knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
GCP Firewall rule allows all traffic on RDP port (3389)
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-firewall-rules-list' AND json.rule = disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(ports contains _Port.inRange(3389,3389) or (ports does not exist and (IPProtocol contains tcp or IPProtocol contains udp)))] exists```
This policy identifies GCP Firewall rules which allow all inbound traffic on RDP port (3389). Allowing access from arbitrary IP addresses to this port increases the attack surface of your network. It is recommended that the RDP port (3389) should be allowed to specific IP addresses.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-firewall-rules-list' AND json.rule = disabled is false and direction equals INGRESS and (sourceRanges[*] equals ::0 or sourceRanges[*] equals 0.0.0.0 or sourceRanges[*] equals 0.0.0.0/0 or sourceRanges[*] equals ::/0 or sourceRanges[*] equals ::) and allowed[?any(ports contains _Port.inRange(3389,3389) or (ports does not exist and (IPProtocol contains tcp or IPProtocol contains udp)))] exists```
PCSUP-23654
```config from cloud.resource where finding.source = 'AWS Inspector' AND finding.type = 'AWS Inspector Security Best Practices'```
```config from cloud.resource where finding.source = 'AWS Inspector' AND finding.type = 'AWS Inspector Security Best Practices'```
GCP Service account is publicly accessible
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-iam-service-accounts-list' AND json.rule = ( iamPolicy.bindings[*].members contains "allUsers" or iamPolicy.bindings[*].members contains "allAuthenticatedUsers" ) and ( disabled does not exist or disabled is false )```
This policy identifies GCP Service accounts that are publicly accessible.

GCP Service accounts are intended to be used by an application or compute workload, rather than a person. It can be granted permission to perform actions in the GCP project as any other GCP user. Allowing access to 'allUsers' or 'allAuthenticatedUsers' over a service account would allow unwanted access to the public and could lead to a security breach.

As a security best practice, follow the Principle of Least Privilege and grant permissions to entities only on a need basis. It is recommended to avoid granting permission to 'allUsers' or 'allAuthenticatedUsers'.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-iam-service-accounts-list' AND json.rule = ( iamPolicy.bindings[*].members contains "allUsers" or iamPolicy.bindings[*].members contains "allAuthenticatedUsers" ) and ( disabled does not exist or disabled is false )```
AWS ECS cluster with container insights feature disabled
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ecs-cluster' AND json.rule = status equals ACTIVE and settings[?any(name equals containerInsights and value equals disabled)] exists```
This policy identifies ECS clusters that are disabled with the container insights feature. Container Insights collects metrics at the cluster, task, and service levels. As a best practice, enable container insights to start collecting the data available through these logs for the reported ECS cluster.

For details:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/deploy-container-insights-ECS-cluster.html
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ecs-cluster' AND json.rule = status equals ACTIVE and settings[?any(name equals containerInsights and value equals disabled)] exists```
GCP SQL database instance is not configured with automated backups
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = settings.backupConfiguration.enabled is false and instanceType is not member of ("READ_REPLICA_INSTANCE","ON_PREMISES_INSTANCE")```
This policy identifies the GCP SQL database instances that are not configured with automated backups. Automated backups need to be set for any instance that contains data that should be protected from loss or damage. It is recommended to have all SQL database instances set to enable automated backups.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = settings.backupConfiguration.enabled is false and instanceType is not member of ("READ_REPLICA_INSTANCE","ON_PREMISES_INSTANCE")```
AWS IAM password policy does not have a symbol
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or requireSymbols equals null or requireSymbols is false or requireSymbols does not exist'```
Checks to ensure that IAM password policy requires a symbol. AWS IAM (Identity & Access Management) allows customers to secure AWS console access. As a security best practice, customers must have strong password policies in place.
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or requireSymbols equals null or requireSymbols is false or requireSymbols does not exist'```
Azure App Service Web app doesn't use latest Python version
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'config.isPythonVersionLatest exists and config.isPythonVersionLatest equals false'```
This policy identifies App Service Web apps that are not configured with latest Python version. Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. It is recommended to use the latest Python version for web apps in order to take advantage of security fixes, if any.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'config.isPythonVersionLatest exists and config.isPythonVersionLatest equals false'```
Azure Activity log alert for Delete network security group does not exist
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/delete" as X; count(X) less than 1```
This policy identifies the Azure accounts in which activity log alert for Delete network security group does not exist. Creating an activity log alert for the Delete network security group gives insight into network access changes and may reduce the time it takes to detect suspicious activity.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-activity-log-alerts' AND json.rule = "location equal ignore case Global and properties.enabled equals true and properties.scopes[*] does not contain resourceGroups and properties.condition.allOf[?(@.field=='operationName')].equals equals Microsoft.Network/networkSecurityGroups/delete" as X; count(X) less than 1```
GCP Vertex AI Workbench user-managed notebook's JupyterLab interface access mode is set to single user
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-vertex-ai-notebook-instance' AND json.rule = state equals "ACTIVE" and ( metadata.proxy-mode equals "mail" or metadata.proxy-user-mail exists )```
This policy identifies GCP Vertex AI Workbench user-managed notebooks with JupyterLab interface access mode set to single user.

