Update .new-additions

This reverts commit c31d574176.

.new-additions

@@ -1,69 +1,65 @@
-code/cves/2024/CVE-2024-12356.yaml
-code/cves/2024/CVE-2024-56331.yaml
-dast/vulnerabilities/cmdi/python-code-injection.yaml
-dast/vulnerabilities/redirect/open-redirect-bypass.yaml
-dast/vulnerabilities/ssti/freemarker-sandbox-bypass-ssti.yaml
-dast/vulnerabilities/ssti/oob/codepen-oob.yaml
-dast/vulnerabilities/ssti/oob/jinjava-oob.yaml
-dast/vulnerabilities/ssti/oob/pebble-oob.yaml
-dast/vulnerabilities/ssti/oob/spring-expression-oob.yaml
-dast/vulnerabilities/ssti/oob/thymeleaf-oob.yaml
-dast/vulnerabilities/ssti/razor-ssti.yaml
-dast/vulnerabilities/ssti/smarty-ssti.yaml
-dast/vulnerabilities/ssti/twig-ssti.yaml
-file/audit/ssh/change-default-port.yaml
-file/audit/ssh/disable-empty-password.yaml
-file/audit/ssh/disable-root-login.yaml
-file/audit/ssh/disable-ssh-forwarding.yaml
-file/audit/ssh/disable-ssh-protocol-1.yaml
-file/audit/ssh/enable-ssh-privilege-separation.yaml
-file/audit/ssh/hide-last-login-information.yaml
-file/audit/ssh/idle-timeout-Interval.yaml
-file/audit/ssh/limit-max-auth-attempts.yaml
-file/audit/ssh/limit-ssh-group.yaml
-file/audit/ssh/limit-ssh-users-access.yaml
-file/audit/ssh/ssh-ip-whitelist.yaml
-file/audit/ssh/ssh-key-auth-required.yaml
-headless/cves/2022/CVE-2022-29455.yaml
-headless/cves/2025/CVE-2025-25062.yaml
-http/cves/2023/CVE-2023-45826.yaml
-http/cves/2023/CVE-2023-47248.yaml
-http/cves/2024/CVE-2024-11396.yaml
-http/cves/2024/CVE-2024-12824.yaml
-http/cves/2024/CVE-2024-13159.yaml
-http/cves/2024/CVE-2024-13160.yaml
-http/cves/2024/CVE-2024-13161.yaml
-http/cves/2024/CVE-2024-13888.yaml
-http/cves/2024/CVE-2024-48248.yaml
-http/cves/2025/CVE-2025-0868.yaml
-http/cves/2025/CVE-2025-22952.yaml
-http/cves/2025/CVE-2025-24893.yaml
-http/cves/2025/CVE-2025-27112.yaml
-http/default-logins/klog-server-default-login.yaml
-http/default-logins/zoho/app-manager-default-login.yaml
-http/exposed-panels/beszel-panel.yaml
-http/exposed-panels/dex-panel.yaml
-http/exposed-panels/irisnext-panel.yaml
-http/exposed-panels/kerion-control-panel.yaml
-http/exposed-panels/squidex-panel.yaml
-http/miscellaneous/credit-card-number-detect.yaml
-http/misconfiguration/intercom-identity-misconfiguration.yaml
-http/misconfiguration/salesforce-community-misconfig.yaml
-http/technologies/pomerium-detect.yaml
-http/technologies/shibboleth-detect.yaml
-http/technologies/winrm-detect.yaml
-http/technologies/wordpress/plugins/aryo-activity-log.yaml
-http/technologies/wordpress/plugins/speedycache.yaml
-http/vulnerabilities/leantime/leantime-stored-xss.yaml
-javascript/audit/ssh/change-default-port.yaml
-javascript/audit/ssh/disable-empty-password.yaml
-javascript/audit/ssh/disable-root-login.yaml
-javascript/audit/ssh/disable-ssh-forwarding.yaml
-javascript/audit/ssh/disable-ssh-protocol-1.yaml
-javascript/audit/ssh/enable-ssh-privilege-separation.yaml
-javascript/audit/ssh/hide-last-login-information.yaml
-javascript/audit/ssh/idle-timeout-interval.yaml
-javascript/audit/ssh/limit-ssh-group.yaml
-javascript/audit/ssh/limit-ssh-users-access.yaml
-javascript/audit/ssh/ssh-key-auth-disabled.yaml
-javascript/audit/ssh/ssh-unrestricted-nonwhitelist.yaml
+http/cves/2018/CVE-2018-11222.yaml
+http/cves/2018/CVE-2018-17283.yaml
+http/cves/2018/CVE-2018-19276.yaml
+http/cves/2018/CVE-2018-19410.yaml
+http/cves/2018/CVE-2018-20062.yaml
+http/cves/2019/CVE-2019-20504.yaml
+http/cves/2019/CVE-2019-5128.yaml
+http/cves/2019/CVE-2019-5129.yaml
+http/cves/2020/CVE-2020-15415.yaml
+http/cves/2021/CVE-2021-25161.yaml
+http/cves/2021/CVE-2021-36646.yaml
+http/cves/2022/CVE-2022-0592.yaml
+http/cves/2022/CVE-2022-1950.yaml
+http/cves/2022/CVE-2022-31137.yaml
+http/cves/2022/CVE-2022-31161.yaml
+http/cves/2022/CVE-2022-45808.yaml
+http/cves/2023/CVE-2023-1389.yaml
+http/cves/2023/CVE-2023-51409.yaml
+http/cves/2024/CVE-2024-11320.yaml
+http/cves/2024/CVE-2024-12987.yaml
+http/cves/2024/CVE-2024-2473.yaml
+http/cves/2024/CVE-2024-44762.yaml
+http/cves/2024/CVE-2024-8529.yaml
+http/cves/2025/CVE-2025-1743.yaml
+http/cves/2025/CVE-2025-2011.yaml
+http/cves/2025/CVE-2025-2127.yaml
+http/cves/2025/CVE-2025-24016.yaml
+http/cves/2025/CVE-2025-2609.yaml
+http/cves/2025/CVE-2025-2610.yaml
+http/cves/2025/CVE-2025-2636.yaml
+http/cves/2025/CVE-2025-27007.yaml
+http/cves/2025/CVE-2025-3102.yaml
+http/cves/2025/CVE-2025-34026.yaml
+http/cves/2025/CVE-2025-34027.yaml
+http/cves/2025/CVE-2025-4123.yaml
+http/cves/2025/CVE-2025-41393.yaml
+http/cves/2025/CVE-2025-4388.yaml
+http/cves/2025/CVE-2025-4396.yaml
+http/cves/2025/CVE-2025-4427.yaml
+http/cves/2025/CVE-2025-47204.yaml
+http/cves/2025/CVE-2025-47916.yaml
+http/default-logins/loytec/loytec-default-password.yaml
+http/default-logins/magnusbilling/magnusbilling-default-login.yaml
+http/default-logins/nti/enviromuux-default-login.yaml
+http/default-logins/osasi/osasi-default-login.yaml
+http/default-logins/siemens/siemens-simatic-default-login.yaml
+http/default-logins/wago/wago-webbased-default-login.yaml
+http/exposed-panels/aperio-eslidemanager-panel.yaml
+http/exposed-panels/mbilling-panel.yaml
+http/exposed-panels/osasi-panel.yaml
+http/exposed-panels/polarion-siemens-panel.yaml
+http/exposed-panels/sap-netweaver-cet-detect.yaml
+http/iot/cae-monitor-panel.yaml
+http/iot/etic-telecom-panel.yaml
+http/iot/moxa-vpn-router-panel.yaml
+http/iot/siemens-logo8-panel.yaml
+http/iot/siemens-simatic-panel.yaml
+http/iot/wago-webbased-panel.yaml
+http/misconfiguration/installer/emby-installer.yaml
+http/misconfiguration/traccar-settings-disclosure.yaml
+http/technologies/docker-registry-browser-detect.yaml
+http/technologies/plantumlserver-detect.yaml
+http/technologies/webswing-api-version-detect.yaml
+http/vulnerabilities/other/wp-publishpress-capabilities-xss.yaml
+http/vulnerabilities/vbulletin/vbulletin-replacead-rce.yaml

.nuclei-ignore

@@ -25,11 +25,7 @@ tags:
 # unless asked for by the user.
 
 files:
-  - http/cves/2006/CVE-2006-1681.yaml
   - http/cves/2019/CVE-2019-14696.yaml
-  - http/cves/2020/CVE-2020-2036.yaml
-  - http/cves/2020/CVE-2020-28351.yaml
-  - http/vulnerabilities/oracle/oracle-ebs-xss.yaml
   - http/cves/2021/CVE-2021-28164.yaml
   - http/fuzzing/wordpress-themes-detect.yaml
   - http/fuzzing/mdb-database-file.yaml

README.md

@@ -42,18 +42,18 @@ An overview of the nuclei template project, including statistics on unique tags,
 
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  2954 | dhiyaneshdk   |  1577 | http       |  8399 | info     |  4016 | file |   404 |
-| panel     |  1268 | daffainfo     |   867 | cloud      |   419 | high     |  2231 | dns  |    25 |
-| wordpress |  1095 | dwisiswant0   |   804 | file       |   404 | medium   |  1896 |      |       |
-| exposure  |  1052 | princechaddha |   570 | workflows  |   192 | critical |  1233 |      |       |
-| xss       |  1003 | ritikchaddha  |   533 | code       |   160 | low      |   292 |      |       |
-| wp-plugin |   958 | pussycat0x    |   452 | network    |   140 | unknown  |    37 |      |       |
-| osint     |   807 | pikpikcu      |   352 | javascript |    66 |          |       |      |       |
-| tech      |   760 | pdteam        |   302 | dast       |    40 |          |       |      |       |
-| lfi       |   744 | ricardomaia   |   247 | ssl        |    36 |          |       |      |       |
-| misconfig |   725 | geeknik       |   234 | dns        |    22 |          |       |      |       |
+| cve       |  3081 | dhiyaneshdk   |  1828 | http       |  8605 | info     |  4072 | file |   434 |
+| panel     |  1295 | daffainfo     |   868 | cloud      |   655 | high     |  2360 | dns  |    25 |
+| xss       |  1231 | princechaddha |   806 | file       |   434 | medium   |  2313 |      |       |
+| wordpress |  1131 | dwisiswant0   |   805 | dast       |   255 | critical |  1298 |      |       |
+| exposure  |  1083 | ritikchaddha  |   586 | workflows  |   202 | low      |   315 |      |       |
+| wp-plugin |   990 | pussycat0x    |   500 | code       |   168 | unknown  |    53 |      |       |
+| osint     |   808 | pikpikcu      |   352 | network    |   140 |          |       |      |       |
+| tech      |   774 | pdteam        |   304 | javascript |    71 |          |       |      |       |
+| lfi       |   760 | ricardomaia   |   249 | ssl        |    38 |          |       |      |       |
+| misconfig |   737 | geeknik       |   235 | dns        |    22 |          |       |      |       |
 
-**786 directories, 10220 files**.
+**826 directories, 10939 files**.
 
