knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
This policy identifies GCP Vertex AI Workbench user-managed notebooks that are using the default service account with the editor role.

When you create a new Vertex AI Workbench user-managed notebook, the compute engine default service account is associated with the notebook by default if any other service account is not configured. The compute engine default service account is automatically created when the Compute Engine API is enabled and is granted the IAM basic Editor role if you have not disabled this behavior explicitly. These permissions can be exploited to get admin access to the GCP project.

To be compliant with the principle of least privileges and prevent potential privilege escalation, it is recommended that Vertex AI Workbench user-managed notebooks are not assigned the 'Compute Engine default service account' especially when the editor role is granted to the service account.
```config from cloud.resource where api.name = 'gcloud-vertex-ai-notebook-instance' AND json.rule = state equals "ACTIVE" and serviceAccount contains "compute@developer.gserviceaccount.com" as X; config from cloud.resource where api.name = 'gcloud-projects-get-iam-user' AND json.rule = user contains "compute@developer.gserviceaccount.com" and roles[*] contains "roles/editor" as Y; filter ' $.X.serviceAccount equals $.Y.user'; show X;```
Azure Network Watcher is not enabled
```config from cloud.resource where cloud.type = 'azure' AND cloud.service = 'Azure Network Watcher' AND api.name = 'azure-network-watcher-list' AND json.rule = ' provisioningState !exists  or provisioningState != Succeeded'```
```config from cloud.resource where cloud.type = 'azure' AND cloud.service = 'Azure Network Watcher' AND api.name = 'azure-network-watcher-list' AND json.rule = ' provisioningState !exists  or provisioningState != Succeeded'```
dnd-azure-disk-flip-flop-policy
```config from cloud.resource where cloud.type = 'azure' AND cloud.account = 'Azure_Redlock_QA_BVT_25FE' AND api.name = 'azure-disk-list' AND json.rule = id exists ```
```config from cloud.resource where cloud.type = 'azure' AND cloud.account = 'Azure_Redlock_QA_BVT_25FE' AND api.name = 'azure-disk-list' AND json.rule = id exists ```
OCI Load Balancer not configured with inbound rules or listeners
```config from cloud.resource where api.name = 'oci-networking-loadbalancer' and json.rule = lifecycleState equal ignore case "ACTIVE" as X; config from cloud.resource where api.name = 'oci-networking-subnet' and json.rule = lifecycleState equal ignore case "AVAILABLE" as Y; config from cloud.resource where api.name = 'oci-networking-security-list' AND json.rule = lifecycleState equal ignore case AVAILABLE as Z; filter 'not ($.X.listeners does not equal "{}" and ($.X.subnetIds contains $.Y.id and $.Y.securityListIds contains $.Z.id and $.Z.ingressSecurityRules is not empty))'; show X;```
This policy identifies Load Balancers that are not configured with inbound rules or listeners.

A Load Balancer's subnet security lists should include ingress rules, and the Load Balancer should have at least one listener to handle incoming traffic. Without these configurations, the load balancer cannot receive and route incoming traffic, rendering it ineffective. 

As best practice, it is recommended to configure Load Balancers with proper inbound rules and listeners.
```config from cloud.resource where api.name = 'oci-networking-loadbalancer' and json.rule = lifecycleState equal ignore case "ACTIVE" as X; config from cloud.resource where api.name = 'oci-networking-subnet' and json.rule = lifecycleState equal ignore case "AVAILABLE" as Y; config from cloud.resource where api.name = 'oci-networking-security-list' AND json.rule = lifecycleState equal ignore case AVAILABLE as Z; filter 'not ($.X.listeners does not equal "{}" and ($.X.subnetIds contains $.Y.id and $.Y.securityListIds contains $.Z.id and $.Z.ingressSecurityRules is not empty))'; show X;```
IBM Cloud MySQL Database network access is not restricted to a specific IP range
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-mysql-deployment-info' AND json.rule = allowedListIPAddresses[*] size equals 0 or allowedListIPAddresses[?any( address equals 0.0.0.0/0 )] exists```
This policy identifies IBM Cloud MySQL Databases with no specified IP range for network access. To restrict access to your databases, you can allowlist specific IP addresses or ranges of IP addresses on your deployment. When no IP addresses are in the allowlist, the allowlist is disabled and the deployment accepts connections from any IP address. It is recommended to create an allowlist, only IP addresses that match the allowlist or are in the range of IP addresses in the allowlist can connect to your deployment

