knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
This policy identifies S3 buckets which are not configured with secure data transport policy. AWS S3 buckets should enforce encryption of data over the network using Secure Sockets Layer (SSL). It is recommended to add a bucket policy that explicitly denies (Effect: Deny) all access (Action: s3:*) from anybody who browses (Principal: *) to Amazon S3 objects within an Amazon S3 bucket if they are not accessed through HTTPS (aws:SecureTransport: false).
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-acl' AND json.rule = "(((((acl.grants[?(@.grantee=='AllUsers')] size > 0) or policyStatus.isPublic is true) and publicAccessBlockConfiguration does not exist) or ((acl.grants[?(@.grantee=='AllUsers')] size > 0) and publicAccessBlockConfiguration.ignorePublicAcls is false) or (policyStatus.isPublic is true and publicAccessBlockConfiguration.restrictPublicBuckets is false)) and websiteConfiguration does not exist) and ((policy.Statement[*].Condition.Bool.aws:SecureTransport does not exist) or ((policy.Statement[?(@.Principal=='*' || @.Principal.AWS=='*')].Action contains s3: or policy.Statement[?(@.Principal=='*' || @.Principal.AWS=='*')].Action[*] contains s3:) and (policy.Statement[?(@.Principal=='*' && @.Effect=='Allow')].Condition.Bool.aws:SecureTransport contains false or policy.Statement[?(@.Principal.AWS=='*' && @.Effect=='Allow')].Condition.Bool.aws:SecureTransport contains false or policy.Statement[?(@.Principal=='*' && @.Effect=='Allow')].Condition.Bool.aws:SecureTransport contains FALSE or policy.Statement[?(@.Principal.AWS=='*' && @.Effect=='Allow')].Condition.Bool.aws:SecureTransport contains FALSE or policy.Statement[?(@.Principal=='*' && @.Effect=='Deny')].Condition.Bool.aws:SecureTransport contains true or policy.Statement[?(@.Principal.AWS=='*' && @.Effect=='Deny')].Condition.Bool.aws:SecureTransport contains true or policy.Statement[?(@.Principal=='*' && @.Effect=='Deny')].Condition.Bool.aws:SecureTransport contains TRUE or policy.Statement[?(@.Principal.AWS=='*' && @.Effect=='Deny')].Condition.Bool.aws:SecureTransport contains TRUE)))"```
GCP Vertex AI Workbench Instance is using default service account with the editor role
```config from cloud.resource where api.name = 'gcloud-vertex-ai-workbench-instance' AND json.rule = state equals "ACTIVE" and gceSetup.serviceAccounts[*].email contains "compute@developer.gserviceaccount.com" as X; config from cloud.resource where api.name = 'gcloud-projects-get-iam-user' AND json.rule = user contains "compute@developer.gserviceaccount.com" and roles[*] contains "roles/editor" as Y; filter ' $.X.gceSetup.serviceAccounts[*].email equals $.Y.user'; show X;```
This policy identifies GCP Vertex AI Workbench Instances that are using the default service account with the Editor role.

The Compute Engine default service account is automatically created with an autogenerated name and email address when you enable the Compute Engine API. By default, this service account is granted the IAM basic Editor role unless you explicitly disable this behavior. If this service account is assigned to a Vertex AI Workbench instance, it may lead to potential privilege escalation.

In line with the principle of least privilege, it is recommended that Vertex AI Workbench Instances are not assigned the 'Compute Engine default service account', particularly when the Editor role is granted to the service account.
```config from cloud.resource where api.name = 'gcloud-vertex-ai-workbench-instance' AND json.rule = state equals "ACTIVE" and gceSetup.serviceAccounts[*].email contains "compute@developer.gserviceaccount.com" as X; config from cloud.resource where api.name = 'gcloud-projects-get-iam-user' AND json.rule = user contains "compute@developer.gserviceaccount.com" and roles[*] contains "roles/editor" as Y; filter ' $.X.gceSetup.serviceAccounts[*].email equals $.Y.user'; show X;```
Azure AKS cluster Azure CNI networking not enabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kubernetes-cluster' AND json.rule =  properties.networkProfile.networkPlugin does not contain azure```
Azure CNI provides the following features over kubenet networking:

- Every pod in the cluster is assigned an IP address in the virtual network. The pods can directly communicate with other pods in the cluster, and other nodes in the virtual network.
- Pods in a subnet that have service endpoints enabled can securely connect to Azure services, such as Azure Storage and SQL DB.
- You can create user-defined routes (UDR) to route traffic from pods to a Network Virtual Appliance.
- Support for Network Policies securing communication between pods.