Vertex AI Workbench user-managed notebook can be accessed using the web-based JupyterLab interface. Access mode controls the control access to this interface. Allowing access to only a single user could limit collaboration, increase chances of credential sharing, and hinder security audits and reviews of the resource.

It is recommended to avoid single user access and make use of the service account access mode for user-managed notebooks.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-vertex-ai-notebook-instance' AND json.rule = state equals "ACTIVE" and ( metadata.proxy-mode equals "mail" or metadata.proxy-user-mail exists )```
GCP PostgreSQL instance database flag log_temp_files is not set to 0
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "databaseVersion contains POSTGRES and (settings.databaseFlags[?(@.name=='log_temp_files')] does not exist or settings.databaseFlags[?(@.name=='log_temp_files')].value does not equal 0)"```
This policy identifies PostgreSQL database instances in which database flag log_temp_files is not set to 0. The log_temp_files flag controls the logging of names and size of temporary files. Configuring log_temp_files to 0 causes all temporary file information to be logged, while positive values log only files whose size is greater than or equal to the specified number of kilobytes. A value of -1 disables temporary file information logging. If all temporary files are not logged, it may be more difficult to identify potential performance issues that may be either poor application coding or deliberate resource starvation attempts.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = "databaseVersion contains POSTGRES and (settings.databaseFlags[?(@.name=='log_temp_files')] does not exist or settings.databaseFlags[?(@.name=='log_temp_files')].value does not equal 0)"```
Copy of PCSUP-16458-CLI-Test
```config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-lambda-list-functions' AND json.rule = authType equal ignore case NONE```
AWS IAM policy overly permissive to STS services
```config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-get-policy-version' AND json.rule = isAttached is true and document.Statement[?any(Effect equals Allow and Action contains sts:* and Resource equals * and Condition does not exist)] exists```
This policy identifies the IAM policies that are overly permissive to STS services. AWS Security Token Service (AWS STS) is a web service that enables you to request temporary credentials for AWS Identity and Access Management (IAM) users or for users that you authenticate (federated users). It is recommended to follow the principle of least privileges ensuring that only restricted STS services for restricted resources.
```config from cloud.resource where cloud.type = 'aws' and api.name = 'aws-iam-get-policy-version' AND json.rule = isAttached is true and document.Statement[?any(Effect equals Allow and Action contains sts:* and Resource equals * and Condition does not exist)] exists```
AWS IAM SSH keys for AWS CodeCommit have aged more than 90 days without being rotated
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-ssh-public-keys' AND json.rule = '(_DateTime.ageInDays($.uploadDate) > 91) and status==Active'```
This policy identifies all of your IAM SSH public keys which haven't been rotated in the past 90 days. It is recommended to verify that they are rotated on a regular basis in order to protect your AWS CodeCommit repositories.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-ssh-public-keys' AND json.rule = '(_DateTime.ageInDays($.uploadDate) > 91) and status==Active'```
Azure Storage account not configured with SAS expiration policy
```config from cloud.resource where cloud.type = 'azure' and api.name= 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.allowSharedKeyAccess is true and properties.sasPolicy does not exist```
This policy identifies Azure Storage accounts not configured with SAS expiration policy.

A Shared Access Signature (SAS) expiration policy specifies a recommended interval over which the SAS is valid. SAS expiration policies apply to a service SAS or an account SAS. When a user generates service SAS or an account SAS with a validity interval that is larger than the recommended interval, they'll see a warning. If Azure Storage logging with Azure Monitor is enabled, then an entry is written to the Azure Storage logs. It is recommended that you limit the interval for a SAS in case it is compromised.