```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-mysql-deployment-info' AND json.rule = allowedListIPAddresses[*] size equals 0 or allowedListIPAddresses[?any( address equals 0.0.0.0/0 )] exists```
AWS EC2 Auto Scaling Launch Configuration is not using encrypted EBS volumes
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-autoscaling-launch-configuration' AND json.rule = blockDeviceMappings[*].ebs exists AND blockDeviceMappings[?any(ebs.encrypted is false)] exists```
This policy identifies AWS EC2 Auto Scaling Launch Configurations that are not using encrypted EBS volumes.

A launch configuration defines an instance configuration template that an Auto Scaling group uses to launch EC2 instances. Amazon Elastic Block Store (EBS) volumes allow you to create encrypted launch configurations when creating EC2 instances and auto scaling groups. When the entire EBS volume is encrypted, data stored at rest, in-transit, and snapshots are encrypted. This protects the data from unauthorized access.

As a security best practice for data protection, enable encryption for all EBS volumes at auto scaling launch configuration.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-ec2-autoscaling-launch-configuration' AND json.rule = blockDeviceMappings[*].ebs exists AND blockDeviceMappings[?any(ebs.encrypted is false)] exists```
AWS Secret Manager Automatic Key Rotation is not enabled
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-secretsmanager-describe-secret' AND json.rule = rotationEnabled is false and owningService is not member of (appflow, databrew, datasync, directconnect, events, opsworks-cm, rds, sqlworkbench)```
This policy identifies AWS Secret Manager that are not enabled with key rotation. As a security best practice, it is important to rotate the keys periodically so that if the keys are compromised, the data in the underlying service is still secure with the new keys.

NOTE: This policy does not include secret manager which are managed by some of the AWS services that store AWS Secrets Manager secrets on your behalf. Refer: https://docs.aws.amazon.com/secretsmanager/latest/userguide/service-linked-secrets.html
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-secretsmanager-describe-secret' AND json.rule = rotationEnabled is false and owningService is not member of (appflow, databrew, datasync, directconnect, events, opsworks-cm, rds, sqlworkbench)```
Azure Microsoft Defender for Cloud set to Off for Agentless container vulnerability assessment
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = not (pricings[?any(properties.extensions[?any(name equal ignore case ContainerRegistriesVulnerabilityAssessments AND isEnabled is true)] exists AND properties.pricingTier equal ignore case Standard )] exists)```
This policy identifies Azure Microsoft Defender for Cloud where the Agentless container vulnerability assessment is set to Off.

Agentless container vulnerability assessment enables automatic scanning for vulnerabilities in container images stored in Azure Container Registry or running in Azure Kubernetes Service without additional agents. Disabling it exposes container images to unpatched security issues and misconfigurations, risking exploitation and data breaches. Enabling agentless container vulnerability assessment ensures continuous scanning for known vulnerabilities, enhancing security by proactively identifying risks and providing remediation suggestions to maintain compliance with industry standards.