 </td>
 </tr>

TEMPLATES-STATS.json

@@ -1 +1 @@
-{"tags":[{"name":"cve","count":2954},{"name":"panel","count":1268},{"name":"wordpress","count":1095},{"name":"exposure","count":1052},{"name":"xss","count":1003},{"name":"wp-plugin","count":958},{"name":"osint","count":807},{"name":"tech","count":760},{"name":"lfi","count":744},{"name":"misconfig","count":725},{"name":"rce","count":693},{"name":"edb","count":598},{"name":"packetstorm","count":552},{"name":"wpscan","count":530},{"name":"wp","count":510},{"name":"cve2021","count":503},{"name":"cve2022","count":496},{"name":"devops","count":496},{"name":"cve2023","count":460},{"name":"sqli","count":455},{"name":"cloud","count":454},{"name":"detect","count":440},{"name":"authenticated","count":403},{"name":"login","count":396},{"name":"unauth","count":395},{"name":"cve2024","count":380},{"name":"intrusive","count":362},{"name":"file","count":347},{"name":"kev","count":290},{"name":"cve2020","count":260},{"name":"oast","count":256},{"name":"default-login","count":251},{"name":"token-spray","count":247},{"name":"microsoft","count":235},{"name":"top-200","count":233},{"name":"config","count":228},{"name":"apache","count":224},{"name":"malware","count":213},{"name":"token","count":211},{"name":"osint-social","count":210},{"name":"azure","count":210},{"name":"network","count":209},{"name":"","count":193},{"name":"azure-cloud-config","count":191},{"name":"aws","count":183},{"name":"time-based-sqli","count":174},{"name":"cve2018","count":173},{"name":"iot","count":172},{"name":"cve2019","count":170},{"name":"amazon","count":166},{"name":"auth-bypass","count":166},{"name":"install","count":161},{"name":"keys","count":156},{"name":"code","count":153},{"name":"redirect","count":151},{"name":"joomla","count":150},{"name":"tcp","count":139},{"name":"aws-cloud-config","count":138},{"name":"ssrf","count":137},{"name":"cms","count":121},{"name":"phishing","count":117},{"name":"cve2017","count":117},{"name":"files","count":114},{"name":"cve2010","count":112},{"name":"router","count":111},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"disclosure","count":96},{"name":"linux","count":86},{"name":"seclists","count":83},{"name":"local","count":81},{"name":"takeover","count":80},{"name":"privesc","count":80},{"name":"oss","count":78},{"name":"fileupload","count":76},{"name":"oracle","count":75},{"name":"kubernetes","count":74},{"name":"windows-audit","count":70},{"name":"js","count":70},{"name":"cisco","count":70},{"name":"windows","count":66},{"name":"adobe","count":65},{"name":"enum","count":65},{"name":"huntr","count":64},{"name":"k8s","count":63},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2016","count":60},{"name":"cve2015","count":60},{"name":"atlassian","count":59},{"name":"vmware","count":57},{"name":"c2","count":57},{"name":"detection","count":57},{"name":"google","count":56},{"name":"logs","count":50},{"name":"cve2014","count":49},{"name":"tenable","count":49},{"name":"file-upload","count":48},{"name":"php","count":48},{"name":"hackerone","count":47},{"name":"log4j","count":47},{"name":"debug","count":47},{"name":"cnvd","count":46},{"name":"generic","count":46},{"name":"vulhub","count":46},{"name":"deserialization","count":46},{"name":"aem","count":46},{"name":"aliyun","count":45},{"name":"osint-gaming","count":45},{"name":"traversal","count":44},{"name":"jndi","count":44},{"name":"oa","count":43},{"name":"injection","count":42},{"name":"plugin","count":42},{"name":"osint-porn","count":42},{"name":"osint-hobby","count":42},{"name":"springboot","count":40},{"name":"ssl","count":40},{"name":"dast","count":40},{"name":"misc","count":40},{"name":"listing","count":40},{"name":"tls","count":39},{"name":"miscellaneous","count":39},{"name":"ibm","count":39},{"name":"fortinet","count":39},{"name":"cti","count":37},{"name":"jira","count":37},{"name":"dlink","count":35},{"name":"sap","count":35},{"name":"k8s-cluster-security","count":35},{"name":"osint-misc","count":35},{"name":"ssti","count":35},{"name":"gitlab","count":33},{"name":"devsecops","count":33},{"name":"wp-theme","count":33},{"name":"fuzz","count":33},{"name":"lfr","count":33},{"name":"info-leak","count":32},{"name":"api","count":31},{"name":"osint-tech","count":31},{"name":"alibaba-cloud-config","count":30},{"name":"ec2","count":30},{"name":"osint-coding","count":30},{"name":"printer","count":28},{"name":"yonyou","count":28},{"name":"xxe","count":28},{"name":"tomcat","count":27},{"name":"bestwebsoft","count":27},{"name":"dns","count":27},{"name":"firewall","count":27},{"name":"proxy","count":27},{"name":"citrix","count":27},{"name":"manageengine","count":26},{"name":"zohocorp","count":26},{"name":"admin","count":26},{"name":"cve2012","count":26},{"name":"ssh","count":26},{"name":"weaver","count":25},{"name":"zoho","count":25},{"name":"prestashop","count":25},{"name":"osint-shopping","count":24},{"name":"rds","count":24},{"name":"github","count":24},{"name":"osint-business","count":24},{"name":"osint-finance","count":24},{"namLine truncated
+{"tags":[{"name":"cve","count":3081},{"name":"panel","count":1295},{"name":"xss","count":1231},{"name":"wordpress","count":1131},{"name":"exposure","count":1083},{"name":"wp-plugin","count":990},{"name":"osint","count":808},{"name":"tech","count":774},{"name":"lfi","count":760},{"name":"misconfig","count":737},{"name":"devops","count":736},{"name":"rce","count":718},{"name":"cloud","count":694},{"name":"edb","count":598},{"name":"packetstorm","count":551},{"name":"wp","count":542},{"name":"wpscan","count":531},{"name":"cve2021","count":503},{"name":"cve2022","count":502},{"name":"cve2023","count":473},{"name":"sqli","count":466},{"name":"detect","count":460},{"name":"cve2024","count":438},{"name":"login","count":421},{"name":"authenticated","count":414},{"name":"unauth","count":413},{"name":"file","count":376},{"name":"intrusive","count":370},{"name":"kev","count":337},{"name":"oast","count":271},{"name":"cve2020","count":260},{"name":"default-login","count":257},{"name":"config","count":253},{"name":"token-spray","count":247},{"name":"microsoft","count":235},{"name":"top-200","count":235},{"name":"apache","count":234},{"name":"gcp","count":232},{"name":"gcp-cloud-config","count":226},{"name":"gcloud","count":224},{"name":"network","count":215},{"name":"malware","count":213},{"name":"token","count":211},{"name":"azure","count":210},{"name":"osint-social","count":210},{"name":"","count":204},{"name":"csp-bypass","count":204},{"name":"aws","count":192},{"name":"azure-cloud-config","count":191},{"name":"time-based-sqli","count":179},{"name":"auth-bypass","count":176},{"name":"iot","count":175},{"name":"amazon","count":175},{"name":"cve2018","count":173},{"name":"cve2019","count":170},{"name":"install","count":164},{"name":"keys","count":156},{"name":"code","count":156},{"name":"redirect","count":155},{"name":"joomla","count":150},{"name":"aws-cloud-config","count":147},{"name":"ssrf","count":142},{"name":"tcp","count":139},{"name":"security","count":133},{"name":"files","count":124},{"name":"cms","count":123},{"name":"router","count":119},{"name":"cve2017","count":117},{"name":"phishing","count":117},{"name":"cve2010","count":112},{"name":"kubernetes","count":109},{"name":"disclosure","count":104},{"name":"top-100","count":100},{"name":"tokens","count":97},{"name":"linux","count":86},{"name":"seclists","count":84},{"name":"local","count":81},{"name":"privesc","count":80},{"name":"takeover","count":80},{"name":"oracle","count":80},{"name":"oss","count":79},{"name":"fileupload","count":77},{"name":"js","count":75},{"name":"windows","count":72},{"name":"enum","count":71},{"name":"cisco","count":71},{"name":"windows-audit","count":70},{"name":"k8s","count":69},{"name":"adobe","count":65},{"name":"huntr","count":64},{"name":"ir","count":63},{"name":"alibaba","count":61},{"name":"cve2015","count":60},{"name":"cve2016","count":60},{"name":"atlassian","count":59},{"name":"vmware","count":57},{"name":"detection","count":57},{"name":"c2","count":57},{"name":"google","count":57},{"name":"audit","count":53},{"name":"cve2025","count":53},{"name":"dast","count":51},{"name":"file-upload","count":51},{"name":"logs","count":50},{"name":"deserialization","count":49},{"name":"php","count":49},{"name":"cve2014","count":49},{"name":"tenable","count":48},{"name":"log4j","count":48},{"name":"generic","count":47},{"name":"hackerone","count":47},{"name":"traversal","count":47},{"name":"debug","count":47},{"name":"aem","count":46},{"name":"vulhub","count":46},{"name":"cnvd","count":46},{"name":"aliyun","count":45},{"name":"ssh","count":45},{"name":"osint-gaming","count":45},{"name":"injection","count":44},{"name":"ssti","count":44},{"name":"jndi","count":44},{"name":"oa","count":43},{"name":"misc","count":43},{"name":"ssl","count":43},{"name":"fortinet","count":42},{"name":"osint-porn","count":42},{"name":"plugin","count":42},{"name":"osint-hobby","count":42},{"name":"firewall","count":41},{"name":"tls","count":41},{"name":"springboot","count":40},{"name":"listing","count":40},{"name":"ibm","count":40},{"name":"postgresql","count":39},{"name":"miscellaneous","count":39},{"name":"sap","count":37},{"name":"cti","count":37},{"name":"jira","count":37},{"name":"info-leak","count":37},{"name":"k8s-cluster-security","count":36},{"name":"google-cloud-sql","count":36},{"name":"dlink","count":36},{"name":"osint-misc","count":35},{"name":"api","count":34},{"name":"wp-theme","count":34},{"name":"networking","count":34},{"name":"gitlab","count":34},{"name":"fuzz","count":33},{"name":"lfr","count":33},{"name":"devsecops","count":33},{"name":"xxe","count":31},{"name":"vpc","count":31},{"name":"osint-tech","count":31},{"name":"nginx","count":31},{"name":"dns","count":31},{"name":"osint-coding","count":30},{"name":"ec2","count":30},{"name":"alibaba-cloud-config","count":30},{"name":"gke","count":29},{"name":"printer","count":28},{"name":"tomcat","count":28},{"name":"admin","count":28},{"name":"yonyou","count":28},{"name":"proxy","count":27},{"name":"bLine truncated

TOP-10.md

@@ -1,12 +1,12 @@
 |    TAG    | COUNT |    AUTHOR     | COUNT | DIRECTORY  | COUNT | SEVERITY | COUNT | TYPE | COUNT |
 |-----------|-------|---------------|-------|------------|-------|----------|-------|------|-------|
-| cve       |  2954 | dhiyaneshdk   |  1577 | http       |  8399 | info     |  4016 | file |   404 |
-| panel     |  1268 | daffainfo     |   867 | cloud      |   419 | high     |  2231 | dns  |    25 |
-| wordpress |  1095 | dwisiswant0   |   804 | file       |   404 | medium   |  1896 |      |       |
-| exposure  |  1052 | princechaddha |   570 | workflows  |   192 | critical |  1233 |      |       |
-| xss       |  1003 | ritikchaddha  |   533 | code       |   160 | low      |   292 |      |       |
-| wp-plugin |   958 | pussycat0x    |   452 | network    |   140 | unknown  |    37 |      |       |
-| osint     |   807 | pikpikcu      |   352 | javascript |    66 |          |       |      |       |
-| tech      |   760 | pdteam        |   302 | dast       |    40 |          |       |      |       |
-| lfi       |   744 | ricardomaia   |   247 | ssl        |    36 |          |       |      |       |
-| misconfig |   725 | geeknik       |   234 | dns        |    22 |          |       |      |       |
+| cve       |  3081 | dhiyaneshdk   |  1828 | http       |  8605 | info     |  4072 | file |   434 |
+| panel     |  1295 | daffainfo     |   868 | cloud      |   655 | high     |  2360 | dns  |    25 |
+| xss       |  1231 | princechaddha |   806 | file       |   434 | medium   |  2313 |      |       |
+| wordpress |  1131 | dwisiswant0   |   805 | dast       |   255 | critical |  1298 |      |       |
+| exposure  |  1083 | ritikchaddha  |   586 | workflows  |   202 | low      |   315 |      |       |
+| wp-plugin |   990 | pussycat0x    |   500 | code       |   168 | unknown  |    53 |      |       |
+| osint     |   808 | pikpikcu      |   352 | network    |   140 |          |       |      |       |
+| tech      |   774 | pdteam        |   304 | javascript |    71 |          |       |      |       |
+| lfi       |   760 | ricardomaia   |   249 | ssl        |    38 |          |       |      |       |
+| misconfig |   737 | geeknik       |   235 | dns        |    22 |          |       |      |       |

cloud/aws/eks/eks-aws-managed-iam-policy.yaml

@@ -0,0 +1,79 @@
+id: eks-aws-managed-iam-policy
+
+info:
+  name: Use AWS-managed policy to manage AWS resources
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that all Amazon EKS clusters use the "AmazonEKSClusterPolicy" managed policy to efficiently manage the resources that you use with the EKS service. This policy grants Kubernetes the necessary permissions to handle resources on your behalf.
+  impact: |
+    Without the AmazonEKSClusterPolicy, Kubernetes may not have the required permissions to perform essential operations like EC2:CreateTags, which are needed for proper resource management and identification.
+  remediation: |
+    Attach the AmazonEKSClusterPolicy to the IAM role associated with your EKS cluster using either the AWS Console or AWS CLI.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/eks-aws-managed-iam-policy.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/service_IAM_role.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+    code(3)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-cluster --region $region --name $cluster --query 'cluster.roleArn' --output json
+
+    extractors:
+      - type: json
+        name: rolearn
+        internal: true
+        json:
+          - '.'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws iam list-attached-role-policies --role-name $(echo $rolearn | cut -d'/' -f2) --query 'AttachedPolicies[*].PolicyArn' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
+        negative: true
+
+      - type: word
+        words:
+          - "["
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS cluster " + cluster + " does not have AmazonEKSClusterPolicy attached to its IAM role"'
+# digest: 4b0a00483046022100cb188ea7a1c621443962e0752bbd3c2ed69bff4d32f2235fdc081775da96d4e1022100b1f30b371acb9baa1fa798187a7a003c496d9b10b73f163722b365498bdd289e:922c64590222798bb761d5b6d8e72950

cloud/aws/eks/eks-cluster-logging.yaml

@@ -0,0 +1,65 @@
+id: eks-cluster-logging
+
+info:
+  name: Kubernetes Cluster Logging
+  author: princechaddha
+  severity: low
+  description: |
+    Ensure that your Amazon Elastic Kubernetes Service (EKS) clusters have control plane logs enabled to publish API, audit, controller manager, scheduler and authenticator logs to AWS CloudWatch Logs.
+  impact: |
+    Without control plane logging enabled, you lose visibility into API requests, authentication attempts, and cluster operations, making it difficult to monitor, troubleshoot, and audit cluster activities.
+  remediation: |
+    Enable control plane logging for your EKS cluster by configuring all log types (api, audit, authenticator, controllerManager, scheduler) in the cluster configuration.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/cluster-logging.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-cluster --region $region --name $cluster --query 'cluster.logging.clusterLogging[*].enabled' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "false"
+
+      - type: word
+        words:
+          - "true"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS cluster " + cluster + " does not have control plane logging enabled"'
+# digest: 4a0a0047304502207abbc7892b2cc08d5d295b171c31d5ae2ef322d6278e92f662aeb47c659f8885022100ba3672bb61d247c24db1fc1b6ef3cd256258f04a268d52faa5e8105261796fd7:922c64590222798bb761d5b6d8e72950

cloud/aws/eks/eks-endpoint-access.yaml

@@ -0,0 +1,64 @@
+id: eks-endpoint-access
+
+info:
+  name: EKS Cluster Endpoint Public Access
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Amazon EKS cluster's Kubernetes API server endpoint is not publicly accessible from the Internet in order to avoid exposing private data and minimizing security risks.
+  impact: |
+    Publicly accessible EKS cluster endpoints expose your Kubernetes API server to potential unauthorized access and attacks, increasing the risk of data breaches and security compromises.
+  remediation: |
+    Configure the EKS cluster endpoint access to be private or restrict public access to specific IP addresses. Use VPC endpoints and security groups to control access to the Kubernetes API server.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/endpoint-access.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let clusterName of iterate(template.clusters)){
+    set("cluster", clusterName)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters[]' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-cluster --name $cluster --region $region --query 'cluster.resourcesVpcConfig' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"endpointPublicAccess": true'
+
+      - type: word
+        words:
+          - '"0.0.0.0/0"'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS cluster " + cluster + " has public endpoint access enabled with unrestricted CIDR (0.0.0.0/0)"'
+# digest: 4a0a004730450220449d0874682b6d4ed40f71819e03f437222ad9b8f6b8cc21fc17bca8fda57714022100b3b986adfc06443888f8dc7148a6721b2dce6beabce549e0b74aebd6835d3f80:922c64590222798bb761d5b6d8e72950

cloud/aws/eks/eks-iam-managed-policy-networking.yaml

@@ -0,0 +1,96 @@
+id: eks-iam-managed-policy-networking
+
+info:
+  name: Use AWS-managed policy to Manage Networking Resources
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that all Amazon EKS cluster node groups use the "AmazonEKS_CNI_Policy" managed policy to manage cloud networking resources effectively. This policy provides the necessary permissions to the Amazon VPC CNI Plugin for managing network interfaces.
+  impact: |
+    Without the AmazonEKS_CNI_Policy, the VPC CNI plugin cannot properly manage network interfaces, which will affect pod networking and communication within the EKS cluster.
+  remediation: |
+    Attach the AmazonEKS_CNI_Policy to the IAM role associated with your EKS node groups using either the AWS Console or AWS CLI.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/eks-iam-managed-policy-networking.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+    for(let nodegroup of iterate(template.nodegroups)){
+      set("nodegroup", nodegroup)
+      code(3)
+      code(4)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-nodegroups --region $region --cluster-name $cluster --query 'nodegroups' --output json
+
+    extractors:
+      - type: json
+        name: nodegroups
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-nodegroup --region $region --cluster-name $cluster --nodegroup-name $nodegroup --query 'nodegroup.nodeRole' --output json
+
+    extractors:
+      - type: json
+        name: rolearn
+        internal: true
+        json:
+          - '.'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws iam list-attached-role-policies --role-name $(echo $rolearn | cut -d'/' -f2) --query 'AttachedPolicies[*].PolicyArn' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
+        negative: true
+
+      - type: word
+        words:
+          - "["
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS node group " + nodegroup + " in cluster " + cluster + " does not have AmazonEKS_CNI_Policy attached to its IAM role"'
+# digest: 4a0a00473045022023f8808874109fe7ecbba46a483828ba13f43be27154f5616fe50dc71b12cc43022100af8c38a314e3e68589d0d8fc67814595d173bc29827cdee00c0fcf3189049701:922c64590222798bb761d5b6d8e72950