For more details:
https://learn.microsoft.com/en-us/azure/storage/common/sas-expiration-policy
```config from cloud.resource where cloud.type = 'azure' and api.name= 'azure-storage-account-list' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.allowSharedKeyAccess is true and properties.sasPolicy does not exist```
GCP Cloud Function v1 is using unsecured HTTP trigger
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-cloud-function-v2' AND json.rule = state equals "ACTIVE" AND environment equals "GEN_1" AND serviceConfig.securityLevel exists AND serviceConfig.securityLevel does not equal "SECURE_ALWAYS"```
This policy identifies GCP Cloud Functions v1 that are using unsecured HTTP trigger.

Using HTTP triggers for cloud functions poses significant security risks, including vulnerability to interception, tampering, and various attacks like man-in-the-middle. Conversely, HTTPS triggers provide encrypted communication, safeguarding sensitive data and ensuring confidentiality. HTTPS also supports authentication mechanisms, enhancing overall security and trust.

It is recommended to enable 'Require HTTPS' for HTTP triggers for all cloud functions v1.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-cloud-function-v2' AND json.rule = state equals "ACTIVE" AND environment equals "GEN_1" AND serviceConfig.securityLevel exists AND serviceConfig.securityLevel does not equal "SECURE_ALWAYS"```
GCP Cloud Run service is using default service account with editor role
```config from cloud.resource where api.name = 'gcloud-projects-get-iam-user' AND json.rule = user contains "compute@developer.gserviceaccount.com" and roles[*] contains "roles/editor" as X; config from cloud.resource where api.name = 'gcloud-cloud-run-services-list' AND json.rule = spec.template.spec.serviceAccountName contains "compute@developer.gserviceaccount.com" as Y; filter ' $.X.user equals $.Y.spec.template.spec.serviceAccountName '; show Y; ```
This policy identifies GCP Cloud Run services that are utilizing the default service account with the editor role.

When you create a new Cloud Run service, the compute engine default service account is associated with the service by default if any other service account is not configured. The compute engine default service account is automatically created when the Compute Engine API is enabled and is granted the IAM basic Editor role if you have not disabled this behavior explicitly. These permissions can be exploited to get admin access to the GCP project.