As a security best practice, it is recommended to enable Agentless container vulnerability assessment in Azure Microsoft Defender for Cloud.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = not (pricings[?any(properties.extensions[?any(name equal ignore case ContainerRegistriesVulnerabilityAssessments AND isEnabled is true)] exists AND properties.pricingTier equal ignore case Standard )] exists)```
pcsup-26179-policy
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-active-directory-admin-consent-request-policy' AND json.rule = ['@odata.context'] exists```
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-active-directory-admin-consent-request-policy' AND json.rule = ['@odata.context'] exists```
AWS MSK clusters not configured with enhanced monitoring
```config from cloud.resource where api.name = 'aws-msk-cluster' AND json.rule = state equal ignore case active and enhancedMonitoring is member of (DEFAULT, PER_BROKER)```
This policy identifies MSK clusters that are not configured with enhanced monitoring.

Amazon MSK is a fully managed Apache Kafka service on AWS that handles the provisioning, setup, and maintenance of Kafka clusters. Amazon MSK's PER_TOPIC_PER_BROKER monitoring level provides granular insights into the audit, performance and resource utilization of individual topics and brokers, enabling you to identify and optimize bottlenecks in your Kafka cluster.

It is recommended to enable at least PER_TOPIC_PER_BROKER monitoring on the MSK cluster to get enhanced monitoring capabilities.
```config from cloud.resource where api.name = 'aws-msk-cluster' AND json.rule = state equal ignore case active and enhancedMonitoring is member of (DEFAULT, PER_BROKER)```
Azure Custom subscription administrator roles found
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-definition' AND json.rule = properties.permissions[*].actions any start with "*" and properties.permissions[*].actions any end with "*" and properties.type equal ignore case "CustomRole" and properties.assignableScopes starts with "/subscriptions" and properties.assignableScopes does not contain "resourceGroups"```
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-role-definition' AND json.rule = properties.permissions[*].actions any start with "*" and properties.permissions[*].actions any end with "*" and properties.type equal ignore case "CustomRole" and properties.assignableScopes starts with "/subscriptions" and properties.assignableScopes does not contain "resourceGroups"```
GCP GKE unsupported node version
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = isNodeVersionSupported exists AND isNodeVersionSupported does not equal "true"```
This policy identifies the GKE node version and generates an alert if the version running is unsupported.

Using an unsupported version of Google Kubernetes Engine (GKE) on Google Cloud Platform (GCP) can lead to several potential issues and risks, such as security vulnerabilities, compatibility issues, performance and stability problems, and compliance concerns. To mitigate these risks, it's crucial to regularly update the GKE clusters to supported versions recommended by Google Cloud.

As a security best practice, it is always recommended to use the latest version of GKE.

Note: The Policy updates will be made as per the release schedule https://cloud.google.com/kubernetes-engine/docs/release-schedule#schedule-for-release-channels
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = isNodeVersionSupported exists AND isNodeVersionSupported does not equal "true"```
AWS Web Application Firewall (AWS WAF) Classic logging is disabled
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-waf-classic-web-acl-resource' AND json.rule = '(resources.applicationLoadBalancer[*] exists or resources.apiGateway[*] exists or resources.other[*] exists) and loggingConfiguration.resourceArn does not exist'```
This policy identifies Classic Web Application Firewalls (AWS WAFs) for which logging is disabled. Enabling WAF logging, logs all web requests inspected by the service which can be used for debugging and additional forensics. The logs will help to understand why certain rules are triggered and why certain web requests are blocked. You can also integrate the logs with any SIEM and log analysis tools for further analysis. It is recommended to enable logging on your Classic Web Application Firewalls (WAFs).

For details:
https://docs.aws.amazon.com/waf/latest/developerguide/classic-logging.html

NOTE: Global (CloudFront) WAF resources are out of scope for this policy.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-waf-classic-web-acl-resource' AND json.rule = '(resources.applicationLoadBalancer[*] exists or resources.apiGateway[*] exists or resources.other[*] exists) and loggingConfiguration.resourceArn does not exist'```
GCP Kubernetes Engine Clusters have Network policy disabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = networkConfig.datapathProvider does not equal ADVANCED_DATAPATH and (addonsConfig.networkPolicyConfig.disabled is true or networkPolicy.enabled does not exist or networkPolicy.enabled is false )```
This policy identifies Kubernetes Engine Clusters which have disabled Network policy. A network policy defines how groups of pods are allowed to communicate with each other and other network endpoints. By enabling network policy in a namespace for a pod, it will reject any connections that are not allowed by the network policy.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-container-describe-clusters' AND json.rule = networkConfig.datapathProvider does not equal ADVANCED_DATAPATH and (addonsConfig.networkPolicyConfig.disabled is true or networkPolicy.enabled does not exist or networkPolicy.enabled is false )```
Azure Storage Account without Secure transfer enabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = (properties.supportsHttpsTrafficOnly does not exist or properties.supportsHttpsTrafficOnly is false) as X; config from cloud.resource where api.name = 'azure-storage-file-shares' as Y; filter '($.X.kind does not equal ignore case "FileStorage") or ($.X.kind equal ignore case "FileStorage" and $.Y.id contains $.X.name and $.Y.properties.enabledProtocols does not contain NFS)'; show X;```
This policy identifies Storage accounts which have Secure transfer feature disabled. The secure transfer option enhances the security of your storage account by only allowing requests to the storage account by a secure connection.