cloud/aws/eks/eks-kubernetes-secrets-encryption.yaml

@@ -0,0 +1,59 @@
+id: eks-kubernetes-secrets-encryption
+
+info:
+  name: EKS Kubernetes Secrets not Encrypted
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Amazon Elastic Kubernetes Service (EKS) clusters have encryption enabled for Kubernetes secrets using AWS KMS Customer Master Keys (CMKs). This is a security best practice for protecting sensitive data stored in Kubernetes secrets.
+  impact: |
+    Without encryption enabled, Kubernetes secrets are stored in plaintext, making them vulnerable to unauthorized access and potentially violating compliance requirements for data-at-rest encryption.
+  remediation: |
+    Enable encryption for your EKS cluster by creating a KMS CMK and configuring it for the cluster. Note that this requires recreating the cluster with the encryption configuration.
+  reference:
+    - https://docs.aws.amazon.com/eks/latest/userguide/encryption-configuration.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/update-cluster.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-cluster --region $region --name $cluster --query 'cluster.encryptionConfig[*].provider.keyArn' --output json
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS cluster " + cluster + " does not have encryption enabled for Kubernetes secrets"'
+# digest: 4b0a0048304602210095384f513dd7c3cfcf985e2bb4c95fd1ef48deb4c6d60d5e2068f5be999999a7022100dc5163ca0d48f98dd9991cfb47bfa72632a09376f17fb74868870b8816f9e944:922c64590222798bb761d5b6d8e72950

cloud/aws/eks/eks-logging-kubes-api-calls.yaml

@@ -0,0 +1,59 @@
+id: eks-logging-kubes-api-calls
+
+info:
+  name: Enable CloudTrail Logging for Kubernetes API Calls
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that CloudTrail logging is enabled for Amazon Elastic Kubernetes Service (EKS) clusters in order to record all Kubernetes API calls. Amazon CloudTrail records and documents all activities performed on EKS clusters.
+  impact: |
+    Without CloudTrail logging enabled, there is no audit trail of API calls made to EKS clusters, making it difficult to track unauthorized access, investigate security incidents, and maintain compliance.
+  remediation: |
+    Enable CloudTrail logging for your EKS clusters by either starting logging on existing trails or creating a new multi-region trail if none exists.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/eks-logging-kubes-api-calls.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/logging-using-cloudtrail.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let trailName of iterate(template.trails)){
+    set("trail", trailName)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws cloudtrail list-trails --region $region --query 'Trails[*].Name' --output json
+
+    extractors:
+      - type: json
+        name: trails
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws cloudtrail get-trail-status --name $trail --region $region --query 'IsLogging' --output json
+
+    matchers:
+      - type: word
+        words:
+          - "false"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"CloudTrail trail " + trail + " is not logging EKS API calls"'
+# digest: 4a0a00473045022100f391ee451c3a69cb5835b4b0a2c35886c5905ac8d91adf05ea56546b3e4109ff02201fd66caa2a782620e962cecbdf4ff60f957dcecac3f8d53006d44b60d08d7672:922c64590222798bb761d5b6d8e72950

cloud/aws/eks/eks-long-running-pods.yaml

@@ -0,0 +1,64 @@
+id: eks-long-running-pods
+
+info:
+  name: EKS Long Running Pods
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Amazon Elastic Kubernetes Service (EKS) clusters do not have pods running for more than 30 days. Long-running pods may indicate stale deployments, potential security risks, or resource inefficiencies.
+  impact: |
+    Long-running pods can lead to security vulnerabilities, outdated software versions, and inefficient resource utilization. They may also indicate a lack of proper deployment practices and maintenance.
+  remediation: |
+    Review and update long-running pods. Consider implementing proper deployment strategies, regular updates, and automated pod rotation policies.
+  reference:
+    - https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/
+    - https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+  days: "30"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks update-kubeconfig --name $cluster --region $region
+      kubectl get pods --all-namespaces --field-selector=status.phase=Running --output=json | \
+      jq -r --argjson days "$days" '.items[] |
+      select((now - (.metadata.creationTimestamp | fromdate)) > ($days * 24 * 3600)) |
+      .metadata.namespace + "/" + .metadata.name'
+
+    matchers:
+      - type: word
+        words:
+          - "/"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS cluster " + cluster + " has pods running for more than " + days + " days"'
+# digest: 4a0a00473045022078e484dde6ab14a2c60f99ac9498ceac9733bddc7c21db406a696cf49974d53d022100b8fde680e4403da4247605f652a492812f19e6559cfd949652e11e22dadbf28e:922c64590222798bb761d5b6d8e72950

cloud/aws/eks/eks-managed-policy-ecr-access.yaml

@@ -0,0 +1,96 @@
+id: eks-managed-policy-ecr-access
+
+info:
+  name: Use AWS-managed policy to access Amazon ECR Repositories
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that all EKS cluster node groups use the "AmazonEC2ContainerRegistryReadOnly" managed policy to access Amazon ECR repositories. This policy provides read-only access to Amazon EC2 Container Registry (ECR) repositories.
+  impact: |
+    Without the AmazonEC2ContainerRegistryReadOnly policy, EKS node groups cannot pull container images from ECR repositories, which will prevent pods from starting and running properly.
+  remediation: |
+    Attach the AmazonEC2ContainerRegistryReadOnly policy to the IAM role associated with your EKS node groups using either the AWS Console or AWS CLI.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/managed-policy-ecr-access.html
+    - https://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let cluster of iterate(template.clusters)){
+    set("cluster", cluster)
+    code(2)
+    for(let nodegroup of iterate(template.nodegroups)){
+      set("nodegroup", nodegroup)
+      code(3)
+      code(4)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-nodegroups --region $region --cluster-name $cluster --query 'nodegroups' --output json
+
+    extractors:
+      - type: json
+        name: nodegroups
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-nodegroup --region $region --cluster-name $cluster --nodegroup-name $nodegroup --query 'nodegroup.nodeRole' --output json
+
+    extractors:
+      - type: json
+        name: rolearn
+        internal: true
+        json:
+          - '.'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws iam list-attached-role-policies --role-name $(echo $rolearn | cut -d'/' -f2) --query 'AttachedPolicies[*].PolicyArn' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
+        negative: true
+
+      - type: word
+        words:
+          - "["
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS node group " + nodegroup + " in cluster " + cluster + " does not have AmazonEC2ContainerRegistryReadOnly policy attached to its IAM role"'
+# digest: 4b0a00483046022100dfff86549934385d864486861683a6edb57b79f605a4d9fe4ec39ae73e89441a022100b9baaea0b29a98600ba9ac840f7ff8b99be1fd58679e781a011a6fe2bc8c0bfd:922c64590222798bb761d5b6d8e72950

cloud/aws/eks/eks-node-group-remote-access.yaml

@@ -0,0 +1,82 @@
+id: eks-node-group-remote-access
+
+info:
+  name: EKS Node Group Remote Access Configuration
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that Amazon EKS node groups are configured with appropriate remote access settings to maintain security and enable necessary administrative access.
+  impact: |
+    Improper remote access configuration in EKS node groups can lead to security vulnerabilities or hinder necessary administrative access, potentially affecting cluster management and troubleshooting capabilities.
+  remediation: |
+    Configure remote access settings for EKS node groups by specifying appropriate SSH key pairs and source security groups to enable secure administrative access while maintaining security best practices.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/EKS/eks-node-group-remote-access.html
+    - https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html
+  tags: cloud,devops,aws,amazon,eks,aws-cloud-config
+
+variables:
+  region: "us-east-1"
+
+flow: |
+  code(1)
+  for(let clusterName of iterate(template.clusters)){
+    set("cluster", clusterName)
+    code(2)
+    for(let nodegroupName of iterate(template.nodegroups)){
+      set("nodegroup", nodegroupName)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-clusters --region $region --query 'clusters[]' --output json
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks list-nodegroups --cluster-name $cluster --region $region --query 'nodegroups[]' --output json
+
+    extractors:
+      - type: json
+        name: nodegroups
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      aws eks describe-nodegroup --cluster-name $cluster --nodegroup-name $nodegroup --region $region --query 'nodegroup.remoteAccess' --output json
+
+    matchers-condition: and
+    matchers:
+      - type: regex
+        regex:
+          - '.*'
+
+      - type: word
+        words:
+          - "null"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"EKS node group " + nodegroup + " in cluster " + cluster + " does not have remote access configured"'
+# digest: 4a0a0047304502203d6f07c68d09531799f475c104159760b6ff871908abe6318495c472fcf12e75022100d887a58f8de4bf9665e832ed1af966ae0c186a2afe1f1749c1912bba4b308266:922c64590222798bb761d5b6d8e72950

cloud/aws/s3/s3-bucket-policy-public-access.yaml

@@ -27,7 +27,7 @@ code:
       aws s3api list-buckets --query 'Buckets[*].Name'
 
     extractors:
-      - type: json # type of the extractor
+      - type: json
         internal: true
         name: buckets
         json:
@@ -39,21 +39,14 @@ code:
     source: |
       aws s3api get-bucket-policy --bucket $bucket --query Policy --output text
 
-    matchers-condition: and
     matchers:
-      - type: word
+      - type: regex
         part: body
-        words:
-          - '"Effect":"Allow"'
-
-      - type: word
-        part: body
-        words:
-          - '"Principal":"*"'
-          - '"AWS":"*"'
+        regex:
+          - '\{[^}]*?(?:(?:"Effect"\s*:\s*"Allow"[^}]*?"Principal"\s*:\s*(?:"\*"|\{\s*"AWS"\s*:\s*"\*"\s*\}))|(?:"Principal"\s*:\s*(?:"\*"|\{\s*"AWS"\s*:\s*"\*"\s*\})[^}]*?"Effect"\s*:\s*"Allow"))[^}]*?\}'
 
     extractors:
       - type: dsl
         dsl:
           - '"The S3 bucket " + bucket +" is publicly accessible via Policy"'
-# digest: 4a0a00473045022100c62712d0155b3a6ab8cad4c8d7a87284079288e840855539a4186055949e17f2022061849f7af633798a71f6769172339151da4f05799827c15cc680ee59bfbbf55d:922c64590222798bb761d5b6d8e72950
+# digest: 4a0a0047304502204aa1c0bf7c39ed575786813f4442686d138c58747766d33101948713281ac9610221008b7dc698b16415a2e1262b4bf9da7afda5e909f72df76d03d403dab9b8f1d479:922c64590222798bb761d5b6d8e72950

cloud/azure/activedirectory/azure-mfa-not-enabled-privileged-users.yaml

@@ -11,11 +11,14 @@ info:
     Configure Multi-Factor Authentication for all privileged Azure user accounts to enhance security measures and prevent unauthorized access.
   reference:
     - https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
-  tags: cloud,devops,azure,microsoft,multi-factor-authentication,azure-cloud-config
+    - https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
+    - https://docs.microsoft.com/en-us/graph/api/resources/authenticationmethods-overview
+    - https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
+  tags: cloud,devops,azure,microsoft,azure-cloud-config,graph-api
 
 flow: |
   code(1);
-  for (let User of iterate(template.userList)) {
+  for (let User of iterate(template.noMfaUsers)) {
     set("userPrincipalName", User);
     code(2);
   }
@@ -26,14 +29,14 @@ code:
       - sh
       - bash
     source: |
-      az ad user list --query '[].{userPrincipalName:userPrincipalName}' --output json
+      az rest --method GET --uri 'https://graph.microsoft.com/v1.0/reports/authenticationMethods/userRegistrationDetails' --query "value[?isMfaRegistered==\`false\`].userPrincipalName"
 
     extractors:
       - type: json
-        name: userList
+        name: noMfaUsers
         internal: true
         json:
-          - '.[].userPrincipalName'
+          - '.[]'
 
   - engine:
       - sh
@@ -41,16 +44,18 @@ code:
     source: |
       az role assignment list --include-classic-administrators true --assignee "$userPrincipalName" --query '[].{roleDefinitionName:roleDefinitionName}' --output json
 
-    matchers-condition: and
     matchers:
       - type: word
         words:
           - 'Owner'
           - 'Contributor'
           - 'Administrator'
+          - 'Reservations Administrator'
+          - 'Role Based Access Control Administrator'
+          - 'User Access Administrator'
 
     extractors:
       - type: dsl
         dsl:
-          - 'userPrincipalName + " is a privileged user without MFA enabled"'
-# digest: 4b0a00483046022100ac62c7907ff822f9a0d991f1879f25b4f3d62620f5fa20b030547a2ae093979d022100fd488a6bec4367aeac8a65c1fdc2bde66be3041b2e2d323aae3b0559eb92b362:922c64590222798bb761d5b6d8e72950
+          - 'userPrincipalName + " is a privileged user without MFA registered"'
+# digest: 490a0046304402206d892d252940b608a8d53769f5bf92a9e7d8e27b8def2ce6c61ec22771e90cca02200d535c282211d9f17c7d320f585789b370dbc211c6d4a9c6ceb99b3bccbd353c:922c64590222798bb761d5b6d8e72950

cloud/azure/cosmosdb/azure-cosmosdb-default-network-access-unrestricted.yaml

@@ -39,21 +39,15 @@ code:
       - sh
       - bash
     source: |
-      az cosmosdb show --ids $id --query '{"ipRules":ipRules,"isVirtualNetworkFilterEnabled":isVirtualNetworkFilterEnabled}' --output json
+      az cosmosdb show --ids $id --query "{publicNetworkAccess: publicNetworkAccess, virtualNetworkRules: virtualNetworkRules}" --output json
 