This policy checks your AKS cluster for the Azure CNI network plugin and generates an alert if not found.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-kubernetes-cluster' AND json.rule =  properties.networkProfile.networkPlugin does not contain azure```
IBM Cloud Key Protect root key have aged more than 90 days without being rotated
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-key-protect-key' AND json.rule = 'extractable is false and state equals 1 and ((lastRotateDate does not exist and _DateTime.ageInDays(creationDate) > 90 ) or _DateTime.ageInDays(lastRotateDate) > 90)'```
This policy identifies IBM Cloud Key Protect root keys that have aged more than 90 days without being rotated. It is a procedure that adheres to security best practices to rotate keys on a regular basis. So that if the keys are compromised, the data in the underlying service is still secure with the new keys.
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-key-protect-key' AND json.rule = 'extractable is false and state equals 1 and ((lastRotateDate does not exist and _DateTime.ageInDays(creationDate) > 90 ) or _DateTime.ageInDays(lastRotateDate) > 90)'```
GCP Storage log buckets have object versioning disabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = '(acl[*].email exists and acl[*].email contains logging) and (versioning.enabled is false or versioning does not exist)'```
This policy identifies Storage log buckets which have object versioning disabled. Enabling object versioning on storage log buckets will protect your cloud storage data from being overwritten or accidentally deleted. It is recommended to enable object versioning feature on all storage buckets where sinks are configured.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = '(acl[*].email exists and acl[*].email contains logging) and (versioning.enabled is false or versioning does not exist)'```
AWS ElastiCache Redis with in-transit encryption disabled (Non-replication group)
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elasticache-cache-clusters' AND json.rule = engine equals redis and transitEncryptionEnabled is false and replicationGroupId does not exist```
This policy identifies ElastiCache Redis that are in non-replication groups or individual ElastiCache Redis and have in-transit encryption disabled. It is highly recommended to implement in-transit encryption in order to protect data from unauthorized access as it travels through the network, between clients and cache servers. Enabling data encryption in-transit helps prevent unauthorized users from reading sensitive data between your Redis and their associated cache storage systems.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-elasticache-cache-clusters' AND json.rule = engine equals redis and transitEncryptionEnabled is false and replicationGroupId does not exist```
bboiko test 02 - policy
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-iam-service-accounts-keys-list' AND json.rule = 'name contains iam.gserviceaccount.com and (_DateTime.ageInDays($.validAfterTime) > -1) and keyType equals USER_MANAGED'```
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-iam-service-accounts-keys-list' AND json.rule = 'name contains iam.gserviceaccount.com and (_DateTime.ageInDays($.validAfterTime) > -1) and keyType equals USER_MANAGED'```
Azure MySQL database flexible server SSL enforcement is disabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-mysql-flexible-server' AND json.rule = properties.state equal ignore case "Ready" and require_secure_transport.value equal ignore case "OFF"```
This policy identifies Azure MySQL database flexible servers for which the SSL enforcement is disabled. SSL connectivity helps to provide a new layer of security, by connecting database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between database server and client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and application.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-mysql-flexible-server' AND json.rule = properties.state equal ignore case "Ready" and require_secure_transport.value equal ignore case "OFF"```
GCP SQL instance configured with overly permissive authorized networks
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = settings.ipConfiguration.authorizedNetworks[?any(value contains 0.0.0.0/0 or value contains ::/0)] exists```
This policy identifies GCP Cloud SQL instances that are configured with overly permissive authorized networks. You can connect to the SQL instance securely by using the Cloud SQL Proxy or adding your client's public address as an authorized network. If your client application is connecting directly to a Cloud SQL instance on its public IP address, you have to add your client's external address as an Authorized network for securing the connection. It is recommended to add specific IPs instead of public IPs as authorized networks as per the requirement.

Reference: https://cloud.google.com/sql/docs/mysql/authorize-networks
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-sql-instances-list' AND json.rule = settings.ipConfiguration.authorizedNetworks[?any(value contains 0.0.0.0/0 or value contains ::/0)] exists```
test
```config from cloud.resource where api.name = 'aws-securityhub-hub' AND json.rule = SubscribedAt exists```
```config from cloud.resource where api.name = 'aws-securityhub-hub' AND json.rule = SubscribedAt exists```
GCP Storage bucket with object versioning disabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = versioning.enabled is false or versioning does not exist```
This policy identifies GCP Storage buckets that have object versioning disabled. 

Object versioning is a method of keeping multiple variants of an object in the same storage bucket. Enabling object versioning on storage log buckets will protect your cloud storage data from being overwritten or accidentally deleted.

