knarayan/cloud_posture_checks_name_and_desc huggingface dataset:
Azure VM OS disk is not configured with any encryption
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-disk-list' and json.rule = osType exists and managedBy exists and (encryptionSettings does not exist or encryptionSettings.enabled is false) and encryption.type is not member of ("EncryptionAtRestWithCustomerKey","EncryptionAtRestWithPlatformAndCustomerKeys","EncryptionAtRestWithPlatformKey")```
This policy identifies VM OS disks that are not configured with any encryption. Azure encrypts OS disks that are not configured with any encryption. Azure offers Server-Side Encryption (SSE) with platform-managed keys [SSE with PMK] by default for managed disks. It is recommended to enable default encryption or you may optionally choose to use a customer-managed key to protect from malicious activity.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-disk-list' and json.rule = osType exists and managedBy exists and (encryptionSettings does not exist or encryptionSettings.enabled is false) and encryption.type is not member of ("EncryptionAtRestWithCustomerKey","EncryptionAtRestWithPlatformAndCustomerKeys","EncryptionAtRestWithPlatformKey")```
jScheel Wireguard instance allows ANY toPort on 51820
```config from cloud.resource where cloud.type = 'aws' AND cloud.account = 'jScheel AWS Account' AND api.name = 'aws-ec2-describe-instances' as X; config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[?any( toPort equals 51820 and ipRanges[*] contains "0/0" )] exists as Y; config from cloud.resource where api.name = 'aws-ec2-describe-route-tables' AND json.rule = routes[?any( state equals active and gatewayId contains "igw" and destinationCidrBlock contains "0/0" )] exists as Z; filter ' $.X.securityGroups[*].groupId == $.Y.groupId and $.X.subnetId == $.Z.associations[*].subnetId'; show Z;```
Wireguard instance allows ANY toPort on 51820
```config from cloud.resource where cloud.type = 'aws' AND cloud.account = 'jScheel AWS Account' AND api.name = 'aws-ec2-describe-instances' as X; config from cloud.resource where api.name = 'aws-ec2-describe-security-groups' AND json.rule = ipPermissions[?any( toPort equals 51820 and ipRanges[*] contains "0/0" )] exists as Y; config from cloud.resource where api.name = 'aws-ec2-describe-route-tables' AND json.rule = routes[?any( state equals active and gatewayId contains "igw" and destinationCidrBlock contains "0/0" )] exists as Z; filter ' $.X.securityGroups[*].groupId == $.Y.groupId and $.X.subnetId == $.Z.associations[*].subnetId'; show Z;```
AWS Elastic File System (EFS) with encryption for data at rest is disabled
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-describe-mount-targets' AND json.rule = 'fileSystemDescription.encrypted is false'```
This policy identifies Elastic File Systems (EFSs) for which encryption for data at rest is disabled. It is highly recommended to implement at-rest encryption in order to prevent unauthorized users from reading sensitive data saved to EFSs.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-describe-mount-targets' AND json.rule = 'fileSystemDescription.encrypted is false'```
API automation policy buecs
```config from cloud.resource where api.name = "aws-ec2-describe-instances" AND json.rule = architecture contains "foo"```
OCI Event Rule and Notification does not exist for user changes
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.identitycontrolplane.createuser and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.deleteuser and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateuser and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateusercapabilities and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateuserstate) and actions.actions[*].topicId exists' as X; count(X) less than 1```
This policy identifies the OCI compartments which do not have an Event Rule and Notification that gets triggered for IAM User changes. Monitoring and alerting on changes to IAM User will help in identifying changes to the security posture. It is recommended that a Event Rule and Notification be configured to catch changes made to Identity and Access Management (IAM) Users.
NOTE: 
1. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level.
2. This policy will trigger alert if you have at least one Event Rule and Notification, even if OCI has single or multi compartments.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-events-rule' AND json.rule = '(isEnabled equals true) and (actions.actions[?any( actionType equals ONS and isEnabled equals true and lifecycleState equals ACTIVE)] exists) and (condition.eventType[*] contains com.oraclecloud.identitycontrolplane.createuser and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.deleteuser and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateuser and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateusercapabilities and condition.eventType[*] contains com.oraclecloud.identitycontrolplane.updateuserstate) and actions.actions[*].topicId exists' as X; count(X) less than 1```
Azure Container Registry using the deprecated classic registry