To be compliant with the principle of least privileges and prevent potential privilege escalation, it is recommended that Cloud Run services are not assigned the 'Compute Engine default service account' especially when the editor role is granted to the service account.
```config from cloud.resource where api.name = 'gcloud-projects-get-iam-user' AND json.rule = user contains "compute@developer.gserviceaccount.com" and roles[*] contains "roles/editor" as X; config from cloud.resource where api.name = 'gcloud-cloud-run-services-list' AND json.rule = spec.template.spec.serviceAccountName contains "compute@developer.gserviceaccount.com" as Y; filter ' $.X.user equals $.Y.spec.template.spec.serviceAccountName '; show Y; ```
GCP VM instance with Shielded VM Secure Boot disabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = status equals RUNNING and name does not start with "gke-" and (shieldedInstanceConfig does not exist or shieldedInstanceConfig.enableSecureBoot is false )```
This policy identifies GCP VM instances that have Shielded VM Secure Boot disabled.

Secure Boot is a security feature that ensures only trusted, digitally signed software runs during the boot process of a computer. Enabling it helps protect against malware and unauthorized software by verifying the integrity of the bootloader and operating system. Without Secure Boot, systems are vulnerable to rootkits, bootkits, and other malicious code that can compromise the system from the start, making it difficult to detect and remove such threats.

It is recommended to enable Shielded VM secure boot for GCP VM instances.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = status equals RUNNING and name does not start with "gke-" and (shieldedInstanceConfig does not exist or shieldedInstanceConfig.enableSecureBoot is false )```
GCP Kubernetes cluster Shielded GKE Nodes feature disabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = shieldedNodes.enabled does not exist or shieldedNodes.enabled equals "false"```
This policy identifies GCP Kubernetes clusters for which the Shielded GKE Nodes feature is not enabled. Shielded GKE nodes protect clusters against boot- or kernel-level malware or rootkits
which persist beyond infected OS. It is recommended to enable Shielded GKE Nodes for all the Kubernetes clusters.

FMI: https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = shieldedNodes.enabled does not exist or shieldedNodes.enabled equals "false"```
Azure SQL Server ADS Vulnerability Assessment 'Also send email notifications to admins and subscription owners' is disabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = vulnerabilityAssessments[*].properties.storageContainerPath exists and vulnerabilityAssessments[*].properties.recurringScans.emailSubscriptionAdmins is false```
This policy identifies Azure SQL Server which has ADS Vulnerability Assessment 'Also send email notifications to admins and subscription owners' disabled. This setting enables ADS - VA scan reports being sent to admins and subscription owners. It is recommended to enable 'Also send email notifications to admins and subscription owners' setting, which would help in reducing time required for identifying risks and taking corrective measures.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = vulnerabilityAssessments[*].properties.storageContainerPath exists and vulnerabilityAssessments[*].properties.recurringScans.emailSubscriptionAdmins is false```
RomanPolicy
```config from cloud.resource where cloud.type = 'azure' AND cloud.accountgroup NOT IN ( 'PCF Azure') AND api.name = 'azure-vm-list' AND json.rule = ['properties.storageProfile'].['osDisk'].['vhd'].['uri'] exists```
```config from cloud.resource where cloud.type = 'azure' AND cloud.accountgroup NOT IN ( 'PCF Azure') AND api.name = 'azure-vm-list' AND json.rule = ['properties.storageProfile'].['osDisk'].['vhd'].['uri'] exists```
GCP VM instance using a default service account with Cloud Platform access scope
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = (status equals RUNNING and name does not start with "gke-") and serviceAccounts[*].email contains "-compute@developer.gserviceaccount.com" and serviceAccounts[*].scopes[*] any equal "https://www.googleapis.com/auth/cloud-platform"```
This policy identifies the GCP VM instances that are using a default service account with cloud-platform access scope. To compliant with the principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account 'Compute Engine default service account' with scope 'cloud-platform'.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = (status equals RUNNING and name does not start with "gke-") and serviceAccounts[*].email contains "-compute@developer.gserviceaccount.com" and serviceAccounts[*].scopes[*] any equal "https://www.googleapis.com/auth/cloud-platform"```
Azure Machine Learning compute instance not configured inside virtual network
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-machine-learning-compute' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.properties.subnet.id does not exist```
This policy identifies Azure Machine Learning compute instances that are not configured within a virtual network.

Azure Machine Learning compute instances outside a Virtual Network are exposed to external threats, as they may be publicly accessible. Placing the instance within a Virtual Network improves security by limiting access to trusted virtual machines and services within the same network. This ensures secure communication and blocks unauthorized public access.

As a security best practice, it is recommended to deploy the Azure Machine Learning compute instances inside a virtual network.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-machine-learning-compute' AND json.rule = properties.provisioningState equal ignore case Succeeded and properties.properties.subnet.id does not exist```
AWS CloudFront not configured with AWS Web Application Firewall v2 (AWS WAFv2)
```config from cloud.resource where api.name = 'aws-waf-classic-global-web-acl-resource' as X; config from cloud.resource where api.name = 'aws-cloudfront-list-distributions' AND json.rule = webACLId is not empty as Y; filter '$.X.webACL.webACLId equals $.Y.webACLId'; show Y;```
This policy identifies AWS CloudFront which is not configured with AWS Web Application Firewall v2 (AWS WAFv2). As a best practice, configure the AWS WAFv2 service on the CloudFront to protect against application-layer attacks. To block malicious requests to your CloudFront, define the block criteria in the WAFv2 web access control list (web ACL).
```config from cloud.resource where api.name = 'aws-waf-classic-global-web-acl-resource' as X; config from cloud.resource where api.name = 'aws-cloudfront-list-distributions' AND json.rule = webACLId is not empty as Y; filter '$.X.webACL.webACLId equals $.Y.webACLId'; show Y;```
AWS S3 bucket encrypted with Customer Managed Key (CMK) is not enabled for regular rotation
```config from cloud.resource where cloud.type = 'aws' AND api.name= 'aws-s3api-get-bucket-acl' AND json.rule = (sseAlgorithm contains "aws:kms" or sseAlgorithm contains "aws:kms:dsse") and kmsMasterKeyID exists as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equals Enabled and keyMetadata.keyManager equal ignore case CUSTOMER and keyMetadata.origin equals AWS_KMS and (rotation_status.keyRotationEnabled is false or rotation_status.keyRotationEnabled equals "null")as Y; filter '$.X.kmsMasterKeyID contains $.Y.key.keyArn'; show X;```