It is recommended to enable the object versioning feature on all storage buckets.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-storage-buckets-list' AND json.rule = versioning.enabled is false or versioning does not exist```
AWS CloudTrail log validation is not enabled in all regions
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-cloudtrail-describe-trails' AND json.rule='logFileValidationEnabled is false'```
This policy identifies AWS CloudTrails in which log validation is not enabled in all regions. CloudTrail log file validation creates a digitally signed digest file containing a hash of each log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was modified after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-cloudtrail-describe-trails' AND json.rule='logFileValidationEnabled is false'```
GCP VM instance with Shielded VM features disabled
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = '(status equals RUNNING and name does not start with "gke-") and shieldedInstanceConfig exists and (shieldedInstanceConfig.enableVtpm is false or shieldedInstanceConfig.enableIntegrityMonitoring is false)'```
This policy identifies VM instances which have Shielded VM features disabled. Shielded VMs are virtual machines (VMs) on Google Cloud Platform hardened by a set of security controls that help defend against rootkits and bootkits. Shielded VM's verifiable integrity is achieved through the use of Secure Boot, virtual trusted platform module (vTPM)-enabled Measured Boot, and integrity monitoring. Shielded VM instances run firmware which is signed and verified using Google's Certificate Authority, ensuring that the instance's firmware is unmodified and establishing the root of trust for Secure Boot.

NOTE: You can only enable Shielded VM options on instances that have Shielded VM support. This policy reports VM instances that have Shielded VM support and are disabled with the Shielded VM features.
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-compute-instances-list' AND json.rule = '(status equals RUNNING and name does not start with "gke-") and shieldedInstanceConfig exists and (shieldedInstanceConfig.enableVtpm is false or shieldedInstanceConfig.enableIntegrityMonitoring is false)'```
IBM Cloud user with IAM policies provide administrative privileges for Databases for MySQL service
```config from cloud.resource where api.name = 'ibm-iam-policy' AND json.rule = type equal ignore case "access" and roles[?any( role_id contains "crn:v1:bluemix:public:iam::::role:Administrator" )] exists and resources[?any( attributes[?any( name equal ignore case "serviceName" and value equal ignore case "databases-for-mysql" and operator is member of ("stringEquals", "stringMatch"))] exists and attributes[?any( name is member of ("region","resourceGroupId","serviceInstance"))] does not exist )] exists and subjects[?any( attributes[?any( name contains "iam_id" and value contains "IBMid")] exists )] exists as X;config from cloud.resource where api.name = 'ibm-iam-user' as Y; filter '$.X.subjects[*].attributes[*].value contains $.Y.iam_id'; show Y;```
This policy identifies IBM Cloud users with administrator role permission for Databases for MySQL service. A user has full platform control as an administrator, including the ability to assign other users access policies and modify deployment passwords. If a user with administrator privilege becomes compromised, it may result in a compromised database. As a security best practice, it is advised to provide the least privilege access, such as allowing only the rights necessary to complete a task, instead of excessive permissions.
```config from cloud.resource where api.name = 'ibm-iam-policy' AND json.rule = type equal ignore case "access" and roles[?any( role_id contains "crn:v1:bluemix:public:iam::::role:Administrator" )] exists and resources[?any( attributes[?any( name equal ignore case "serviceName" and value equal ignore case "databases-for-mysql" and operator is member of ("stringEquals", "stringMatch"))] exists and attributes[?any( name is member of ("region","resourceGroupId","serviceInstance"))] does not exist )] exists and subjects[?any( attributes[?any( name contains "iam_id" and value contains "IBMid")] exists )] exists as X;config from cloud.resource where api.name = 'ibm-iam-user' as Y; filter '$.X.subjects[*].attributes[*].value contains $.Y.iam_id'; show Y;```
OCI Function Application is not configured with Network Security Groups
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-functions-applications' AND json.rule = lifecycleState equal ignore case ACTIVE and (networkSecurityGroupIds does not exist or networkSecurityGroupIds[*] is empty)```
This policy identifies Function Applications that are not configured with Network Security Groups. 

OCI Function Applications allow you to execute code in response to events without provisioning or managing infrastructure. When these function applications are not configured with NSGs, they are more vulnerable to unauthorized access and potential security breaches. NSGs help isolate and protect your functions by ensuring that only trusted sources can communicate with them.