When "secure transfer required" is disabled,REST APIs to access your storage accounts may connect over insecure HTTP which is not advised. Hence, it is highly recommended to enable secure transfer feature on your storage account.

NOTE: Azure storage doesn't support HTTPs for custom domain names, this option is not applied when using a custom domain name. Additionally, this property is not applicable for NFS Azure file shares to work.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-storage-account-list' AND json.rule = (properties.supportsHttpsTrafficOnly does not exist or properties.supportsHttpsTrafficOnly is false) as X; config from cloud.resource where api.name = 'azure-storage-file-shares' as Y; filter '($.X.kind does not equal ignore case "FileStorage") or ($.X.kind equal ignore case "FileStorage" and $.Y.id contains $.X.name and $.Y.properties.enabledProtocols does not contain NFS)'; show X;```
pcsup-gcp-policy
```config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND resource.status = Active AND json.rule = tags[*].key none equal "application" AND tags[*].key none equal "Application"```
```config from cloud.resource where api.name = 'gcloud-compute-instances-list' AND resource.status = Active AND json.rule = tags[*].key none equal "application" AND tags[*].key none equal "Application"```
jashah_ms_join_pol
```config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' AND json.rule = _AWSCloudAccount.orgHierarchyNames() intersects ("all-accounts") as X; config from cloud.resource where api.name = 'aws-ec2-describe-subnets' AND json.rule = _AWSCloudAccount.orgHierarchyNames() intersects ("all-accounts") as Y; filter '$.X.vpcId equals $.Y.vpcId'; show Y;```
```config from cloud.resource where api.name = 'aws-ec2-describe-vpcs' AND json.rule = _AWSCloudAccount.orgHierarchyNames() intersects ("all-accounts") as X; config from cloud.resource where api.name = 'aws-ec2-describe-subnets' AND json.rule = _AWSCloudAccount.orgHierarchyNames() intersects ("all-accounts") as Y; filter '$.X.vpcId equals $.Y.vpcId'; show Y;```
Alibaba Cloud RAM password retry constraint policy is disabled
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ram-password-policy' AND json.rule =  'maxLoginAttemps !isType Integer or maxLoginAttemps == 0'```
This policy identifies Alibaba Cloud accounts for which password retry constraint policy is disabled. As a best practice, enable RAM password retry constraint policy to prevent multiple login attempts with an incorrect password within an hour.
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ram-password-policy' AND json.rule =  'maxLoginAttemps !isType Integer or maxLoginAttemps == 0'```
IBM Cloud Application Load Balancer for VPC has public access enabled
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-loadbalancer' AND json.rule = profile.family equal ignore case "application" and operating_status equal ignore case "online" and is_public is true```
This policy identifies IBM Cloud Application Load Balancer for VPC which has public access enabled. Creating a load balancer with public access will lead to unexpected malicious requests getting sent to the public DNS address assigned. A private load balancer is only accessible from within a specific virtual private cloud (VPC). It is highly recommended to use load balancers of type private to protect from unauthorized access.
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-loadbalancer' AND json.rule = profile.family equal ignore case "application" and operating_status equal ignore case "online" and is_public is true```
Azure Function App with public access linked to Blob Storage
```config from cloud.resource where api.name = 'azure-storage-account-list' as X; config from cloud.resource where api.name = 'azure-app-service-web-apps-configurations' as Y; config from cloud.resource where api.name = 'azure-app-service' AND json.rule = 'kind contains functionapp and kind does not contain workflowapp and kind does not equal app and properties.state equal ignore case running and ((properties.publicNetworkAccess exists and properties.publicNetworkAccess equal ignore case Enabled) or (properties.publicNetworkAccess does not exist)) and config.ipSecurityRestrictions[?any((action equals Allow and ipAddress equals Any) or (action equals Allow and ipAddress equals 0.0.0.0/0))] exists' as Z; filter ' $.Y.properties.azureStorageAccounts contains $.X.name and $.Z.name equal ignore case $.Y.name' ; show Z;```
This policy identifies Azure Function Apps configured with public access and linked to Azure Blob Storage.

Azure Function Apps often access Blob Storage to retrieve or store data. When public access is enabled for the Function App, it exposes the application and, potentially, the associated Blob Storage to unauthorized access, leading to potential security risks.

As a security best practice, it is recommended to evaluate public access for Azure Function Apps and secure Azure Blob Storage.
```config from cloud.resource where api.name = 'azure-storage-account-list' as X; config from cloud.resource where api.name = 'azure-app-service-web-apps-configurations' as Y; config from cloud.resource where api.name = 'azure-app-service' AND json.rule = 'kind contains functionapp and kind does not contain workflowapp and kind does not equal app and properties.state equal ignore case running and ((properties.publicNetworkAccess exists and properties.publicNetworkAccess equal ignore case Enabled) or (properties.publicNetworkAccess does not exist)) and config.ipSecurityRestrictions[?any((action equals Allow and ipAddress equals Any) or (action equals Allow and ipAddress equals 0.0.0.0/0))] exists' as Z; filter ' $.Y.properties.azureStorageAccounts contains $.X.name and $.Z.name equal ignore case $.Y.name' ; show Z;```
Azure Logic app does not redirect HTTP requests to HTTPS
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case Running and kind contains workflowapp and properties.httpsOnly is false```
This policy identifies Azure Logic apps that fail to redirect HTTP traffic to HTTPS.

