-DSS-CAMELLIA256-SHA' || @.attributeName=='CAMELLIA256-SHA' || @.attributeName=='EDH-DSS-DES-CBC3-SHA' || @.attributeName=='DHE-DSS-AES128-GCM-SHA256' || @.attributeName=='DHE-RSA-AES128-GCM-SHA256' || @.attributeName=='DHE-RSA-AES128-SHA256' || @.attributeName=='DHE-DSS-AES128-SHA256' || @.attributeName=='DHE-RSA-CAMELLIA128-SHA' || @.attributeName=='DHE-DSS-CAMELLIA128-SHA' || @.attributeName=='ADH-AES128-GCM-SHA256' || @.attributeName=='ADH-AES128-SHA' || @.attributeName=='ADH-AES128-SHA256' || @.attributeName=='ADH-AES256-GCM-SHA384' || @.attributeName=='ADH-AES256-SHA' || @.attributeName=='ADH-AES256-SHA256' || @.attributeName=='ADH-CAMELLIA128-SHA' || @.attributeName=='ADH-CAMELLIA256-SHA' || @.attributeName=='ADH-DES-CBC3-SHA' || @.attributeName=='ADH-DES-CBC-SHA' || @.attributeName=='ADH-RC4-MD5' || @.attributeName=='ADH-SEED-SHA' || @.attributeName=='DES-CBC-SHA' || @.attributeName=='DHE-DSS-SEED-SHA' || @.attributeName=='DHE-RSA-SEED-SHA' || @.attributeName=='EDH-DSS-DES-CBC-SHA' || @.attributeName=='EDH-RSA-DES-CBC-SHA' || @.attributeName=='IDEA-CBC-SHA' || @.attributeName=='RC4-MD5' || @.attributeName=='SEED-SHA' || @.attributeName=='DES-CBC3-MD5' || @.attributeName=='DES-CBC-MD5' || @.attributeName=='RC2-CBC-MD5' || @.attributeName=='PSK-AES256-CBC-SHA' || @.attributeName=='PSK-3DES-EDE-CBC-SHA' || @.attributeName=='KRB5-DES-CBC3-SHA' || @.attributeName=='KRB5-DES-CBC3-MD5' || @.attributeName=='PSK-AES128-CBC-SHA' || @.attributeName=='PSK-RC4-SHA' || @.attributeName=='KRB5-RC4-SHA' || @.attributeName=='KRB5-RC4-MD5' || @.attributeName=='KRB5-DES-CBC-SHA' || @.attributeName=='KRB5-DES-CBC-MD5' || @.attributeName=='EXP-EDH-RSA-DES-CBC-SHA' || @.attributeName=='EXP-EDH-DSS-DES-CBC-SHA' || @.attributeName=='EXP-ADH-DES-CBC-SHA' || @.attributeName=='EXP-DES-CBC-SHA' || @.attributeName=='EXP-RC2-CBC-MD5' || @.attributeName=='EXP-KRB5-RC2-CBC-SHA' || @.attributeName=='EXP-KRB5-DES-CBC-SHA' || @.attributeName=='EXP-KRB5-RC2-CBC-MD5' || @.attributeName=='EXP-KRB5-DES-CBC-MD5' || @.attributeName=='EXP-ADH-RC4-MD5' || @.attributeName=='EXP-RC4-MD5' || @.attributeName=='EXP-KRB5-RC4-SHA' || @.attributeName=='EXP-KRB5-RC4-MD5')].attributeValue equals true"```
GCP BigQuery Dataset not configured with default CMEK
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-bigquery-dataset-list' AND json.rule = defaultEncryptionConfiguration.kmsKeyName does not exist```
This policy identifies BigQuery Datasets that are not configured with default CMEK. Setting a Default Customer-managed encryption key (CMEK) for a data set ensures any tables created in the future will use the specified CMEK if none other is provided. It is recommended to configure all BigQuery Datasets with default CMEK.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-bigquery-dataset-list' AND json.rule = defaultEncryptionConfiguration.kmsKeyName does not exist```
Azure Network Security Group allows all traffic on Windows SMB (TCP Port 445)
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and (protocol equals Tcp or protocol equals *) and (destinationPortRange contains _Port.inRange(445,445) or destinationPortRanges[*] contains _Port.inRange(445,445) ))] exists```
This policy identifies Azure Network Security Groups (NSG) that allow all traffic on Windows SMB TCP port 445. Review your list of NSG rules to ensure that your resources are not exposed. As a best practice, restrict DNS solely to known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and (protocol equals Tcp or protocol equals *) and (destinationPortRange contains _Port.inRange(445,445) or destinationPortRanges[*] contains _Port.inRange(445,445) ))] exists```
AWS S3 bucket having policy overly permissive to VPC endpoints
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-s3api-get-bucket-acl' AND json.rule = 'policy.Statement[?any((Condition.StringNotEquals contains aws:SourceVpce and Effect equals Deny and (Action contains s3:* or Action[*] contains s3:*)) or (Condition.StringEquals contains aws:SourceVpce and Effect equals Allow and (Action contains s3:* or Action[*] contains s3:*)))] exists'```
This policy identifies S3 buckets that have the bucket policy overly permissive to VPC endpoints. It is recommended to follow the principle of least privileges ensuring that the VPC endpoints have only necessary permissions instead of full permission on S3 operations.