As a best practice, it is recommended to restrict access to the application traffic by configuring network security groups.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-functions-applications' AND json.rule = lifecycleState equal ignore case ACTIVE and (networkSecurityGroupIds does not exist or networkSecurityGroupIds[*] is empty)```
OCI Default Security List of every VCN allows all traffic on SSH port (22)
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-security-list' AND json.rule = (displayName contains "Default Security List for") and (ingressSecurityRules[?any((source equals 0.0.0.0/0) and (((*.destinationPortRange.min == 22 or *.destinationPortRange.max == 22) or (*.destinationPortRange.min < 22 and *.destinationPortRange.max > 22)) or (protocol equals "all") or ((tcpOptions does not exist) and (udpOptions does not exist) and (protocol does not equal 1))))] exists)```
This policy identifies OCI Default Security lists associated with every VCN that allow unrestricted ingress access to port 22. It is recommended that no security group allows unrestricted ingress access to port 22. As a best practice, remove unfettered connectivity to remote console services, such as Secure Shell (SSH),  to reduce server's exposure to risk.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-security-list' AND json.rule = (displayName contains "Default Security List for") and (ingressSecurityRules[?any((source equals 0.0.0.0/0) and (((*.destinationPortRange.min == 22 or *.destinationPortRange.max == 22) or (*.destinationPortRange.min < 22 and *.destinationPortRange.max > 22)) or (protocol equals "all") or ((tcpOptions does not exist) and (udpOptions does not exist) and (protocol does not equal 1))))] exists)```
OCI Load balancer not configured with Network Security Groups
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-loadbalancer' AND json.rule = lifecycleState equals ACTIVE and networkSecurityGroupIds[*] does not exist```
This policy identifies Load balancers that are not configured with Network Security Groups.

Without Network Security Groups, load balancers may be exposed to unwanted traffic, increasing the risk of security breaches and unauthorized access. NSGs allow administrators to define security rules that specify the types of traffic allowed to flow in and out of the load balancer, enhancing overall network security.

As a best practice, it is recommended to restrict access to the load balancer by configuring network security groups.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-networking-loadbalancer' AND json.rule = lifecycleState equals ACTIVE and networkSecurityGroupIds[*] does not exist```
OCI File Storage File System access is not restricted to root users
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-file-storage-export' AND json.rule = exportOptions[?any( identitySquash equals ROOT and (anonymousGid does not equal 65534 or anonymousUid does not equal 65534))] exists```
This policy identifies the OCI File Storage File Systems that allow unrestricted access to root users. It is recommended that File Storage File Systems should limit root users access by restricting the privileges, to increase the security of File Systems.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-file-storage-export' AND json.rule = exportOptions[?any( identitySquash equals ROOT and (anonymousGid does not equal 65534 or anonymousUid does not equal 65534))] exists```
IBM Cloud Key Protect root key automatic key rotation is not enabled
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-key-protect-key' AND json.rule = extractable is false and state equals 1 and ((policy[*].rotation exists and policy[*].rotation.enabled is false ) or policy[*].rotation does not exist)```
This policy identifies IBM Cloud Key Protect root keys that are not enabled with automatic key rotation. As a security best practice, it is important to rotate the keys periodically. So that if the keys are compromised, the data in the underlying service is still secure with the new keys.
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-key-protect-key' AND json.rule = extractable is false and state equals 1 and ((policy[*].rotation exists and policy[*].rotation.enabled is false ) or policy[*].rotation does not exist)```
AWS Log metric filter and alarm does not exist for AWS Organization changes
```config from cloud.resource where api.name  = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name  = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name  = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "eventName=" or $.X.filterPattern contains "eventName =") and ($.X.filterPattern does not contain "eventName!=" and $.X.filterPattern does not contain "eventName !=") and ($.X.filterPattern contains "eventSource=" or $.X.filterPattern contains "eventSource =") and ($.X.filterPattern does not contain "eventSource!=" and $.X.filterPattern does not contain "eventSource !=") and $.X.filterPattern contains organizations.amazonaws.com and $.X.filterPattern contains AcceptHandshake and $.X.filterPattern contains AttachPolicy and $.X.filterPattern contains CreateAccount and $.X.filterPattern contains CreateOrganizationalUnit and $.X.filterPattern contains CreatePolicy and $.X.filterPattern contains DeclineHandshake and $.X.filterPattern contains DeleteOrganization and $.X.filterPattern contains DeleteOrganizationalUnit and $.X.filterPattern contains DeletePolicy and $.X.filterPattern contains DetachPolicy and $.X.filterPattern contains DisablePolicyType and $.X.filterPattern contains EnablePolicyType and $.X.filterPattern contains InviteAccountToOrganization and $.X.filterPattern contains LeaveOrganization and $.X.filterPattern contains MoveAccount and $.X.filterPattern contains RemoveAccountFromOrganization and $.X.filterPattern contains UpdatePolicy and $.X.filterPattern contains UpdateOrganizationalUnit) and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```