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-container-registry' AND json.rule =  skuName contains "Classic"```
This policy identifies an Azure Container Registry (ACR) that is using the classic SKU. The initial release of the Azure Container Registry (ACR) service that was offered as a classic SKU is being deprecated and will be unavailable after April 2019. As a best practice, upgrade your existing classic registry to a managed registry.

For more information, visit https://docs.microsoft.com/en-us/azure/container-registry/container-registry-upgrade
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-container-registry' AND json.rule =  skuName contains "Classic"```
AWS IAM password policy allows password reuse
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or passwordReusePrevention equals null or passwordReusePrevention !isType Integer or passwordReusePrevention < 1'```
This policy identifies IAM policies which allow password reuse . AWS IAM (Identity & Access Management) allows customers to secure AWS console access. As a security best practice, customers must have strong password policies in place.
```config from cloud.resource where cloud.type = 'aws' and api.name='aws-iam-get-account-password-policy' AND json.rule='isDefaultPolicy is true or passwordReusePrevention equals null or passwordReusePrevention !isType Integer or passwordReusePrevention < 1'```
IBM Cloud VPC ACL allow ingress rule from 0.0.0.0/0 to SSH port
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-network-acl' AND json.rule = rules[?any( source equals "0.0.0.0/0" and direction equals "inbound" and action equals "allow" and ( (protocol equals "tcp" and (( destination_port_max greater than 22 and destination_port_min less than 22 ) or ( destination_port_max equals 22 and destination_port_min equals 22 ))) or protocol equals "all" ))] exists```
This policy identifies IBM Cloud VPC Access Control List which are having ingress rule that allows traffic from 0.0.0.0/0 to SSH port. Doing so, may allow a bad actor to brute force their way into the system and potentially get access to the entire network. It is recommended to review VPC ACL rules to ensure that your resources are not exposed. As a best practice, restrict SSH solely to known static IP addresses.
```config from cloud.resource where cloud.type = 'ibm' AND api.name = 'ibm-vpc-network-acl' AND json.rule = rules[?any( source equals "0.0.0.0/0" and direction equals "inbound" and action equals "allow" and ( (protocol equals "tcp" and (( destination_port_max greater than 22 and destination_port_min less than 22 ) or ( destination_port_max equals 22 and destination_port_min equals 22 ))) or protocol equals "all" ))] exists```
OCI IAM policy with full administrative privileges across the tenancy to non Administrator
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-iam-policy' AND json.rule = lifecycleState equals ACTIVE and (statements[*] contains "to manage all-resources in tenancy" or statements[*] contains "to manage all-resources IN TENANCY") and name does not contain "Tenant Admin Policy"```
This policy identifies IAM policies with full administrative privileges across the tenancy to non Administrators. IAM policies are the means by which privileges are granted to users, groups, or services. It is recommended to practice the Principle of least privilege, which limits users' access rights to strictly required to do their jobs.
```config from cloud.resource where cloud.type = 'oci' AND api.name = 'oci-iam-policy' AND json.rule = lifecycleState equals ACTIVE and (statements[*] contains "to manage all-resources in tenancy" or statements[*] contains "to manage all-resources IN TENANCY") and name does not contain "Tenant Admin Policy"```
Azure Container Registry does not use a dedicated resource group
```config from cloud.resource where cloud.type='azure' and api.name= 'azure-container-registry'   as X; config from cloud.resource where api.name = 'azure-resource-group' as Y; filter ' $.X.resourceGroupName equals $.Y.name and $.Y.isDedicatedContainerRegistryGroup is false' ; show X;```
Placing your Azure Container Registry (ACR) in a dedicated Azure resource group, allows you to minimize the risk of accidentally deleting the collection of images in the registry when you delete the container instance resource group.
This policy identifies ACRs that reside in resource groups that contains non-ACR resources. For more information about ACR best practices, visit https://docs.microsoft.com/en-us/azure/container-registry/container-registry-best-practices
```config from cloud.resource where cloud.type='azure' and api.name= 'azure-container-registry'   as X; config from cloud.resource where api.name = 'azure-resource-group' as Y; filter ' $.X.resourceGroupName equals $.Y.name and $.Y.isDedicatedContainerRegistryGroup is false' ; show X;```
Azure App service HTTP logging is disabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case Running and config.httpLoggingEnabled exists and config.httpLoggingEnabled is false```
This policy identifies Azure App services that have HTTP logging disabled. 

