knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
This policy identifies the Azure Application Gateway WAF policies that are not enabled in prevention mode.

Azure Application Gateway WAF policies support Prevention and Detection modes. Detection mode monitors and logs all threat alerts to a log file. Detection mode is useful for testing purposes and configures WAF initially but it does not provide protection. It logs the traffic, but it doesn't take any actions such as allow or deny. Where as, in Prevention mode, WAF analyzes incoming traffic to the application gateway and blocks any requests that are determined to be malicious based on a set of rules.

As a best security practice, it is recommended to enable Application Gateway WAF policies with Prevention mode to prevent malicious requests from reaching your application and potentially causing damage.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-application-gateway-waf-policy' AND json.rule = properties.applicationGateways[*].id size greater than 0 and properties.policySettings.state equal ignore case Enabled and properties.policySettings.mode does not equal ignore case Prevention```
Azure SQL server Defender setting is set to Off
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule =  "$.serverSecurityAlertPolicy.properties.retentionDays does not exist or $.serverSecurityAlertPolicy.properties.state equals Disabled"```
This policy identifies Azure SQL server which have Defender setting set to Off. Azure Defender for SQL provides a new layer of security, which enables customers to detect and respond to potential threats as they occur by providing security alerts on anomalous activities. Users will receive an alert upon suspicious database activities, potential vulnerabilities, SQL injection attacks, as well as anomalous database access patterns. Advanced threat protection alerts provide details of suspicious activity and recommend action on how to investigate and mitigate the threat.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule =  "$.serverSecurityAlertPolicy.properties.retentionDays does not exist or $.serverSecurityAlertPolicy.properties.state equals Disabled"```
Copy of GCP API key is created for a project1
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-api-key' as X; count(X) greater than 0```
This policy identifies GCP projects where API keys are created. Keys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides. To avoid the security risk in using API keys, it is recommended to use standard authentication flow instead.