NOTE: When applying the Amazon S3 bucket policies for VPC endpoints described in this section, you might block your access to the bucket without intending to do so. Bucket permissions that are intended to specifically limit bucket access to connections originating from your VPC endpoint can block all connections to the bucket. The policy might disable console access to the specified bucket because console requests don't originate from the specified VPC endpoint. So remediation should be done very carefully.

For details refer https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html 
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-s3api-get-bucket-acl' AND json.rule = 'policy.Statement[?any((Condition.StringNotEquals contains aws:SourceVpce and Effect equals Deny and (Action contains s3:* or Action[*] contains s3:*)) or (Condition.StringEquals contains aws:SourceVpce and Effect equals Allow and (Action contains s3:* or Action[*] contains s3:*)))] exists'```
AWS KMS Key policy overly permissive
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and policies.default.Statement[?any(Principal.AWS contains * and Effect equal ignore case allow and Condition does not exist)] exists```
This policy identifies KMS Keys that have a key policy overly permissive. Key policies are the primary way to control access to customer master keys (CMKs) in AWS KMS. It is recommended to follow the principle of least privilege ensuring that KMS key policy does not have all the permissions to be able to complete a malicious action.

For more details:
https://docs.aws.amazon.com/kms/latest/developerguide/control-access-overview.html#overview-policy-elements
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and policies.default.Statement[?any(Principal.AWS contains * and Effect equal ignore case allow and Condition does not exist)] exists```
Azure App Service Web app doesn't use latest .Net Core version
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'config.isDotnetcoreVersionLatest exists and config.isDotnetcoreVersionLatest equals false'```
This policy identifies App Service Web apps that are not configured with latest .Net Core version. Periodically, newer versions are released for .Net Core software either due to security flaws or to include additional functionality. It is recommended to use the latest .Net version for web apps in order to take advantage of security fixes, if any.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'config.isDotnetcoreVersionLatest exists and config.isDotnetcoreVersionLatest equals false'```
AWS Customer Master Key (CMK) rotation is not enabled
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and keyMetadata.keyManager equals CUSTOMER and keyMetadata.origin equals AWS_KMS and (rotation_status.keyRotationEnabled is false or rotation_status.keyRotationEnabled equals "null") and keyMetadata.customerMasterKeySpec equals SYMMETRIC_DEFAULT```
This policy identifies Customer Master Keys (CMKs) that are not enabled with key rotation. AWS KMS (Key Management Service) allows customers to create master keys to encrypt sensitive data in different services. As a security best practice, it is important to rotate the keys periodically so that if the keys are compromised, the data in the underlying service is still secure with the new keys.
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and keyMetadata.keyManager equals CUSTOMER and keyMetadata.origin equals AWS_KMS and (rotation_status.keyRotationEnabled is false or rotation_status.keyRotationEnabled equals "null") and keyMetadata.customerMasterKeySpec equals SYMMETRIC_DEFAULT```
Azure Database for MariaDB not configured with private endpoint
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-database-maria-db-server' AND json.rule = properties.userVisibleState equal ignore case Ready and properties.privateEndpointConnections[*] is empty```
This policy identifies Azure MariaDB database servers that are not configured with private endpoint. Private endpoint connections enforce secure communication by enabling private connectivity to Azure Database for MariaDB. Configuring a private endpoint enables access to traffic coming from only known networks and prevents access from malicious or unknown IP addresses which includes IP addresses within Azure. It is recommended to create private endpoint for secure communication for your Azure MariaDB database.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-database-maria-db-server' AND json.rule = properties.userVisibleState equal ignore case Ready and properties.privateEndpointConnections[*] is empty```
Azure SQL server public network access setting is enabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = ['sqlServer'].['properties.state'] equal ignore case Ready and ['sqlServer'].['properties.publicNetworkAccess'] equal ignore case Enabled and ['sqlServer'].['properties.privateEndpointConnections'] is empty and firewallRules[*] is empty```
This policy identifies Azure SQL servers which have public network access setting enabled.

Publicly accessible SQL servers are vulnerable to external threats with risk of unauthorized access or may remotely exploit any vulnerabilities.

It is recommended to configure the SQL servers with IP-based strict server-level firewall rules or virtual-network rules or private endpoints so that servers are accessible only to restricted entities.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = ['sqlServer'].['properties.state'] equal ignore case Ready and ['sqlServer'].['properties.publicNetworkAccess'] equal ignore case Enabled and ['sqlServer'].['properties.privateEndpointConnections'] is empty and firewallRules[*] is empty```
OCI Load Balancer not configured with backend set
```config from cloud.resource where api.name = 'oci-networking-loadbalancer' AND json.rule = lifecycleState equal ignore case "ACTIVE" and backendSets.*.backends is empty OR backendSets.*.backends equals "[]"```