By default, Azure Logic app data is accessible through unsecured HTTP traffic. HTTP does not include any encryption and data sent over HTTP is susceptible to interception and eavesdropping. To secure web traffic, use HTTPS which incorporates encryption through SSL/TLS protocols, providing a secure channel over which data can be transmitted safely.

As a security best practice,  it is recommended to configure HTTP to HTTPS redirection to prevent unauthorized parties from being able to read or modify the data in transit.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case Running and kind contains workflowapp and properties.httpsOnly is false```
GCP Project audit logging is not configured properly across all services and all users in a project
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-iam-get-audit-config' AND json.rule = 'auditConfigs[*].service does not contain allServices or (auditConfigs[*].auditLogConfigs[*].exemptedMembers exists and auditConfigs[*].auditLogConfigs[*].exemptedMembers is not empty)'```
This policy identifies the GCP projects in which cloud audit logging is not configured properly across all services and all users. It is recommended that cloud audit logging is configured to track all Admin activities and read, write access to user data. Logs should be captured for all users and there should be no exempted users in any of the audit config section.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-iam-get-audit-config' AND json.rule = 'auditConfigs[*].service does not contain allServices or (auditConfigs[*].auditLogConfigs[*].exemptedMembers exists and auditConfigs[*].auditLogConfigs[*].exemptedMembers is not empty)'```
IBM Cloud Key Protect Key dual authorization for deletion is not enabled
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-key-protect-key' AND json.rule = dualAuthDelete does not exist or dualAuthDelete.enabled is false```
This policy identifies IBM Cloud Key Protect Key that has dual authorization for deletion is disabled. Dual authorization for Key Protect service instances is an extra policy that helps to prevent accidental or malicious deletion of keys in your Key Protect instance. It is recommended that dual authorization for deletion of all keys in a Key Protect instance is enabled.
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-key-protect-key' AND json.rule = dualAuthDelete does not exist or dualAuthDelete.enabled is false```