Note: There are limited cases where API keys are more appropriate. For example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API. If a business requires API keys to be used, then the API keys should be secured using appropriate IAM policies.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-api-key' as X; count(X) greater than 0```
AWS EMR shadow resource
```config from cloud.resource where api.name = 'aws-emr-studio' AND json.rule = DefaultS3Location exists and DefaultS3Location contains "aws-emr-studio-" as X; config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' AND json.rule = bucketName contains "aws-emr-studio-" as Y; filter 'not ($.X.BucketName equals $.Y.bucketName)' ; show X;```
sdvdsv
```config from cloud.resource where api.name = 'aws-emr-studio' AND json.rule = DefaultS3Location exists and DefaultS3Location contains "aws-emr-studio-" as X; config from cloud.resource where api.name = 'aws-s3api-get-bucket-acl' AND json.rule = bucketName contains "aws-emr-studio-" as Y; filter 'not ($.X.BucketName equals $.Y.bucketName)' ; show X;```
Azure Network Security Group having Inbound rule overly permissive to all traffic on any protocol
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any((sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and protocol equals * and access equals Allow and destinationPortRange contains * and direction equals Inbound)] exists```
This policy identifies Azure Network Security Groups (NSGs) which are overly permissive to all traffic on any protocol. A network security group contains a list of security rules that allow or deny inbound or outbound network traffic based on source or destination IP address, port, and protocol. As a best practice, it is recommended to configure NSGs to restrict traffic from known sources, allowing only authorized protocols and ports.
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any((sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and protocol equals * and access equals Allow and destinationPortRange contains * and direction equals Inbound)] exists```
IBM Cloud Virtual Private Cloud (VPC) Subnet has public gateways attached
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-network-subnet' and json.rule = public_gateway exists```
This policy identifies IBM Virtual Private Cloud Subnet where public gateway attached. A Public Gateway enables resources to connect to the internet. After public gateway is attached, all resources in that subnet can connect to the internet. If the use case for public gateway is not external connectivity, it is recommended not to attach any public gateways.
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-network-subnet' and json.rule = public_gateway exists```
AWS ElastiCache Redis cluster with Redis AUTH feature disabled
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elasticache-describe-replication-groups' AND json.rule = 'authTokenEnabled is false or transitEncryptionEnabled is false or authTokenEnabled does not exist or transitEncryptionEnabled does not exist'```
This policy identifies ElastiCache Redis clusters which have Redis AUTH feature disabled. Redis AUTH can improve data security by requiring the user to enter a password before they are granted permission to execute Redis commands on a password protected Redis server.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elasticache-describe-replication-groups' AND json.rule = 'authTokenEnabled is false or transitEncryptionEnabled is false or authTokenEnabled does not exist or transitEncryptionEnabled does not exist'```
test-3
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-key-vault-list' AND json.rule = properties.provisioningState equals Succeeded and diagnosticSettings.value[*].properties.workspaceId does not equal ignore case "/subscriptions/8dff688e-d9b0-477c-b2b0-b0e729fb06bd/resourceGroups/rg-analytics-sh-prd-scus/providers/Microsoft.OperationalInsights/workspaces/log-sh-workspace"```
AWS IAM Roles with Administrator Access Permissions
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-roles' as X; config from cloud.resource where api.name = 'aws-iam-get-policy-version' as Y; filter "($.X.inlinePolicies[*].policyDocument.Statement[?(@.Effect=='Allow' && @.Resource=='*')].Action any equal *) or ($.X.attachedPolicies[*].policyArn contains $.Y.policyArn and $.Y.document.Statement[?(@.Effect=='Allow' && @.Resource=='*')].Action any equal *)"; show X;```
This policy identifies AWS IAM roles which has administrator access permission set. This would allow all users who assume this role to have administrative privileges. As a security best practice, it is recommended to grant least privilege access like granting only the permissions required to perform a task, instead of providing excessive permissions.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-roles' as X; config from cloud.resource where api.name = 'aws-iam-get-policy-version' as Y; filter "($.X.inlinePolicies[*].policyDocument.Statement[?(@.Effect=='Allow' && @.Resource=='*')].Action any equal *) or ($.X.attachedPolicies[*].policyArn contains $.Y.policyArn and $.Y.document.Statement[?(@.Effect=='Allow' && @.Resource=='*')].Action any equal *)"; show X;```
Hostfindings test