-    matchers-condition: and
     matchers:
       - type: word
         words:
-          - '"isVirtualNetworkFilterEnabled": false'
-
-      - type: word
-        words:
-          - '"ipRules": []'
-          - '"ipRules": null'
+          - '"publicNetworkAccess": "Enabled"'
 
     extractors:
       - type: dsl
         dsl:
           - 'id + " is unrestricted with default network access"'
-# digest: 4a0a00473045022100cb26538e8bb7b97b94d92971d4e07f524f8f431339a982d078f398a65314724902201a2efdf52b03527c0d8f1a9c4816e041ec52fb0b74bf63e8481dfc0a679f9d4c:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402201b52806f47e1c0a2e8267269a5aef2f8cd84daf085c320160c0a22c9a32f16b902204f6da44a563362ae4fc20de0be0cbbe1e4412896d6149e06a8aa4a3928ad124c:922c64590222798bb761d5b6d8e72950

cloud/azure/keyvault/azure-keyvault-network-unrestricted.yaml

@@ -39,16 +39,16 @@ code:
       - sh
       - bash
     source: |
-      az keyvault show --name $vaultName --query 'properties.networkAcls.defaultAction' --output json
+      az keyvault show --name $vaultName --query 'properties.publicNetworkAccess' --output tsv
 
     matchers:
       - type: word
         words:
-          - '"Allow"'
+          - 'Enabled'
           - ''
 
     extractors:
       - type: dsl
         dsl:
           - 'vaultName + " is configured to allow unrestricted Key Vault network access"'
-# digest: 4a0a0047304502200a69471e0adb1de1ded0fd0dc5901d9ded2c25d65574c1b574e409c7bcba70da022100c4c62e0af8d1d317784ff35df3d35c7558b6a83155a6a73a92f868a6073a8adc:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402202235e2154b8f07704fc4c2d1c908bfa81bed50c8e1e810045f98dfde26b1ecd6022079a2551d6e4708fab8d25470394d4e9389b3fa624f2840652adcfc7c8a779b3e:922c64590222798bb761d5b6d8e72950

cloud/azure/storageaccounts/azure-storage-blob-public-access.yaml

@@ -45,10 +45,10 @@ code:
     matchers:
       - type: word
         words:
-          - 'false'
+          - 'true'
 
     extractors:
       - type: dsl
         dsl:
           - 'ids + " has public access enabled"'
-# digest: 4b0a00483046022100f755c16fc63db658362f5f67dfe2c2033a4272b416639726c548fc8895f49c1d022100e57e148fcab6a467515f5983dfe1ddf7f1ba8c73d72f9835c13befe146fffb85:922c64590222798bb761d5b6d8e72950
+# digest: 490a0046304402200a4647bd2fcbf10578588b6759a03e7c950b6dd1097956c795e10ed117bdc765022051b5ccfe57bd9dbe49c43aba85f04b56ed99c6b7e1636cac6faeb80ba691dc7d:922c64590222798bb761d5b6d8e72950

cloud/azure/storageaccounts/azure-storage-cross-tenant-replication-disabled.yaml

@@ -42,14 +42,13 @@ code:
     source: |
       az storage account show --name "$name" --query 'allowCrossTenantReplication'
 
-    matchers-condition: and
     matchers:
       - type: word
         words:
-          - 'false'
+          - 'true'
 
     extractors:
       - type: dsl
         dsl:
           - '"Cross-Tenant Replication is enabled for " + name + ", posing a security risk"'
-# digest: 490a00463044022000ae1a04ecda351a200bbc28099b9ddca8bbaa6f20579cde6d31ae404b97227d02206c5b1363ed1c0f656c4a4d219af389035dbfe84597b4a1d3842a4f076a5e49ff:922c64590222798bb761d5b6d8e72950
+# digest: 4b0a00483046022100ef0f1360870fe2845c40b84a1de7171a6612e371a0176675ced7d4fda7a1c4b5022100815143249c65ce85f872d8dd949c933cbb762d39fcf3e6bde403920f9c5aee75:922c64590222798bb761d5b6d8e72950

cloud/gcp/api/gcloud-api-key-restrictions-missing.yaml

@@ -0,0 +1,73 @@
+id: gcloud-api-key-restrictions-missing
+
+info:
+  name: Missing API Key API Restrictions
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that the usage of your Google Cloud API keys is restricted to specific APIs such as Cloud Key Management Service (KMS) API, Cloud Storage API, Cloud Monitoring API, and Cloud Logging API. All Google Cloud API keys that are being used for production applications should use API restrictions.
+  impact: |
+    API keys without specific API restrictions can be used to access any GCP API, potentially leading to unauthorized access and misuse of resources. Implementing API restrictions helps in limiting the scope of API keys to intended services only.
+  remediation: |
+    Apply API restrictions to each Google Cloud API key to limit their usage to specific APIs. This can be managed through the Google Cloud Console or using the gcloud command-line tool.
+  reference:
+    - https://cloud.google.com/api-keys/docs/restricting-api-keys
+  tags: cloud,devops,gcp,gcloud,api-keys,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let apiKey of iterate(template.apiKeys)){
+      set("apiKeyUid", apiKey)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud alpha services api-keys list --project=$projectId --format="json(uid)"
+
+    extractors:
+      - type: json
+        name: apiKeys
+        internal: true
+        json:
+          - '.[].uid'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud alpha services api-keys describe $apiKeyUid --format="json(restrictions)"
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Unrestricted API Key: " + apiKeyUid + " in Project: " + projectId'
+# digest: 4b0a00483046022100b6b2f16aaed30fbe7cf6f76b17cd99ebb5394c3f78c791dd66de6d10bdbab3ab022100858dcb4e5f0139b7c9e1431d7318a4ddf89998fb7cc475285f14c0c5fb3819a0:922c64590222798bb761d5b6d8e72950

cloud/gcp/api/gcloud-api-key-unrestricted.yaml

@@ -0,0 +1,72 @@
+id: gcloud-api-key-unrestricted
+
+info:
+  name: Unrestricted API Key Usage
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that the use of Google Cloud API keys is limited to trusted and reliable hosts, HTTP referrers, or applications. An API key application restriction manages the authorization of websites, IP addresses, or Android/iOS mobile applications that can employ your API key. It is crucial that all API keys used in production employ host and application restrictions. By enforcing these restrictions, you can reduce the impact that a compromised API key can have on your applications.
+  impact: |
+    API keys without restrictions can be used unrestrictedly, which might lead to unauthorized access and misuse, potentially exposing sensitive data or services.
+  remediation: |
+    Apply restrictions to all production API keys to specify the allowed websites, IP addresses, or mobile applications that can use each key, to mitigate potential abuse.
+  reference:
+    - https://cloud.google.com/docs/authentication/api-keys#restricting_api_keys
+  tags: cloud,devops,gcp,gcloud,api-keys,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let uid of iterate(template.uids)){
+      set("uid", uid)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud alpha services api-keys list --project $projectId --format="json(uid)"
+
+    extractors:
+      - type: json
+        name: uids
+        internal: true
+        json:
+          - '.[].uid'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud alpha services api-keys describe $uid --format="json(restrictions)"
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Unrestricted API Key: " + uid + " in Project: " + projectId'
+# digest: 4a0a00473045022100d1751d133cbe1cb508355fb6acc6fb0d51094a8c42db864114772bfce2fd382a022022cb36fbfcf3f8b8ef22cd8a428104f85035cc421437b2e735f221396b39c224:922c64590222798bb761d5b6d8e72950

cloud/gcp/api/gcloud-api-keys-inactive-services.yaml

@@ -0,0 +1,61 @@
+id: gcloud-api-keys-inactive-services
+
+info:
+  name: API Keys Should Only Exist for Active Services
+  author: princechaddha
+  severity: low
+  description: |
+    Ensure that your Google Cloud projects are using the standard authentication flow as the preferred method for authentication, rather than relying on API keys. API keys are simple encrypted strings that can be used when calling certain APIs which don't need to access private user data. API keys should be exclusively employed for active services when alternative authentication methods are not accessible, otherwise deleted.
+  impact: |
+    Using API keys for inactive services can expose your applications to unnecessary security risks. It is advisable to employ standard authentication methods and ensure that API keys are used judiciously and only for active services.
+  remediation: |
+    Review and ensure that API keys are only configured for active services. Delete or disable API keys associated with inactive or unnecessary services to minimize security risks.
+  reference:
+    - https://cloud.google.com/docs/authentication/api-keys
+  tags: cloud,devops,gcp,gcloud,api-keys,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud alpha services api-keys list --project=$projectId --format="json(uid)"
+
+    matchers:
+      - type: word
+        words:
+          - 'uid'
+
+    extractors:
+      - type: json
+        name: uid
+        internal: true
+        json:
+          - '.[].uid'
+
+      - type: dsl
+        dsl:
+          - '"Inactive API Key found: UID: " + uid + " in Project: " + projectId'
+# digest: 490a0046304402207d9636d01e08f534fa218db024859e2229a20f9545b6dda783fb652284e64785022049b4893759d0e724f60c748db1d8d00f7499c3830638f2d6d16bdd41043ee5e9:922c64590222798bb761d5b6d8e72950

cloud/gcp/api/gcloud-critical-service-apis-disabled.yaml

@@ -0,0 +1,54 @@
+id: gcloud-critical-service-apis-disabled
+
+info:
+  name: Critical Service APIs Not Enabled
+  author: princechaddha
+  severity: critical
+  description: |
+    Ensure that critical service APIs are enabled for your GCP projects to gain access to essential functionalities and services provided by Google Cloud Platform (GCP), manage your project resources efficiently, enhance the security of your cloud environment, and track your usage and billing. The critical service APIs include, but are not limited to, Identity and Access Management (IAM) API, Compute Engine API, Cloud Storage, Google Cloud Pub/Sub API, Cloud Key Management Service (KMS) API, and Cloud Logging API.
+  impact: |
+    Disabling critical service APIs can prevent the proper management and security of GCP resources, potentially leading to service disruptions or compromised security.
+  remediation: |
+    Enable the necessary service APIs via the GCP Console or the gcloud command-line tool for each project where they are found to be disabled.
+  reference:
+    - https://cloud.google.com/service-usage/docs/enable-disable
+  tags: cloud,devops,gcp,gcloud,api-management,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud services list --project $projectId --enabled --filter=name:iam.googleapis.com --format="json" | jq '.'
+
+    matchers:
+      - type: word
+        words:
+          - '[]'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Critical API not enabled: IAM API in Project: " + projectId'
+# digest: 4a0a004730450221008a33e85deb35cb7e682c6875bd120be993c3a552deaa4cd2831b5531d9efe550022013a2421e83defe9ea15eb71ffe62daaabb0dca6395e27b06449c3c81f7a43abe:922c64590222798bb761d5b6d8e72950

cloud/gcp/api/gcloud-security-center-api-disabled.yaml

@@ -0,0 +1,55 @@
+id: gcloud-security-center-api-disabled
+
+info:
+  name: Security Command Center API Disabled
+  author: princechaddha
+  severity: high
+  description: |
+    To access historical security findings and asset data in Security Command Center, ensure that the Security Command Center API is enabled within your Google Cloud account. If the API is not enabled, certain security features and monitoring capabilities will be unavailable.
+  impact: |
+    Disabling the Security Command Center API may limit visibility and control over security threats, leading to potential vulnerabilities and undetected risks within Google Cloud environments.
+  remediation: |
+    Enable the Security Command Center API for each Google Cloud project to maintain proper security monitoring and threat detection capabilities. This can be done through the Google Cloud Console or using the `gcloud services enable securitycenter.googleapis.com` command.
+  reference:
+    - https://cloud.google.com/security-command-center/docs/reference/rest
+  tags: cloud,devops,gcp,gcloud,security-center,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud services list --project $projectId --enabled --filter="name:securitycenter.googleapis.com" --format="json"
+
+    matchers:
+      - type: word
+        words:
+          - '[]'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Security Command Center API is not enabled in Project: " + projectId'
+# digest: 490a0046304402205fea2a2e299a52eb546969bd6614f8700c6998c55466aa365d9ccd4075587d6b02204484e1f2e8d8006c0a73a607a0b0b2d522950ab551a33fe17e1cb27e565996e0:922c64590222798bb761d5b6d8e72950

cloud/gcp/api/gcloud-vm-os-config-disabled.yaml

@@ -0,0 +1,55 @@
+id: gcloud-cloud-asset-disabled
+
+info:
+  name: Cloud Asset Inventory Not Enabled
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that Cloud Asset Inventory is enabled for all your GCP projects in order to efficiently manage the history and the inventory of your cloud resources. Google Cloud Asset Inventory is a fully managed metadata inventory service that allows you to view, monitor, analyze, and gain insights for your Google Cloud and Anthos assets. Cloud Asset Inventory is disabled by default in each GCP project.
+  impact: |
+    Not having Cloud Asset Inventory enabled can prevent the organization from having a managed and insightful view over its cloud resources, potentially leading to mismanagement and security risks.
+  remediation: |
+    Enable the Google Cloud Asset Inventory by activating the Cloud Asset API in each GCP project through the Google Cloud Console or using the `gcloud services enable cloudasset.googleapis.com --project <project-id>` command.
+  reference:
+    - https://cloud.google.com/asset-inventory/docs
+  tags: cloud,devops,gcp,gcloud,cloud-asset,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud services list --project $projectId --enabled --filter="name:cloudasset.googleapis.com" --format="json"
+
+    matchers:
+      - type: word
+        words:
+          - '[]'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"OS Config service is disabled for Project: " + projectId'
+# digest: 4a0a00473045022100c28adedbeb559d545dc0eca6cf3a0004844111370c7d0ede7af66abdff49dcb902204355d8cd6f1790b8802945e4337dff422ab941931047a7e12a390868e7a71b09:922c64590222798bb761d5b6d8e72950

cloud/gcp/artifactregistry/gcloud-artifact-registry-public.yaml

@@ -0,0 +1,74 @@
+id: gcloud-artifact-registry-public
+
+info:
+  name: Publicly Accessible Artifact Registry Repositories
+  author: princechaddha
+  severity: high
+  description: |
+    Identify any publicly accessible Artifact Registry repositories within your Google Cloud account and update their IAM policy in order to protect against unauthorized access. To deny access from anonymous and public users, remove the bindings for "allUsers" and "allAuthenticatedUsers" members from the IAM policy associated with your repository.
+  impact: |
+    Public accessibility of Artifact Registry repositories can lead to unauthorized data access or data leaks. Restricting access ensures that only authorized entities can view or manipulate the repositories.
+  remediation: |
+    Update the IAM policies for each Artifact Registry repository to remove "allUsers" and "allAuthenticatedUsers". This action will ensure that repositories are not exposed to any user on the internet or authenticated users not explicitly granted permission.
+  reference:
+    - https://cloud.google.com/artifact-registry/docs/managing/access-control
+  tags: cloud,devops,gcp,gcloud,artifact-registry,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let repository of iterate(template.repositories)){
+      set("repositoryName", repository)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud artifacts repositories list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: repositories
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud artifacts repositories get-iam-policy $repositoryName --project $projectId --format=json | jq '.bindings[].members[]'
+
+    matchers:
+      - type: word
+        words:
+          - 'allUsers'
+          - 'allAuthenticatedUsers'
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Publicly Accessible Artifact Repository: " + repositoryName + " in Project: " + projectId'
+# digest: 490a00463044022026de167568a630dd6a523997aa3e223e803d9c8e54f7425f71caf8c2e8dfb9e102201af5d1224515cbec4b09f8c167c0e1094aa807fd72b894a27c294228357e1ce6:922c64590222798bb761d5b6d8e72950

cloud/gcp/artifactregistry/gcloud-vuln-scan-missing.yaml

@@ -0,0 +1,59 @@
+id: gcloud-vuln-scan-missing
+
+info:
+  name: Artifact Registry Vulnerability Scanning Not Enabled
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that vulnerability scanning for Google Cloud Artifact Registry repositories is enabled in order to find security weaknesses in your container images before deploying them and help prevent security breaches.
+  impact: |
+    Disabling vulnerability scanning on Artifact Registry repositories can expose your deployment to undiscovered security vulnerabilities, increasing the risk of security breaches.
+  remediation: |
+    Enable the Container Scanning API for each Artifact Registry by visiting the API & services page in the Google Cloud Console and enabling `containerscanning.googleapis.com`.
+  reference:
+    - https://cloud.google.com/artifact-registry/docs/vulnerability-scanning
+  tags: cloud,devops,gcp,gcloud,artifact-registry,container-scanning,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud services list --enabled --project $projectId --format="json(config.name)"
+
+    matchers:
+      - type: word
+        words:
+          - 'containerscanning.googleapis.com'
+        negative: true
+
+      - type: word
+        words:
+          - '"config":'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Vulnerability Scanning not enabled for Artifact Registry in Project: " + projectId'
+# digest: 4a0a004730450221009fddff36e3531876ec8020199fd3d82830417f005b705281b2382f4415a1a2750220507b9a58b4acc754e098c9bfad7d61ec238a0e4d4069632fb08eea3891c320ab:922c64590222798bb761d5b6d8e72950