By enabling HTTP logging for your app service, you can collect log information and use it to monitor and troubleshoot your app, as well as identify any potential security issues or threats. This can help to ensure that your app is running smoothly and is secure from potential attacks. 

As best practice, it is recommended to enable HTTP logging on your app service.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = properties.state equal ignore case Running and config.httpLoggingEnabled exists and config.httpLoggingEnabled is false```
Azure 'Notify about alerts with the following severity' is Set to 'High'
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-defender-for-cloud-security-contact' AND json.rule = properties.alertNotifications.state does not equal ignore case ON and properties.alertNotifications.minimalSeverity equal ignore case High```
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-defender-for-cloud-security-contact' AND json.rule = properties.alertNotifications.state does not equal ignore case ON and properties.alertNotifications.minimalSeverity equal ignore case High```
Alibaba Cloud disk encryption is disabled
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-disk' AND json.rule = 'encrypted is false'```
This policy identifies disks for which encryption is disabled. As a best practice enable disk encryption to improve data security without making changes to your business or applications. Snapshots created from encrypted disks and new disks created from these snapshots are automatically encrypted.
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-disk' AND json.rule = 'encrypted is false'```
Azure Virtual Machine scale sets Boot Diagnostics Disabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-virtual-machine-scale-set' AND json.rule = properties.virtualMachineProfile.diagnosticsProfile.bootDiagnostics.enabled is false```
This policy identifies Azure Virtual Machines scale sets which has Boot Diagnostics setting Disabled. Boot Diagnostics when enabled for virtual machine, captures Screenshot and Console Output during virtual machine startup. This would help in troubleshooting virtual machine when it enters a non-bootable state.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-virtual-machine-scale-set' AND json.rule = properties.virtualMachineProfile.diagnosticsProfile.bootDiagnostics.enabled is false```
Azure PostgreSQL database server Infrastructure double encryption is disabled
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-server' AND json.rule = (sku.tier equals GeneralPurpose or sku.tier equals MemoryOptimized) and properties.userVisibleState equals Ready and properties.infrastructureEncryption equals Disabled```
This policy identifies PostgreSQL database servers in which Infrastructure double encryption is disabled. Infrastructure double encryption adds a second layer of encryption using service-managed keys. It is recommended to enable infrastructure double encryption on PostgreSQL database servers so that encryption can be implemented at the layer closest to the storage device or network wires.

For more details: 
https://docs.microsoft.com/en-us/azure/postgresql/concepts-infrastructure-double-encryption
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-server' AND json.rule = (sku.tier equals GeneralPurpose or sku.tier equals MemoryOptimized) and properties.userVisibleState equals Ready and properties.infrastructureEncryption equals Disabled```
Azure Microsoft Defender for Cloud set to Off for File Integrity Monitoring
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = not (pricings[?any(properties.extensions[?any(name equal ignore case FileIntegrityMonitoring AND isEnabled is true)] exists AND properties.pricingTier equal ignore case Standard )] exists)```
This policy identifies Azure Microsoft Defender for Cloud where the File Integrity Monitoring is set to Off.

File Integrity Monitoring tracks critical system files in Windows and Linux for unauthorized changes, helping to identify potential attacks. Disabling File Integrity Monitoring leaves your system vulnerable to unnoticed alterations, increasing the risk of data breaches or system failures. Enabling FIM enhances security by alerting you to suspicious changes, allowing for proactive threat detection and prevention of unauthorized modifications to system files.

As a security best practice, it is recommended to enable File Integrity Monitoring in Azure Microsoft Defender for Cloud.
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = not (pricings[?any(properties.extensions[?any(name equal ignore case FileIntegrityMonitoring AND isEnabled is true)] exists AND properties.pricingTier equal ignore case Standard )] exists)```
AWS Log metric filter and alarm does not exist for AWS Security group changes
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "eventName=" or $.X.filterPattern contains "eventName =") and ($.X.filterPattern does not contain "eventName!=" and $.X.filterPattern does not contain "eventName !=") and $.X.filterPattern contains AuthorizeSecurityGroupIngress and $.X.filterPattern contains AuthorizeSecurityGroupEgress and $.X.filterPattern contains RevokeSecurityGroupIngress and $.X.filterPattern contains RevokeSecurityGroupEgress and $.X.filterPattern contains CreateSecurityGroup and $.X.filterPattern contains DeleteSecurityGroup) and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```
This policy identifies the AWS regions that do not have a log metric filter and alarm for security group changes.

Security groups act as virtual firewalls that control inbound and outbound traffic to AWS resources. If changes to these groups go unmonitored, it could result in unauthorized access or expose sensitive data to the public internet.

It is recommended to create a metric filter and alarm for security group changes to promptly detect and respond to any unauthorized modifications, thereby maintaining the integrity and security of your AWS environment.