```config from cloud.resource where finding.type IN ( 'Host Vulnerability', 'Serverless Vulnerability' , 'Compliance' , 'AWS Inspector Runtime Behavior Analysis' , 'AWS Inspector Security Best Practices' , 'AWS GuardDuty Host' , 'AWS GuardDuty IAM' ) ```
```config from cloud.resource where finding.type IN ( 'Host Vulnerability', 'Serverless Vulnerability' , 'Compliance' , 'AWS Inspector Runtime Behavior Analysis' , 'AWS Inspector Security Best Practices' , 'AWS GuardDuty Host' , 'AWS GuardDuty IAM' ) ```
AWS MQ Broker is not encrypted by Customer Managed Key (CMK)
```config from cloud.resource where api.name = 'aws-mq-broker' AND json.rule = brokerState equal ignore case RUNNING as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equal ignore case Enabled and keyMetadata.keyManager does not equal ignore case CUSTOMER as Y; filter '$.X.encryptionOptions.kmsKeyId equals $.Y.keyMetadata.arn or $.X.encryptionOptions.useAwsOwnedKey is true'; show X;```
This policy identifies AWS MQ Brokers that are not encrypted by Customer Managed Key (CMK).

AWS MQ Broker messages might contain sensitive information. AWS MQ Broker messages are encrypted by default by an AWS managed key but users can specify CMK to get enhanced security, control over the encryption key, and also comply with any regulatory requirements.

As a security best practice use of CMK to encrypt your MQ Broker is advisable as it gives you full control over the encrypted data.
```config from cloud.resource where api.name = 'aws-mq-broker' AND json.rule = brokerState equal ignore case RUNNING as X; config from cloud.resource where api.name = 'aws-kms-get-key-rotation-status' AND json.rule = keyMetadata.keyState equal ignore case Enabled and keyMetadata.keyManager does not equal ignore case CUSTOMER as Y; filter '$.X.encryptionOptions.kmsKeyId equals $.Y.keyMetadata.arn or $.X.encryptionOptions.useAwsOwnedKey is true'; show X;```
OCI Object Storage Bucket write level logging is disabled
```config from cloud.resource where api.name = 'oci-object-storage-bucket' as X; config from cloud.resource where api.name = 'oci-logging-logs' as Y; filter 'not ($.X.name contains $.Y.configuration.source.resource and $.Y.configuration.source.service contains objectstorage and $.Y.configuration.source.category contains write and $.Y.lifecycleState equal ignore case ACTIVE )'; show X;```
This policy identifies Object Storage buckets that have write-level logging disabled.

Enabling write-level logging for Object Storage provides more visibility into changes to objects in your buckets. Without write-level logging, there is no record of changes made to the bucket. This lack of visibility can lead to undetected data breaches, unauthorized changes, and compliance violations.

As a best practice, it is recommended to enable write-level logging on Object Storage buckets.
```config from cloud.resource where api.name = 'oci-object-storage-bucket' as X; config from cloud.resource where api.name = 'oci-logging-logs' as Y; filter 'not ($.X.name contains $.Y.configuration.source.resource and $.Y.configuration.source.service contains objectstorage and $.Y.configuration.source.category contains write and $.Y.lifecycleState equal ignore case ACTIVE )'; show X;```
Azure Active Directory MFA is not enabled for user
```config from cloud.resource where api.name = 'azure-active-directory-user-registration-details' AND json.rule = isMfaRegistered is false as X; config from cloud.resource where api.name = 'azure-active-directory-user' AND json.rule = accountEnabled is true as Y; filter '$.X.userDisplayName equals $.Y.displayName'; show X;```
This policy identifies Azure users for whom AD MFA (Active Directory Multi-Factor Authentication) is not enabled. 

Azure AD is a simple best practice that adds an extra layer of protection on top of your user name and password. MFA provides increased security for your Azure account settings and resources. Enabling Azure AD Multi-Factor Authentication using Conditional Access policies is the recommended approach to protect users.

As best practice, it is recommended to enable Azure AD Multi-Factor Authentication for users.
```config from cloud.resource where api.name = 'azure-active-directory-user-registration-details' AND json.rule = isMfaRegistered is false as X; config from cloud.resource where api.name = 'azure-active-directory-user' AND json.rule = accountEnabled is true as Y; filter '$.X.userDisplayName equals $.Y.displayName'; show X;```
Azure App Service Web app client certificate is disabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'kind starts with app and properties.clientCertEnabled equals false'```
This policy identifies Azure web apps which are not set with client certificate. Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'kind starts with app and properties.clientCertEnabled equals false'```
Bobby Copy of Azure Service bus namespace not configured with Azure Active Directory (Azure AD) authentication
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-service-bus-namespace' AND json.rule = properties.status equals "Active" and (properties.disableLocalAuth does not exist or properties.disableLocalAuth is false)```
GCP Storage Bucket encryption not configured with Customer-Managed Encryption Key (CMEK)
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = encryption.defaultKmsKeyName does not exist```
This policy identifies GCP Storage Buckets that are not configured with a Customer-Managed Encryption key.