cloud/gcp/bigquery/gcloud-bigquery-cmek-not-enabled.yaml

@@ -0,0 +1,71 @@
+id: gcloud-bigquery-cmek-not-enabled
+
+info:
+  name: BigQuery Dataset Encryption with Customer-Managed Encryption Keys Not Enabled
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that all your Google Cloud BigQuery datasets are encrypted using Customer-Managed Encryption Keys (CMEKs) in order to have a more granular control over the dataset encryption/decryption process. Datasets not encrypted with CMEKs may expose sensitive data to higher risks.
+  impact: |
+    Using Google-managed keys for dataset encryption limits control over the encryption process and may not meet compliance requirements that specify encryption key management policies.
+  remediation: |
+    Update the encryption configuration of your BigQuery datasets to use Customer-Managed Encryption Keys. This can be done by setting the 'defaultEncryptionConfiguration' property of each dataset to use a 'kmsKeyName' that you manage.
+  reference:
+    - https://cloud.google.com/bigquery/docs/customer-managed-encryption
+  tags: cloud,devops,gcp,gcloud,bigquery,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let dataset of iterate(template.datasets)){
+      set("datasetId", dataset)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      bq ls --project_id $projectId --format="prettyjson"
+
+    extractors:
+      - type: json
+        name: datasets
+        internal: true
+        json:
+          - '.[] | .datasetReference.datasetId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      bq show --format=prettyjson $projectId:$datasetId | jq '.defaultEncryptionConfiguration.kmsKeyName'
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Dataset without CMEK: " + datasetId + " in Project: " + projectId'
+# digest: 4a0a004730450221009a940bc0e74b624a666bd31616a1c6271401d731875ab33a0da908d016dc5805022053028b9e545d9edddb5d9c5323ce52dc26a2baf3b756ce0086c36036eb1ed54e:922c64590222798bb761d5b6d8e72950

cloud/gcp/bigquery/gcloud-bigquery-cmk-not-enabled.yaml

@@ -0,0 +1,89 @@
+id: gcloud-bigquery-cmk-not-enabled
+
+info:
+  name: BigQuery Datasets Not Encrypted with Customer-Managed Keys
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that the tables created for your Google Cloud BigQuery datasets are encrypted with Customer-Managed Keys (CMKs) to have more granular control over the data encryption/decryption process. Using CMKs allows you to create, rotate, manage, and destroy your own encryption keys using Google Cloud Key Management Service (Cloud KMS).
+  impact: |
+    If BigQuery dataset tables are not encrypted using CMKs, it limits the control over data encryption and decryption, increasing the risk of unauthorized data access.
+  remediation: |
+    Configure BigQuery dataset tables to use Customer-Managed Keys (CMKs) for encryption. This can be done in the dataset settings where you specify the encryption key managed in Google Cloud KMS.
+  reference:
+    - https://cloud.google.com/bigquery/docs/encryption-customer-managed-keys
+  tags: cloud,devops,gcp,gcloud,bigquery,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let dataset of iterate(template.datasets)){
+      set("datasetId", dataset)
+      code(3)
+      for(let table of iterate(template.tables)){
+        set("tableName", table)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      bq ls --format=prettyjson --project_id $projectId
+
+    extractors:
+      - type: json
+        name: datasets
+        internal: true
+        json:
+          - '.[].datasetReference.datasetId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      bq ls --format=prettyjson --project_id $projectId --dataset_id $datasetId
+
+    extractors:
+      - type: json
+        name: tables
+        internal: true
+        json:
+          - '.[].tableId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      bq show --format=prettyjson $projectId:$datasetId.$tableName | jq '.encryptionConfiguration.encryptionType'
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Table Not Encrypted with CMK: " + tableName + " in Dataset: " + datasetId + " of Project: " + projectId'
+# digest: 4a0a00473045022100d0aae04454fade0847368986e22e385a6cb6eb1103e6c80d2e46201c7272760e0220564730acd22e8d0e07db2ade095020b69593279d3a9e5ad5b9648251b4544499:922c64590222798bb761d5b6d8e72950

cloud/gcp/bigquery/gcloud-bigquery-public-datasets.yaml

@@ -0,0 +1,75 @@
+id: gcloud-bigquery-public-datasets
+
+info:
+  name: Publicly Accessible BigQuery Datasets
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure there are no anonymously and/or publicly accessible BigQuery datasets available within your Google Cloud Platform (GCP) account. Google Cloud BigQuery datasets have Identity and Access Management (IAM) policies configured to determine who can have access to these resources. To refuse access from anonymous and public users, remove the bindings for "allUsers" and "allAuthenticatedUsers" members from the IAM policy associated with your datasets.
+  impact: |
+    Publicly accessible BigQuery datasets can lead to unauthorized data access or data leaks. Ensuring that access is restricted helps maintain the integrity and confidentiality of your data.
+  remediation: |
+    Update the IAM policies for each BigQuery dataset to remove "allUsers" and "allAuthenticatedUsers". This action will ensure that datasets are not exposed to any user on the internet or authenticated users not explicitly granted permission.
+  reference:
+    - https://cloud.google.com/bigquery/docs/managing-dataset-access
+  tags: cloud,devops,gcp,gcloud,bigquery,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let datasetId of iterate(template.datasetIds)){
+      set("datasetId", datasetId)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      bq ls --project_id $projectId --format=json
+
+    extractors:
+      - type: json
+        name: datasetIds
+        internal: true
+        json:
+          - '.[].datasetId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      bq show --format=prettyjson $projectId:$datasetId | jq '.access[] | select(.role != null and (.specialGroup == "allUsers" or .specialGroup == "allAuthenticatedUsers")) | .role'
+
+    matchers:
+      - type: word
+        words:
+          - 'roles/bigquery.dataViewer'
+          - 'roles/bigquery.dataEditor'
+          - 'roles/bigquery.dataOwner'
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Publicly Accessible BigQuery Dataset: " + datasetId + " in Project: " + projectId'
+# digest: 490a004630440220244f74cd6bc6aa70ae3f127aab2e43cee539141d4eaf7c460ba11126ce1d46ed02202d883b802f8d9610b05efe7ff9d09e24acde57969de692f527722f4cf7f7de53:922c64590222798bb761d5b6d8e72950

cloud/gcp/cdn/gcloud-backend-bucket-missing-storage.yaml

@@ -0,0 +1,89 @@
+id: gcloud-backend-bucket-missing-storage
+
+info:
+  name: Backend Buckets Referencing Missing Storage Buckets
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Cloud CDN backend buckets are referencing existing storage buckets in order to be able to deliver static content efficiently from the nearest edge location to users, reducing latency and improving performance.
+  impact: |
+    Referencing missing storage buckets can lead to a failure in content delivery, increased latency, and a poor user experience.
+  remediation: |
+    Verify that each backend bucket is referencing an existing storage bucket. Update the Cloud CDN backend bucket configuration to point to valid and existing storage buckets.
+  reference:
+    - https://cloud.google.com/cdn/docs/backends
+  tags: cloud,devops,gcp,gcloud,cdn,cloud-cdn,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let urlMap of iterate(template.urlMaps)){
+      set("urlMapName", urlMap)
+      code(3)
+      for(let backendBucket of iterate(template.backendBuckets)){
+        set("backendBucketName", backendBucket)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute url-maps list --project $projectId --format="json(name,defaultService)"
+
+    extractors:
+      - type: json
+        name: urlMaps
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute backend-buckets describe $backendBucket --project $projectId --format="json(bucketName)"
+
+    extractors:
+      - type: json
+        name: backendBuckets
+        internal: true
+        json:
+          - '.bucketName'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud storage buckets describe gs://$backendBucket --project $projectId
+
+    matchers:
+      - type: word
+        words:
+          - "404"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Missing Storage Bucket for Backend Bucket: " + backendBucketName + " in URL Map: " + urlMapName + " of Project: " + projectId'
+# digest: 490a0046304402200355352b429e76a66451d939e03a1c0176ce597104577c63526d81f01df76f9d022020fdd9dd953445d97ee9c8bd8261109a157494c1e29cce407fb36af3d30856da:922c64590222798bb761d5b6d8e72950

cloud/gcp/cdn/gcloud-cdn-backend-bucket.yaml

@@ -0,0 +1,54 @@
+id: gcloud-cdn-backend-bucket
+
+info:
+  name: Check Cloud CDN Backend Bucket Configuration
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that the Cloud CDN origin associated with your Google Cloud load balancer points to a backend bucket instead of a backend service in order to provide enhanced performance, cost savings, simplified management, and the ability to customize caching rules.
+  impact: |
+    Using a backend service as the Cloud CDN origin instead of a backend bucket may lead to increased costs, complex management, and suboptimal caching configurations, impacting performance and operational efficiency.
+  remediation: |
+    Reconfigure the Cloud CDN origin to point to a backend bucket instead of a backend service by modifying the associated Google Cloud load balancer's URL map.
+  reference:
+    - https://cloud.google.com/cdn/docs/using-cdn
+  tags: cloud,devops,gcp,gcloud,cloud-cdn,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute url-maps list --project $projectId --format="json(name,defaultService)"
+
+    matchers:
+      - type: word
+        words:
+          - 'backendServices'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Load Balancers in Project: " + projectId + " uses a backend service as CDN origin instead of a backend bucket."'
+# digest: 4a0a0047304502200197e46380e5047ec5f6ff8714252ccd6a158436a5e0d048b2fd5f1c6a3b7caf022100a6a99e00284a5397987cc1ecc6ddc2f3837637e6ab68123452638e924e14eeb3:922c64590222798bb761d5b6d8e72950

cloud/gcp/cdn/gcloud-cdn-origin-auth-unconfigured.yaml

@@ -0,0 +1,72 @@
+id: gcloud-cdn-origin-auth-unconfigured
+
+info:
+  name: Unconfigured Cloud CDN Origin Authentication
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Cloud CDN origins are configured to authenticate access to the content available at backend (backend buckets or backend services) using signed cookies and signed URLs. Signed cookies and URLs are designed to prevent unauthorized users from bypassing the authentication process and accessing sensitive information.
+  impact: |
+    If Cloud CDN origins are not properly configured with signed cookies and signed URLs, it could lead to unauthorized access and potential exposure of sensitive information. This configuration is essential for maintaining the security and integrity of content delivery.
+  remediation: |
+    Configure your Cloud CDN origins to use signed cookies and URLs by adding signed request keys to your backend services. This will enforce authentication on CDN-cached content, preventing unauthorized access.
+  reference:
+    - https://cloud.google.com/cdn/docs/using-signed-urls
+  tags: cloud,devops,gcp,gcloud,cloud-cdn,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let backendService of iterate(template.backendServices)){
+      set("backendServiceName", backendService)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute backend-services list --global --project $projectId --format="json(name,enableCDN)"
+
+    extractors:
+      - type: json
+        name: backendServices
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute backend-services describe $backendServiceName --global --format="json(cdnPolicy.signedUrlKeyNames)"
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Unconfigured Cloud CDN Origin Authentication: " + backendServiceName + " in Project: " + projectId'
+# digest: 4a0a00473045022019bda07807eb922316b8d39af34b048276477aa10516e5f33bdd63513d0283ab022100add40bcc817cd9335b7b92320421beb717427a50977069b0b7411e8ae3afdd8b:922c64590222798bb761d5b6d8e72950

cloud/gcp/cdn/gcloud-cdn-ssl-enforcement.yaml

@@ -0,0 +1,90 @@
+id: gcloud-cdn-ssl-enforcement
+
+info:
+  name: Cloud CDN SSL/TLS Not Enforced
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Google Cloud CDN backend bucket origins enforce HTTPS using SSL/TLS certificates in order to handle encrypted traffic. This helps to protect the integrity and confidentiality of the transmitted information.
+  impact: |
+    Not enforcing HTTPS can expose data to interception or alteration during transmission, compromising data confidentiality and integrity.
+  remediation: |
+    Configure SSL/TLS certificates for Cloud CDN backend bucket origins and ensure all traffic is served over HTTPS by adjusting the forwarding rules and url-maps.
+  reference:
+    - https://cloud.google.com/cdn/docs/using-https
+  tags: cloud,devops,gcp,gcloud,cloud-cdn,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let urlMap of iterate(template.urlMaps)){
+      set("urlMapName", urlMap.name)
+      set("defaultService", urlMap.defaultService)
+      code(3)
+      for(let forwardingRule of iterate(template.forwardingRules)){
+        set("forwardingRuleName", forwardingRule)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute url-maps list --project $projectId --format="json(name,defaultService)"
+
+    extractors:
+      - type: json
+        name: urlMaps
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute forwarding-rules list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: forwardingRules
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute forwarding-rules describe $forwardingRuleName --project $projectId --global --format="value(portRange)"
+
+    matchers:
+      - type: word
+        words:
+          - '80-80'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"SSL/TLS not enforced on Cloud CDN backend bucket origin: " + defaultService + " via URL map: " + urlMapName + " in Project: " + projectId'
+# digest: 4a0a0047304502200ba02ce144420070756cbf207f65eed69dce4d8fa833b734d7062c42174dca2f022100faca1ece34716d82c0c693eb741dc4c9589c8d88697c9ac5ca29b8f08c0d090a:922c64590222798bb761d5b6d8e72950

cloud/gcp/cdn/gcloud-cdn-tls-unenforced.yaml

@@ -0,0 +1,86 @@
+id: gcloud-cdn-tls-unenforced
+
+info:
+  name: Unenforced SSL/TLS on Cloud CDN Backend Service Origins
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Google Cloud CDN backend service origins are using SSL/TLS certificates to enforce HTTPS in order to manage encrypted traffic. This helps to protect the integrity and confidentiality of the transmitted information.
+  impact: |
+    If SSL/TLS certificates are not enforced, the integrity and confidentiality of the transmitted information through Cloud CDN can be compromised, leading to potential data leaks and security breaches.
+  remediation: |
+    Configure SSL/TLS certificates for your Cloud CDN backend service origins to enforce HTTPS and ensure that all communications are securely encrypted.
+  reference:
+    - https://cloud.google.com/cdn/docs/using-https
+  tags: cloud,devops,gcp,gcloud,cloud-cdn,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let service of iterate(template.services)){
+      set("serviceName", service)
+      code(3)
+      code(4)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute url-maps list --project $projectId --format="json(name,defaultService)"
+
+    extractors:
+      - type: json
+        name: services
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute forwarding-rules list --project $projectId
+
+    extractors:
+      - type: json
+        name: forwardingRules
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute forwarding-rules describe $forwardingRules --global --format="value(portRange)"
+
+    matchers:
+      - type: word
+        words:
+          - '80-80'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"HTTP traffic allowed without SSL/TLS on service: " + serviceName + " in Project: " + projectId'
+# digest: 490a0046304402201816c5925b439d4d82d194b0fb552913beb2e0db771ff47d6958979005d5ba7d022062305cca30ff33b8ea930373bac7689f188531b66aa798ad08af6e62eb6b6f11:922c64590222798bb761d5b6d8e72950