NOTE: This policy will trigger an alert if you have at least one Cloudtrail with the multi-trail enabled, Logs all management events in your account, and is not set with a specific log metric filter and alarm.
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "eventName=" or $.X.filterPattern contains "eventName =") and ($.X.filterPattern does not contain "eventName!=" and $.X.filterPattern does not contain "eventName !=") and $.X.filterPattern contains AuthorizeSecurityGroupIngress and $.X.filterPattern contains AuthorizeSecurityGroupEgress and $.X.filterPattern contains RevokeSecurityGroupIngress and $.X.filterPattern contains RevokeSecurityGroupEgress and $.X.filterPattern contains CreateSecurityGroup and $.X.filterPattern contains DeleteSecurityGroup) and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```
Azure Front Door Web application firewall (WAF) policy rule for Remote Command Execution is disabled
```config from cloud.resource where api.name = 'azure-frontdoor-waf-policy' AND json.rule = properties.policySettings.enabledState equals Enabled and properties.managedRules.managedRuleSets is not empty and properties.managedRules.managedRuleSets[*].ruleGroupOverrides[*].rules[?any(action equals Block and ruleId equals 944240 and enabledState equals Disabled)] exists as X; config from cloud.resource where api.name = 'azure-frontdoor' AND json.rule = properties.frontendEndpoints[*].properties.webApplicationFirewallPolicyLink exists and properties.provisioningState equals Succeeded as Y; filter '$.Y.properties.frontendEndpoints[*].properties.webApplicationFirewallPolicyLink.id contains $.X.name'; show X;```
This policy identifies Azure Front Door Web application firewall (WAF) policies that have the Remote Command Execution rule disabled. It is recommended to define the criteria in the WAF policy with the rule ‘Remote Command Execution (944240)’ under managed rules to help in detecting and mitigating Log4j vulnerability. 

For details:
https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/ 
```config from cloud.resource where api.name = 'azure-frontdoor-waf-policy' AND json.rule = properties.policySettings.enabledState equals Enabled and properties.managedRules.managedRuleSets is not empty and properties.managedRules.managedRuleSets[*].ruleGroupOverrides[*].rules[?any(action equals Block and ruleId equals 944240 and enabledState equals Disabled)] exists as X; config from cloud.resource where api.name = 'azure-frontdoor' AND json.rule = properties.frontendEndpoints[*].properties.webApplicationFirewallPolicyLink exists and properties.provisioningState equals Succeeded as Y; filter '$.Y.properties.frontendEndpoints[*].properties.webApplicationFirewallPolicyLink.id contains $.X.name'; show X;```
bobby Copy of AWS SNS topic with cross-account access
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-sns-get-topic-attributes' AND json.rule = Policy.Statement[?any(Effect equals Allow and (Principal.AWS does not equal * and Principal does not equal * and Principal.AWS contains arn and Principal.AWS does not contain $.Owner))] exists```
This policy identifies AWS SNS topics that are configured with cross-account access. Allowing unknown cross-account access to your SNS topics will enable other accounts and gain control over your AWS SNS topics. To prevent unknown cross-account access, allow only trusted entities to access your Amazon SNS topics by implementing the appropriate SNS policies.
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-sns-get-topic-attributes' AND json.rule = Policy.Statement[?any(Effect equals Allow and (Principal.AWS does not equal * and Principal does not equal * and Principal.AWS contains arn and Principal.AWS does not contain $.Owner))] exists```
Azure App Service Web app doesn't use latest Java version
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'properties.state equals Running and ((config.javaVersion exists and config.javaVersion does not equal 1.8 and config.javaVersion does not equal 11 and config.javaVersion does not equal 17) or (config.linuxFxVersion is not empty and config.linuxFxVersion contains JAVA and (config.linuxFxVersion contains 8 or config.linuxFxVersion contains 11 or config.linuxFxVersion contains 17) and config.linuxFxVersion does not contain 8-jre8 and config.linuxFxVersion does not contain 11-java11 and config.linuxFxVersion does not contain 17-java17) or (config.linuxFxVersion is not empty and config.linuxFxVersion contains JBOSSEAP and config.linuxFxVersion does not contain 7-java8 and config.linuxFxVersion does not contain 7-java11 and config.linuxFxVersion does not contain 7-java17) or (config.linuxFxVersion contains TOMCAT and config.linuxFxVersion does not end with 10.0-jre8 and config.linuxFxVersion does not end with 9.0-jre8 and config.linuxFxVersion does not end with 8.5-jre8 and config.linuxFxVersion does not end with 10.0-java11 and config.linuxFxVersion does not end with 9.0-java11 and config.linuxFxVersion does not end with 8.5-java11 and config.linuxFxVersion does not end with 10.0-java17 and config.linuxFxVersion does not end with 9.0-java17 and config.linuxFxVersion does not end with 8.5-java17))'```