GCP Storage Buckets might contain sensitive information. Google Cloud Storage service encrypts all data within the buckets using Google-managed encryption keys by default but users can specify Customer-Managed Keys (CMKs) to get enhanced security, control over the encryption key, and also comply with any regulatory requirements.

As a security best practice, the use of CMK to encrypt your Storage bucket is advisable as it gives you full control over the encrypted data.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = encryption.defaultKmsKeyName does not exist```
Azure Microsoft Defender for Cloud Defender plans is set to Off
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any(properties.pricingTier does not equal Standard and (properties.deprecated does not exist or properties.deprecated is false))] exists```
This policy identifies Azure Microsoft Defender for Cloud which has a Defender setting set to Off. Enabling Azure Defender provides advanced security capabilities like providing threat intelligence, anomaly detection, and behavior analytics in the Azure Microsoft Defender for Cloud. It is highly recommended to enable Azure Defender for all Azure services.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any(properties.pricingTier does not equal Standard and (properties.deprecated does not exist or properties.deprecated is false))] exists```
Azure Microsoft Defender for Cloud is set to Off for Servers
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any( name equals VirtualMachines and properties.pricingTier does not equal Standard)] exists```
This policy identifies Azure Microsoft Defender for Cloud (previously known as Azure Security Center and Azure Defender) which has defender setting for Servers is set to Off. Enabling Microsoft Defender for Cloud provides the tools needed to harden your resources, track your security posture, protect against cyberattacks, and streamline security management. It is highly recommended to enable Microsoft Defender for Servers.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any( name equals VirtualMachines and properties.pricingTier does not equal Standard)] exists```
OCI security lists allows unrestricted ingress access to port 3389
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-security-list' AND json.rule = (ingressSecurityRules[?any((source equals 0.0.0.0/0) and (((*.destinationPortRange.min == 3389 or *.destinationPortRange.max == 3389) or (*.destinationPortRange.min < 3389 and *.destinationPortRange.max > 3389)) or (protocol equals "all") or ((tcpOptions does not exist) and (udpOptions does not exist) and (protocol does not equal 1))))] exists)```
This policy identifies OCI Security lists that allow unrestricted ingress access to port 3389. It is recommended that no security list allows unrestricted ingress access to port 3389. As a best practice, remove unfettered connectivity to remote console services, such as Remote Desktop Protocol (RDP), to reduce server's exposure to risk.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-security-list' AND json.rule = (ingressSecurityRules[?any((source equals 0.0.0.0/0) and (((*.destinationPortRange.min == 3389 or *.destinationPortRange.max == 3389) or (*.destinationPortRange.min < 3389 and *.destinationPortRange.max > 3389)) or (protocol equals "all") or ((tcpOptions does not exist) and (udpOptions does not exist) and (protocol does not equal 1))))] exists)```
AWS IAM has expired SSL/TLS certificates
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-server-certificates' AND json.rule = '(_DateTime.ageInDays($.expiration) > -1)'```
This policy identifies expired SSL/TLS certificates. To enable HTTPS connections to your website or application in AWS, you need an SSL/TLS server certificate. You can use ACM or IAM to store and deploy server certificates. Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can damage the credibility of the application/website behind the ELB. This policy generates alerts if there are any expired SSL/TLS certificates stored in AWS IAM. As a best practice, it is recommended to delete expired certificates.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-iam-list-server-certificates' AND json.rule = '(_DateTime.ageInDays($.expiration) > -1)'```
AWS SageMaker notebook instance configured with direct internet access feature
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-sagemaker-notebook-instance' AND json.rule = 'notebookInstanceStatus equals InService and directInternetAccess equals Enabled'```
This policy identifies SageMaker notebook instances that are configured with direct internet access feature. If AWS SageMaker notebook instances are configured with direct internet access feature, any machine outside the VPC can establish a connection to these instances, which provides an additional avenue for unauthorized access to data and the opportunity for malicious activity.

For more details:
https://docs.aws.amazon.com/sagemaker/latest/dg/appendix-notebook-and-internet-access.html
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-sagemaker-notebook-instance' AND json.rule = 'notebookInstanceStatus equals InService and directInternetAccess equals Enabled'```
Azure MySQL Database Server SSL connection is disabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-mysql-server' AND json.rule = 'properties.sslEnforcement does not equal Enabled'```
This policy identifies Azure MYSQL database server for which the SSL connection is disabled. SSL connectivity helps to provide a new layer of security, by connecting database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between database server and client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and application.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-mysql-server' AND json.rule = 'properties.sslEnforcement does not equal Enabled'```
AWS IAM password policy does not have password expiration period
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or maxPasswordAge !isType Integer or maxPasswordAge < 1 or maxPasswordAge does not exist'```
Checks to ensure that IAM password policy has an expiration period. AWS IAM (Identity & Access Management) allows customers to secure AWS console access. As a security best practice, customers must have strong password policies in place.
```config from cloud.resource where cloud.type = 'aws' AND api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or maxPasswordAge !isType Integer or maxPasswordAge < 1 or maxPasswordAge does not exist'```
GCP Spanner Database drop protection disabled
```config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcloud-cloud-spanner-database' AND json.rule = state equal ignore case ready AND enableDropProtection does not exist```
This policy identifies GCP Spanner Databases with drop protection disabled.

Google Cloud Spanner is a scalable, globally distributed, and strongly consistent database service. The Spanner database drop protection feature prevents accidental deletion of databases and configurations. Without drop protection enabled, a user error or malicious action could lead to irreversible data loss and service disruption for all applications relying on that Spanner instance.

It is recommended to enable drop protection on spanner database to prevent from accidental deletion.
```config from cloud.resource where cloud.type = 'gcp' and api.name = 'gcloud-cloud-spanner-database' AND json.rule = state equal ignore case ready AND enableDropProtection does not exist```
GCP VM Instances without any Custom metadata information
```config from cloud.resource where api.name= 'gcloud-compute-instances-list' and json.rule = ['metadata'].items does not exist and (status equals RUNNING and name does not start with "gke-")```
VM instance does not have any Custom metadata. Custom metadata can be used for easy identification and searches.
```config from cloud.resource where api.name= 'gcloud-compute-instances-list' and json.rule = ['metadata'].items does not exist and (status equals RUNNING and name does not start with "gke-")```