cloud/gcp/certificatemanager/gcloud-certificate-validity-exceeded.yaml

@@ -0,0 +1,72 @@
+id: gcloud-certificate-validity-exceeded
+
+info:
+  name: Exceeded SSL Certificate Validity Period
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that SSL certificates managed with Google Cloud Certificate Manager don't have a validity period greater than 398 days (13 months). This is to enhance security by reducing the risk of certificate compromise and misuse, while aligning with industry standards and support from modern web browsers.
+  impact: |
+    An SSL certificate with a validity period exceeding 398 days poses a higher risk of compromise and misuse. It also fails to comply with industry standards, potentially leading to incompatibilities or security warnings in web browsers.
+  remediation: |
+    Review and adjust the renewal configurations for SSL certificates to ensure their validity periods do not exceed 398 days.
+  reference:
+    - https://cloud.google.com/certificate-manager/docs
+  tags: cloud,devops,gcp,gcloud,certificate-manager,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let certificate of iterate(template.certificates)){
+      set("certificateName", certificate)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud certificate-manager certificates list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: certificates
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud certificate-manager certificates describe $certificateName --project $projectId --format="json(createTime,expireTime)" | jq '[(.expireTime | fromdateiso8601) - (.createTime | fromdateiso8601) < 34444800] | any'
+
+    matchers:
+      - type: word
+        words:
+          - 'false'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Non-compliant SSL Certificate: " + certificateName + " in Project: " + projectId + " with Expiry beyond 398 days"'
+# digest: 490a004630440220249ea895515d2fc98d8c0890a791e1ab9758411dd16248ba4da5dc9379dba072022034c8195a381830f12737dbc03be0daf4756d73906fb9e9a50a117c8349cee3bf:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-disk-image-public-access.yaml

@@ -0,0 +1,74 @@
+id: gcloud-disk-image-public-access
+
+info:
+  name: Disk Images Publicly Shared
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your virtual machine disk images are not publicly shared with all other Google Cloud Platform (GCP) accounts in order to avoid exposing sensitive or confidential data. If required, you can share your disk images with specific GCP accounts only, without making them public.
+  impact: |
+    Publicly shared disk images can expose sensitive application data and configurations to anyone with a Google Cloud account, potentially leading to security breaches.
+  remediation: |
+    Remove the "allAuthenticatedUsers" member from the IAM policy of affected disk images using the 'gcloud compute images remove-iam-policy-binding' command or through the Google Cloud Console.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/publicly-shared-disk-images.html
+    - https://cloud.google.com/compute/docs/images/managing-access-custom-images
+  tags: cloud,devops,gcp,gcloud,compute,security,storage,disk-images,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let image of iterate(template.images)){
+      image = JSON.parse(image)
+      set("imageName", image.name)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute images list --project $projectId --no-standard-images --format="json(name)"
+
+    extractors:
+      - type: json
+        name: images
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute images get-iam-policy $imageName --project $projectId --format="json(bindings[].members[])"
+
+    matchers:
+      - type: word
+        words:
+          - '"allAuthenticatedUsers"'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Disk image " + imageName + " in project " + projectId + " is publicly shared with all Google Cloud users"'
+# digest: 4a0a0047304502204f5fe6175038d8ae8f9ca04d4526a5b544ff323d1f60083d6a23c8369645a21502210097538dc98d9dc851d60cbc0f2f4c5987dcbb2d045ee56f3af740f364acc6ccc7:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-instance-group-autohealing-disabled.yaml

@@ -0,0 +1,75 @@
+id: gcloud-instance-group-autohealing-disabled
+
+info:
+  name: Instance Group Autohealing Not Enabled
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Google Cloud Managed Instance Groups (MIGs) are configured with Autohealing feature. Autohealing allows re-creating virtual machine instances when they become unresponsive. Application-based autohealing improves application availability by relying on a health checking signal that detects application-specific issues such as freezing, crashing, or overloading.
+  impact: |
+    Without autohealing enabled, your application's availability may be compromised as unhealthy instances will not be automatically detected and replaced, potentially leading to service disruptions.
+  remediation: |
+    Enable autohealing for your Managed Instance Groups by configuring a health check that monitors instance health. Configure appropriate check intervals, timeouts, and healthy/unhealthy thresholds based on your application requirements.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-instance-group-autohealing.html
+    - https://cloud.google.com/compute/docs/instance-groups/autohealing-instances
+  tags: cloud,devops,gcp,gcloud,compute,reliability,instance-groups,autohealing,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instanceGroup of iterate(template.instanceGroups)){
+      instanceGroup = JSON.parse(instanceGroup)
+      set("instanceGroupName", instanceGroup.name)
+      set("zone", instanceGroup.location)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instance-groups managed list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: instanceGroups
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instance-groups managed describe $instanceGroupName --zone $zone --format="json(autoHealingPolicies[].healthCheck)" | jq '. // "null"'
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Managed Instance Group " + instanceGroupName + " in zone " + zone + " of project " + projectId + " does not have autohealing enabled"'
+# digest: 4a0a00473045022100f1f5d48a167241054f5967257fafb86b459228cfd238090926b91f415c431fd90220336f1b02c96c823be76fbec9e845159f634cbb6b9468c5e71319a5f9834b4aa5:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-mig-no-load-balancer.yaml

@@ -0,0 +1,74 @@
+id: gcloud-mig-no-load-balancer
+
+info:
+  name: Managed Instance Group Not Using Load Balancer
+  author: princechaddha
+  severity: low
+  description: |
+    Ensure that each Managed Instance Group is using a load balancer to act as an instance group frontend. Google Cloud Managed Instance Groups (MIGs) are groups of virtual machine (VM) instances that you control as a single entity. MIGs support rich features such as autoscaling and autohealing, load balancing, multiple zone coverage, and stateful workloads.
+  impact: |
+    Without a load balancer, traffic is not evenly distributed among instances, potentially leading to poor performance, reduced availability, and inefficient resource utilization.
+  remediation: |
+    Configure a load balancer for your Managed Instance Group by creating a backend service and associating it with your MIG. This ensures even traffic distribution and improved availability.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/mig-load-balancer-check.html
+    - https://cloud.google.com/compute/docs/instance-groups/adding-an-instance-group-to-a-load-balancer
+  tags: cloud,devops,gcp,gcloud,compute,reliability,mig,load-balancer,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instanceGroup of iterate(template.instanceGroups)){
+      set("instanceGroupName", instanceGroup.name)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instance-groups list --project $projectId --only-managed --format="json(name)"
+
+    extractors:
+      - type: json
+        name: instanceGroups
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute backend-services list --project $projectId --format="json(backends[].group)" | grep $instanceGroupName
+
+    matchers:
+      - type: word
+        words:
+          - "name"
+        negative: true
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Managed Instance Group " + instanceGroupName + " in project " + projectId + " is not associated with any load balancer backend service"'
+# digest: 4b0a00483046022100fd07fe7b5044882943a82b02e5f3f8ef7e7d3637ae16e1fac9da1348c033104d022100fc93be04033ba0417bace21359c56a7b8eeb498cf7486a6b8c9b7b60cce1d4e7:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-mig-single-zone.yaml

@@ -0,0 +1,73 @@
+id: gcloud-mig-single-zone
+
+info:
+  name: Managed Instance Group Not Configured for Multiple Zones
+  author: princechaddha
+  severity: low
+  description: |
+    Ensure that Managed Instance Groups (MIGs) are spread across multiple zones within a Google Cloud region for high availability and fault tolerance. Spreading application load across multiple Google Cloud zones with MIGs is crucial for enhancing the availability, resilience, and performance of your application. When you allocate your MIG instances across multiple zones, you can guarantee the continuous availability and functionality of your application even during failures or outages.
+  impact: |
+    Single-zone MIGs are vulnerable to zone-level failures, which could cause complete application downtime. This reduces availability and resilience of your applications.
+  remediation: |
+    Re-create your Managed Instance Groups with multiple zones configuration. Select "Multiple zones" for location, choose a region and desired zones, and set "Target distribution shape" to "Even" for balanced instance distribution.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/mig-multiple-zones.html
+    - https://cloud.google.com/compute/docs/instance-groups/distributing-instances-with-regional-instance-groups
+  tags: cloud,devops,gcp,gcloud,compute,reliability,mig,zones,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instanceGroup of iterate(template.instanceGroups)){
+      set("instanceGroupName", instanceGroup.name)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instance-groups list --project $projectId --only-managed --format="json(name)"
+
+    extractors:
+      - type: json
+        name: instanceGroups
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instance-groups managed describe $instanceGroupName --format="json(distributionPolicy.zones)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Managed Instance Group " + instanceGroupName + " in project " + projectId + " is not configured to run instances across multiple zones"'
+# digest: 4b0a00483046022100f6f5fbd63b6c07b669913549144ae2eb2e9b0680673ccd2da7daf953ddde4fc2022100af56920ce185b9ae06857c9fef77d37a9278cb0b67518f7eb2633b13f0bc80e5:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-oslogin-disabled.yaml

@@ -0,0 +1,96 @@
+id: gcloud-oslogin-disabled
+
+info:
+  name: OS Login Not Enabled for GCP Projects
+  author: princechaddha
+  severity: low
+  description: |
+    Ensure that the OS Login feature is enabled at the Google Cloud Platform (GCP) project level in order to provide you with centralized and automated SSH key pair management. OS Login ensures that SSH keys are mapped with Google Cloud IAM users, facilitating centralized management of SSH access.
+  impact: |
+    Without OS Login enabled, managing SSH access becomes decentralized and complex, making it difficult to handle compromised SSH keys or revoke access for specific users across multiple instances.
+  remediation: |
+    Enable OS Login at the project level by setting the "enable-oslogin" metadata key to "TRUE". Note that enabling OS Login disables metadata-based SSH key configurations on all instances within the project.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-os-login.html
+    - https://cloud.google.com/compute/docs/oslogin
+  tags: cloud,devops,gcp,gcloud,compute,security,ssh,oslogin,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    code(3)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(4)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute project-info describe --project $projectId --format="json(commonInstanceMetadata.items)" | jq '.commonInstanceMetadata.items[]? | select(.key=="enable-oslogin") | .value // "null"'
+
+    matchers:
+      - type: word
+        words:
+          - "FALSE"
+          - "null"
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"OS Login is not enabled at project level for project " + projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(metadata.items)" | jq '.items[]? | select(.key=="enable-oslogin") | .value // "null"'
+
+    matchers:
+      - type: word
+        words:
+          - "FALSE"
+          - "null"
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"OS Login is not enabled for instance " + instanceName + " in zone " + zone + " of project " + projectId'
+# digest: 490a0046304402200645c5e3bb349efa34c33b0df0f765c08f3e6606070dd534685b4387d178b2aa0220495288319a1fed9eb52bab11b609582575ba770d0676ad330a4f5d32cc081fb5:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-persistent-disks-suspended-vms.yaml

@@ -0,0 +1,93 @@
+id: gcloud-persistent-disks-suspended-vms
+
+info:
+  name: Persistent Disks Attached to Suspended Virtual Machines
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that persistent disks are not attached to suspended virtual machine (VM) instances in your Google Cloud environment. Persistent disks attached to suspended VMs continue to incur charges even when the VM is not running, leading to unnecessary costs.
+  impact: |
+    Keeping persistent disks attached to suspended VMs results in ongoing storage charges without active utilization, increasing cloud infrastructure costs unnecessarily.
+  remediation: |
+    Identify and detach persistent disks from suspended VMs, or delete the disks if they are no longer needed to optimize cloud resource costs.
+  reference:
+    - https://cloud.google.com/compute/docs/disks
+  tags: cloud,devops,gcp,gcloud,compute,storage,cost-optimization,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let disk of iterate(template.disks)){
+      disk = JSON.parse(disk)
+      set("diskName", disk.name)
+      set("zone", disk.zone)
+      code(3)
+      for(let instanceUrl of iterate(template.instanceUrls)){
+        set("instanceUrl", instanceUrl)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute disks list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: disks
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute disks describe $diskName --zone $zone --project $projectId --format="json(users[])" | jq -r '.[] // "null"'
+
+    extractors:
+      - type: json
+        name: instanceUrls
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceUrl --zone $zone --project $projectId --format="json(status)"
+
+    matchers:
+      - type: word
+        words:
+          - "SUSPENDED"
+          - "SUSPENDING"
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Persistent disk " + diskName + " is attached to suspended VM instance in zone " + zone + " of project " + projectId'
+# digest: 4a0a004730450221008bfa43d9704681d117af15a9074e4b129945d39e9bc4097d5b36aff8c306391a022002bf2c21d7a6539cb2fc5ee06736e2254f5f773d2888a6780a08e05925edd06a:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-automatic-restart-disabled.yaml

@@ -0,0 +1,75 @@
+id: gcloud-vm-automatic-restart-disabled
+
+info:
+  name: VM Instance Automatic Restart Not Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Google Cloud Compute Engine service restarts automatically your virtual machine instances when they are terminated due to non-user initiated reasons such as maintenance events, hardware, and software failures. The Automatic Restart feature configures the virtual machine restart behavior when an instance crashes or it is terminated by the system.
+  impact: |
+    Without automatic restart enabled, VM instances that crash or are terminated due to system events will not automatically recover, potentially leading to extended service disruptions.
+  remediation: |
+    Enable automatic restart for your VM instances. Note that this behavior does not affect any terminations initiated by the user, such as when the instance is taken offline through a user action like calling sudo shutdown.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-automatic-restart.html
+    - https://cloud.google.com/compute/docs/instances/setting-instance-scheduling-options
+  tags: cloud,devops,gcp,gcloud,compute,reliability,automatic-restart,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(scheduling.automaticRestart)" | jq '. // "false"'
+
+    matchers:
+      - type: word
+        words:
+          - "false"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " does not have automatic restart enabled"'
+# digest: 4b0a00483046022100b4895a6742c95935939c8a32186a178c403d0ce8b848f679bbfb0f90214693d4022100f1c8aa148c2979fe8e8d37c8f0f493b9b56d27b484cdf78a0bd50b8a4350971e:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-confidential-computing-disabled.yaml

@@ -0,0 +1,75 @@
+id: gcloud-vm-confidential-computing-disabled
+
+info:
+  name: VM Instance Confidential Computing Not Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that the Confidential Computing security feature is enabled for your Google Cloud virtual machine (VM) instances in order to add protection to your sensitive data in use by keeping it encrypted in memory and using encryption keys that Google doesn't have access to. Confidential Computing is a breakthrough technology which encrypts data while it is being processed. This technology keeps data encrypted in memory, outside the CPU.
+  impact: |
+    Without Confidential Computing enabled, sensitive data in memory is not encrypted during processing, potentially exposing it to unauthorized access from the infrastructure provider or malicious insiders.
+  remediation: |
+    Re-create your VM instances with Confidential Computing enabled. Note that enabling this feature requires compatible machine types (N2D series) and may change certain instance parameters if they were set to incompatible values.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/confidential-computing.html
+    - https://cloud.google.com/compute/confidential-vm/docs/about-cvm
+  tags: cloud,devops,gcp,gcloud,compute,security,confidential-computing,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(confidentialInstanceConfig.enableConfidentialCompute)" | jq '. // "false"'
+
+    matchers:
+      - type: word
+        words:
+          - "false"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " does not have Confidential Computing enabled"'
+# digest: 490a0046304402204277652a6316b7c1ba855a955b9e21fe2c3dd502964cd78c573b9e99ceba64a802201bc5a857f61491a06437bab550c1b12f9b85c24b714d6f7207652a6c1fce3154:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-default-service-account-full-access.yaml

@@ -0,0 +1,77 @@
+id: gcloud-vm-default-service-account-full-access
+
+info:
+  name: VM Instance Using Default Service Account with Full API Access
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your Google Compute Engine instances are not configured to use the default service account with the Cloud API access scope set to "Allow full access to all Cloud APIs". The principle of least privilege (POLP), also known as the principle of least authority, is the security concept of giving the user/system/service the minimal set of permissions required to successfully perform its tasks.
+  impact: |
+    Using default service accounts with full API access violates the principle of least privilege and could allow compromised instances to make unauthorized API calls to any GCP service.
+  remediation: |
+    Either replace the default service account with a custom one having minimal permissions, or change the access scope to "Allow default access" or "Set access for each API" with only required permissions.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/default-service-accounts-with-full-access-in-use.html
+    - https://cloud.google.com/compute/docs/access/service-accounts
+  tags: cloud,devops,gcp,gcloud,compute,security,iam,service-account,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(serviceAccounts[].email,serviceAccounts[].scopes[])"
+
+    matchers:
+      - type: word
+        words:
+          - "[email protected]"
+          - "https://www.googleapis.com/auth/cloud-platform"
+        condition: and
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " is using the default Compute Engine service account with full API access"'
+# digest: 4a0a0047304502200d7ad4091f6a0ff34060826a1f14902901761a78be4de2737113f701a7e8e639022100e209dcd0cb14413813d204950308de2f7a6e1b116ddb2a54bd332d8ddbfa0c7e:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-default-service-account.yaml

@@ -0,0 +1,75 @@
+id: gcloud-vm-default-service-account
+
+info:
+  name: VM Instance Using Default Service Account
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your Google Compute Engine instances are not configured to use the default Google Cloud service account in order to implement the principle of least privilege (POLP) and secure the access to your cloud resources. The default Compute Engine service account, named <project-number>[email protected], is associated with the Editor role at the project level, which allows read and write access to most Google Cloud Platform (GCP) services.
+  impact: |
+    Using default service accounts with Editor role permissions violates the principle of least privilege and could allow compromised instances to access most GCP services in the project.
+  remediation: |
+    Create a new service account with minimal required permissions and update VM instances to use it instead of the default Compute Engine service account. Note that this requires stopping and restarting the instances.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/default-service-accounts-in-use.html
+    - https://cloud.google.com/compute/docs/access/service-accounts
+  tags: cloud,devops,gcp,gcloud,compute,security,iam,service-account,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(serviceAccounts[].email)"
+
+    matchers:
+      - type: word
+        words:
+          - "[email protected]"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " is using the default Compute Engine service account"'
+# digest: 490a00463044022056c433909de7542bcfb57e00e14f55d349a49c2c70b34094a96d1e9bd0c6103b022069f487e8b93417439beb811bb6580f86c41f64454481eea7b2cee02a543494a6:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-deletion-protection-disabled.yaml

@@ -0,0 +1,75 @@
+id: gcloud-vm-deletion-protection-disabled
+
+info:
+  name: VM Instance Deletion Protection Not Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your production Google Compute Engine instances have Deletion Protection feature enabled in order to protect them from being accidentally deleted. With Deletion Protection safety feature enabled, you have the guarantee that your VM instances cannot be accidentally deleted and make sure that your production environment remains safe.
+  impact: |
+    Without deletion protection enabled, production and mission-critical VM instances are at risk of accidental deletion, which could lead to service disruptions and data loss.
+  remediation: |
+    Enable deletion protection for your production VM instances. You can enable this feature for an existing instance regardless of its current status - stopping the instance is not required.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-deletion-protection.html
+    - https://cloud.google.com/compute/docs/instances/preventing-accidental-vm-deletion
+  tags: cloud,devops,gcp,gcloud,compute,security,deletion-protection,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(deletionProtection)" | jq '. // "false"'
+
+    matchers:
+      - type: word
+        words:
+          - "false"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " does not have deletion protection enabled"'
+# digest: 4b0a00483046022100d3af7f9f8f93b54425c5f333a2314dc0278531b556dbe4ce8bc4b420e81759f6022100826d0a7d7e9501700210e89f90294cafdfc5b4f7ae6ea65f0e29581e4037085b:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-disk-autodelete-enabled.yaml

@@ -0,0 +1,75 @@
+id: gcloud-vm-disk-autodelete-enabled
+
+info:
+  name: Auto-Delete Not Disabled for VM Instance Persistent Disks
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that the Auto-Delete behavior rule is disabled for the persistent disks attached to your Google Cloud virtual machine (VM) instances in order to protect the VM data from being deleted and meet security and compliance requirements. When Auto-Delete is on, the persistent disks are deleted when the associated VM instance is deleted.
+  impact: |
+    With Auto-Delete enabled, persistent disks are automatically deleted when their associated VM instances are deleted, potentially causing unintended data loss for mission-critical systems.
+  remediation: |
+    Disable Auto-Delete for your VM instance persistent disks using the 'gcloud compute instances set-disk-auto-delete' command or through the Google Cloud Console. This ensures disks are retained after instance deletion.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/disable-auto-delete.html
+    - https://cloud.google.com/compute/docs/disks/add-persistent-disk
+  tags: cloud,devops,gcp,gcloud,compute,security,storage,disk,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(disks[].autoDelete)"
+
+    matchers:
+      - type: word
+        words:
+          - '"autoDelete": true'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " has one or more disks with auto-delete enabled"'
+# digest: 4a0a0047304502201225636c26ee4b6234cb21160525eabf8d369b26bbb55af3ec6e1de798cd29a5022100ff680983b468e16af90a5472d1c6bf29c825b0d2dc4617c8d5e0b7071bc4b121:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-disk-cmk-not-enabled.yaml

@@ -0,0 +1,91 @@
+id: gcloud-vm-disk-cmk-not-enabled
+
+info:
+  name: Virtual Machine Disk Encryption with Customer-Managed Keys Not Enabled
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that the persistent disks attached to your Google Compute Engine instances are encrypted with Customer-Managed Keys (CMKs) in order to have a fine control over your sensitive data encryption and decryption process. You can create and manage your own Customer-Managed Keys (CMKs) with Cloud Key Management Service (Cloud KMS). Cloud KMS provides secure and efficient encryption key management, controlled key rotation, and revocation mechanisms.
+  impact: |
+    Without CMK encryption, you have limited control over the encryption keys used to protect your VM disk data, potentially exposing sensitive information to unauthorized access.
+  remediation: |
+    Configure your Compute Engine persistent disks to use Customer-Managed Keys (CMKs) for encryption by specifying a Cloud KMS key during disk creation or by updating existing disks.
+  reference:
+    - https://cloud.google.com/compute/docs/disks/customer-managed-encryption
+  tags: cloud,devops,gcp,gcloud,compute,encryption,cmk,security,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+      for(let disk of iterate(template.disks)){
+        set("diskName", disk)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(disks[].deviceName)"
+
+    extractors:
+      - type: json
+        name: disks
+        internal: true
+        json:
+          - '.disks[].deviceName'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute disks describe $diskName --zone $zone --project $projectId --format="json(diskEncryptionKey.kmsKeyName)" | jq '. // "null"'
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Disk " + diskName + " attached to instance " + instanceName + " in zone " + zone + " of project " + projectId + " is not encrypted with a Customer-Managed Key (CMK)"'
+# digest: 4a0a00473045022100d7cb21540269edd4582afb6f1dcf363463e4568e14154ec5c1fcb0877cd58a2a022005ee32cf0459ad463e162bcc6293991b6bb9dc9d1177233733f6d6f4c41b64cd:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-disk-csek-disabled.yaml

@@ -0,0 +1,91 @@
+id: gcloud-vm-disk-csek-disabled
+
+info:
+  name: VM Disk Encryption with Customer-Supplied Keys Disabled
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that the disks attached to your production Google Compute Engine instances are encrypted with Customer-Supplied Encryption Keys (CSEKs) in order to have complete control over the data-at-rest encryption and decryption process, and meet strict compliance requirements.
+  impact: |
+    Without CSEK encryption, you have limited control over the encryption process of your VM disk data, which may not meet strict compliance requirements for sensitive data protection.
+  remediation: |
+    Enable Customer-Supplied Encryption Keys (CSEKs) for your VM disks by providing a valid encryption key during disk creation or instance launch. The key must be a 256-bit string encoded in RFC 4648 base64 format.
+  reference:
+    - https://cloud.google.com/compute/docs/disks/customer-supplied-encryption
+  tags: cloud,devops,gcp,gcloud,compute,encryption,csek,security,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+      for(let disk of iterate(template.disks)){
+        set("diskName", disk)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json[](name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(disks[].deviceName)"
+
+    extractors:
+      - type: json
+        name: disks
+        internal: true
+        json:
+          - '.disks[].deviceName'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute disks describe $diskName --zone $zone --project $projectId --format="json(diskEncryptionKey)" | jq '.sha256 // "null"'
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Disk " + diskName + " attached to instance " + instanceName + " in zone " + zone + " of project " + projectId + " has Customer-Supplied Encryption Keys (CSEKs) disabled"'
+# digest: 4a0a00473045022100b1774214ffe546cbc3f15390fb79136ed54e41c9f30c6e8c63f4fc4dc28ec9c702205e495b43e7ab875bdc3bcb28febb063991bdb3f692b4d1f73644a87c946aec5b:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-disk-csek-not-enabled.yaml

@@ -0,0 +1,92 @@
+id: gcloud-vm-disk-csek-not-enabled
+
+info:
+  name: Virtual Machine Disk Encryption with Customer-Supplied Keys Not Enabled
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that the disks attached to your production Google Compute Engine instances are encrypted with Customer-Supplied Encryption Keys (CSEKs) in order to have complete control over the data-at-rest encryption and decryption process. CSEKs allow you to provide your own encryption keys that Google Compute Engine uses to protect the Google-generated keys used to encrypt and decrypt your instance data.
+  impact: |
+    Without CSEK encryption, you have limited control over the encryption process of your VM disk data. Google Compute Engine service manages the encryption keys, which may not meet strict compliance requirements for sensitive data.
+  remediation: |
+    Re-create your VM instances with Customer-Supplied Encryption Keys (CSEKs) by providing a 256-bit string encoded in RFC 4648 standard base64 during instance creation. Note that Compute Engine does not store your CSEKs on its servers and cannot access your protected data unless you provide the required key.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-encryption-with-csek.html
+    - https://cloud.google.com/compute/docs/disks/customer-supplied-encryption
+  tags: cloud,devops,gcp,gcloud,compute,encryption,csek,security,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+      for(let disk of iterate(template.disks)){
+        set("diskName", disk)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(disks[].deviceName)"
+
+    extractors:
+      - type: json
+        name: disks
+        internal: true
+        json:
+          - '.disks[].deviceName'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute disks describe $diskName --zone $zone --project $projectId --format="json(diskEncryptionKey.sha256)" | jq '. // "null"'
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Disk " + diskName + " attached to instance " + instanceName + " in zone " + zone + " of project " + projectId + " is not encrypted with a Customer-Supplied Encryption Key (CSEK)"'
+# digest: 4b0a00483046022100c2ddf98deb81b73823578ad0f0b7a5cdcb19b78a9b724b0a8fda299bff5a09b2022100aa01c142410c386168a489b065a27d1e0b089bde93147ac022b6bbb88de194a5:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-ip-forwarding-enabled.yaml

@@ -0,0 +1,75 @@
+id: gcloud-vm-ip-forwarding-enabled
+
+info:
+  name: IP Forwarding Not Disabled for VM Instances
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that IP Forwarding feature is not enabled at the Google Compute Engine instance level for security and compliance reasons, as instances with IP Forwarding enabled act as routers/packet forwarders. Because IP forwarding is rarely required, except when the virtual machine (VM) is used as a network virtual appliance, each Google Cloud VM instance should be reviewed to decide whether IP forwarding is really needed.
+  impact: |
+    With IP forwarding enabled, VM instances can act as routers and receive traffic addressed to other destinations, potentially creating security risks if not properly configured and monitored.
+  remediation: |
+    Re-create your VM instances with IP forwarding disabled. Note that you cannot disable IP forwarding on an existing instance - you must create a new instance without the IP forwarding option.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/disable-ip-forwarding.html
+    - https://cloud.google.com/vpc/docs/using-routes
+  tags: cloud,devops,gcp,gcloud,compute,security,networking,ip-forwarding,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(canIpForward)"
+
+    matchers:
+      - type: word
+        words:
+          - '"canIpForward": true'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " has IP forwarding enabled"'
+# digest: 4a0a00473045022018552b2c39c97674f9ea1def9c2e218bd5a11e55f6b92a483d9dfc474375f2890221008434dd3e48c93627232b1acdefbd19b76d8f6e853fd79250e487b0d5064ea362:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-maintenance-terminate.yaml

@@ -0,0 +1,75 @@
+id: gcloud-vm-maintenance-terminate
+
+info:
+  name: VM Instance Maintenance Policy Set to Terminate
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that Google Cloud Compute Engine performs live migration of your virtual machine instances during periodic infrastructure maintenance. The virtual machine maintenance behavior determines whether the VM instances are live migrated or terminated during a maintenance event. To ensure that your Google Cloud VM instances are migrated to new hardware, set "On Host Maintenance" configuration setting to "Migrate".
+  impact: |
+    When maintenance policy is set to terminate, VM instances will be shut down during maintenance events, leading to service disruptions and potential data loss.
+  remediation: |
+    Configure the maintenance behavior to "MIGRATE" using the gcloud compute instances set-scheduling command or through the Google Cloud Console. This ensures instances are live migrated during maintenance events.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/configure-maintenance-behavior.html
+    - https://cloud.google.com/compute/docs/instances/setting-instance-scheduling-options
+  tags: cloud,devops,gcp,gcloud,compute,reliability,maintenance,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(scheduling.onHostMaintenance)"
+
+    matchers:
+      - type: word
+        words:
+          - '"onHostMaintenance": "TERMINATE"'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " is configured to terminate instead of migrate during maintenance events"'
+# digest: 4a0a004730450221009ea4b62c1ebeed71961f7bb990c4e9efa9c16f57faf141eb25a0da1b9c6564e9022064e76b9d4329f8fdb53dee35e4c9cc024aa09b3d9e60d5f4a4e1e49ff25beb32:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-oslogin-2fa-disabled.yaml

@@ -0,0 +1,76 @@
+id: gcloud-vm-oslogin-2fa-disabled
+
+info:
+  name: OS Login with 2FA Authentication Not Enabled for VM Instances
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that the OS Login feature enabled at the virtual machine instance level is configured with Two-Factor Authentication (2FA) in order to help protect the access to your Google Cloud VM instances. Two-Factor Authentication (also known as Multi-Factor Authentication - MFA) provides an additional layer of security on top of the existing credentials.
+  impact: |
+    Without 2FA enabled for OS Login, VM instances are more vulnerable to unauthorized access through compromised credentials.
+  remediation: |
+    Enable OS Login with 2FA authentication for all VM instances by setting the "enable-oslogin-2fa" metadata key to "TRUE".
+  reference:
+    - https://cloud.google.com/compute/docs/oslogin/set-up-oslogin
+  tags: cloud,devops,gcp,gcloud,compute,security,2fa,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json[](name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(metadata.items)" | jq '.items[]? | select(.key=="enable-oslogin-2fa") | .value // "null"'
+
+    matchers:
+      - type: word
+        words:
+          - "FALSE"
+          - "null"
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"OS Login with 2FA authentication is not enabled for VM instance " + instanceName + " in zone " + zone + " of project " + projectId'
+# digest: 4b0a00483046022100ec0b0d38721c46ad2e4dc2ed7079c6e6e8bc50657cc13c48fe68d37bdbdea45502210085d925e1ae3588e7fba54299325473f2ce75a2e8d65c49dfdd57bbec92a760a9:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-preemptible-enabled.yaml

@@ -0,0 +1,75 @@
+id: gcloud-vm-preemptible-enabled
+
+info:
+  name: VM Instance Preemptibility Not Disabled
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Google Cloud Platform (GCP) projects are not using preemptible virtual machine instances for production and business-critical applications. A preemptible virtual machine (VM) is an instance that you can create and run at a much lower price than normal instances but it can be terminated sooner due to system demands.
+  impact: |
+    Preemptible VM instances can be terminated at any time to free up resources for standard VM instances, making them unsuitable for production workloads and potentially causing service disruptions.
+  remediation: |
+    Re-create your VM instances with preemptibility disabled. Note that you cannot disable preemptibility on an existing instance - you must create a new instance without the preemptible option.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/disable-preemptibility.html
+    - https://cloud.google.com/compute/docs/instances/preemptible
+  tags: cloud,devops,gcp,gcloud,compute,reliability,preemptible,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(scheduling.preemptible)"
+
+    matchers:
+      - type: word
+        words:
+          - "true"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " is configured as preemptible and may not be suitable for production workloads"'
+# digest: 4b0a00483046022100c0513a93a39675e710105757b88a285b42cea4b10d0de21abba6615d3f335d1f022100c1672d6cacacd58532d77684125237e31f787befb25d5fa7d0d1d77a4cb7339d:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-project-ssh-keys-enabled.yaml

@@ -0,0 +1,75 @@
+id: gcloud-vm-project-ssh-keys-enabled
+
+info:
+  name: Block Project-Wide SSH Keys Not Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your Google Compute Engine instances are configured to ignore GCP project-wide (shared) public SSH keys and use instance-level SSH keys instead. Project-wide SSH keys can be used to log in to all the VM instances running inside a GCP project. While project-wide SSH keys can ease SSH key management, if compromised, they pose a security risk which can impact all VM instances within the project.
+  impact: |
+    Using project-wide SSH keys increases the attack surface - if compromised, an attacker could gain access to all VM instances in the project instead of just a single instance.
+  remediation: |
+    Enable "Block Project-Wide SSH Keys" feature for your VM instances and configure instance-specific SSH keys instead. This limits the impact if any single key is compromised.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-block-project-wide-ssh-keys.html
+    - https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys
+  tags: cloud,devops,gcp,gcloud,compute,security,ssh,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(metadata.items)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " is not configured to block project-wide SSH keys"'
+# digest: 490a0046304402207f53624c0d249b3aac27bf5fb31e65c05aec746010620bd810326b22598254f00220109787c755180220327be63e40bf99f95211d459a00abb5adb61d89e9b55afa1:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-public-ip-enabled.yaml

@@ -0,0 +1,81 @@
+id: gcloud-vm-public-ip-enabled
+
+info:
+  name: VM Instance Using Public IP Address
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Google Compute Engine instances are not configured to have external IP addresses in order to minimize their exposure to the Internet. To reduce attack surface, Google Cloud virtual machine (VM) instances should not have public IP addresses attached. Instead, VM instances should be configured to run behind load balancers.
+  impact: |
+    VM instances with public IP addresses are directly exposed to the internet, increasing the attack surface and risk of unauthorized access.
+  remediation: |
+    Remove external IP addresses from your VM instances using the 'gcloud compute instances delete-access-config' command or through the Google Cloud Console. Configure instances to run behind load balancers instead.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/instances-with-public-ip-addresses.html
+    - https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address
+  tags: cloud,devops,gcp,gcloud,compute,security,networking,public-ip,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(networkInterfaces[].accessConfigs)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - '"natIP":'
+        negative: true
+
+      - type: word
+        words:
+          - '"accessConfigs":'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " has a public IP address configured"'
+# digest: 4a0a00473045022027df1ce5767c979d874c287167abb6653905fb39d078890c8aebb9341c8cf470022100f7793e24948701647d8a263c6e45dfe4d47ed9431777632f3c8dbd49948f171e:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-serial-console-enabled.yaml

@@ -0,0 +1,77 @@
+id: gcloud-vm-serial-console-enabled
+
+info:
+  name: Interactive Serial Console Support Not Disabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that "Enable connecting to serial ports" configuration setting is disabled for all your production Google Compute Engine instances. The interactive serial console does not support IP-based access restrictions such as IP address whitelists. If enabled, clients can attempt to connect to your instance from any IP address if they know the username, SSH key, project ID, instance name and zone.
+  impact: |
+    With interactive serial console enabled, instances are accessible from any IP address without IP-based restrictions, potentially allowing unauthorized access if credentials are compromised.
+  remediation: |
+    Disable interactive serial console support by setting the "serial-port-enable" metadata key to "false" for your VM instances to prevent unauthorized access through serial ports.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/disable-interactive-serial-console-support.html
+    - https://cloud.google.com/compute/docs/instances/interacting-with-serial-console
+  tags: cloud,devops,gcp,gcloud,compute,security,serial-console,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(metadata.items)"
+
+    matchers:
+      - type: word
+        words:
+          - '"key": "serial-port-enable"'
+          - '"value": "true"'
+        condition: and
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " has interactive serial console support enabled"'
+# digest: 4b0a00483046022100e9419a3b3eb34b0993182ba41d9f102dc5dc71deac6da1ca0fbacb8452f36d76022100a1ba187dfcc9ee232c5449dc426408f947d4f4c6413d9aa429dd990a2df65649:922c64590222798bb761d5b6d8e72950

cloud/gcp/compute/gcloud-vm-shielded-disabled.yaml

@@ -0,0 +1,80 @@
+id: gcloud-vm-shielded-disabled
+
+info:
+  name: Shielded VM Security Features Not Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your Google Compute Engine instances are configured to use Shielded VM security feature for protection against rootkits and bootkits. Google Compute Engine service can enable 3 advanced security components for Shielded VM instances:
+    - Virtual Trusted Platform Module (vTPM) - validates the guest virtual machine pre-boot and boot integrity, and provides key generation and protection
+    - Integrity Monitoring - lets you monitor and verify the runtime boot integrity using Google Cloud Operations reports
+    - Secure boot - protects your VM instances against boot-level and kernel-level malware and rootkits
+  impact: |
+    Without Shielded VM features enabled, your VM instances are more vulnerable to rootkits, bootkits, and other advanced threats that can compromise the boot integrity and security of your instances.
+  remediation: |
+    Enable Shielded VM security features (vTPM and Integrity Monitoring) for your VM instances. Note that enabling Secure Boot is optional and should only be done if you don't use custom or unsigned drivers, as it may prevent the VM from booting.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/enable-shielded-vm.html
+    - https://cloud.google.com/compute/docs/instances/modifying-shielded-vm
+  tags: cloud,devops,gcp,gcloud,compute,security,shielded-vm,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances list --project $projectId --format="json(name,zone.basename())"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute instances describe $instanceName --zone $zone --project $projectId --format="json(shieldedInstanceConfig.enableVtpm,shieldedInstanceConfig.enableIntegrityMonitoring)"
+
+    matchers:
+      - type: word
+        words:
+          - '"enableIntegrityMonitoring": false'
+          - '"enableVtpm": false'
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"VM instance " + instanceName + " in zone " + zone + " of project " + projectId + " does not have Shielded VM features (vTPM and Integrity Monitoring) fully enabled"'
+# digest: 4a0a0047304502205114fef80e8676d8b3c29ebb922cae352a49b98ddf9419fa115c5a7096e1b0f3022100cbf2503043e325b0ef9da5194e0d295a109583a0dbee38ecbdd75e48ae2f3b07:922c64590222798bb761d5b6d8e72950

cloud/gcp/dataproc/gcloud-dataproc-no-cmk.yaml

@@ -0,0 +1,75 @@
+id: gcloud-dataproc-no-cmk
+
+info:
+  name: Dataproc Cluster Not Using Customer-Managed Keys
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Google Cloud Dataproc clusters on Compute Engine are encrypted with Customer-Managed Keys (CMKs) in order to control the cluster data encryption/decryption process. You can create and manage your own Customer-Managed Keys (CMKs) with Cloud Key Management Service (Cloud KMS). Cloud KMS provides secure and efficient encryption key management, controlled key rotation, and revocation mechanisms.
+  impact: |
+    Without Customer-Managed Keys, you have less control over data encryption and key management, potentially impacting compliance requirements and security controls.
+  remediation: |
+    Re-create your Dataproc clusters with Customer-Managed Keys using Cloud KMS. Configure a key ring and CMK in Cloud KMS, then specify the key when creating the cluster using the '--gce-pd-kms-key' flag or through the console.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/Dataproc/enable-encryption-with-cmks-for-dataproc-clusters.html
+    - https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/customer-managed-encryption
+  tags: cloud,devops,gcp,gcloud,dataproc,security,encryption,cmk,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.clusterName)
+      set("region", cluster.region)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dataproc clusters list --project $projectId --format="json"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dataproc clusters describe $clusterName --region $region --project $projectId --format="json(config.encryptionConfig.gcePdKmsKeyName)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Dataproc cluster " + clusterName + " in region " + region + " of project " + projectId + " is not encrypted with Customer-Managed Keys"'
+# digest: 4b0a00483046022100c004a4c2a84ce03f512e6118356fe0de1a2f530511802817b482769edcda0a13022100afe35a1292495300c69a24062ff7bfe079edfc6e791fc3100015315a23750d2e:922c64590222798bb761d5b6d8e72950

cloud/gcp/dataproc/gcloud-dataproc-public-access.yaml

@@ -0,0 +1,75 @@
+id: gcloud-dataproc-public-access
+
+info:
+  name: Dataproc Cluster Publicly Accessible
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Google Cloud Dataproc clusters are not configured with external IP addresses to minimize exposure to the Internet. When external IP addresses are assigned to Dataproc clusters, the cluster instances are exposed directly to the Internet. This increases the attack surface and risks accidental data exposure if firewall rules are misconfigured.
+  impact: |
+    Publicly accessible Dataproc clusters increase the attack surface and risk of data exposure, as cluster instances can be directly accessed from the internet.
+  remediation: |
+    Re-create your Dataproc clusters with internal IP addresses only by using the '--no-address' flag or enabling 'Internal IP only' in the console. This ensures cluster instances use private IP addresses and communicate over internal networks only.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/Dataproc/publicly-accessible-dataproc-clusters.html
+    - https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/network
+  tags: cloud,devops,gcp,gcloud,dataproc,security,networking,public-access,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.clusterName)
+      set("region", cluster.region)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dataproc clusters list --project $projectId --format="json"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dataproc clusters describe $clusterName --region $region --project $projectId --format=json
+
+    matchers:
+      - type: word
+        words:
+          - "false"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Dataproc cluster " + clusterName + " in region " + region + " of project " + projectId + " is configured with external IP addresses and is publicly accessible"'
+# digest: 4a0a0047304502207ce3d64926d4554201d0410b7dbf479087627c27507152255ff64ad60efe92f70221008746467395042dffd6adf74451c93122a948fbe6805d97c1c05c0ea8951bacc5:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dns-dangling-records.yaml

@@ -0,0 +1,91 @@
+id: gcloud-dns-dangling-records
+
+info:
+  name: Dangling DNS Records Check
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that dangling DNS records are removed from your public Cloud DNS zones in order to maintain the integrity and authenticity of your domains/subdomains and to protect against domain hijacking.
+  impact: |
+    Dangling DNS records can lead to domain hijacking and misrouting of traffic, compromising the security and reliability of your domain infrastructure.
+  remediation: |
+    Regularly audit your DNS records and associated IP addresses. Remove any DNS records that point to IP addresses no longer reserved under your Google Cloud account.
+  reference:
+    - https://cloud.google.com/dns/docs
+  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let managedZone of iterate(template.managedZones)){
+      set("managedZone", managedZone)
+      code(3)
+      for(let recordSet of iterate(template.recordSets)){
+        recordSet = JSON.parse(recordSet)
+        set("recordType", recordSet.type)
+        set("recordData", recordSet.rrdatas)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dns managed-zones list --project $projectId --format="json(name,visibility)"
+
+    extractors:
+      - type: json
+        name: managedZones
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dns record-sets list --zone=$managedZone --format="json(type,rrdatas)"
+
+    extractors:
+      - type: json
+        name: recordSets
+        internal: true
+        json:
+          - '{type: .type, rrdatas: .rrdatas[]}'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud compute addresses list --filter "addressType~EXTERNAL" --format="json(name,status,address)"
+
+    matchers:
+      - type: word
+        words:
+          - 'RESERVED'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Dangling DNS Record: Type: " + recordType + " Data: " + recordData + " in Zone: " + managedZone + " of Project: " + projectId'
+# digest: 490a0046304402202c5b70acf82fe3e4dbbdf2f4205f693e25cfafc642d5bc9c5b661b7685fcf2ee022032f7c3bd76089463d4bde9e6e4d9de7c25ffc32592167725b57b5ecf86d12e39:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dns-dnssec-unenabled.yaml

@@ -0,0 +1,72 @@
+id: gcloud-dns-dnssec-unenabled
+
+info:
+  name: DNSSEC Not Enabled for Google Cloud DNS Zones
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that DNSSEC security feature is enabled for all your Google Cloud DNS managed zones in order to protect your domains against spoofing and cache poisoning attacks. By default, DNSSEC is not enabled for Google Cloud public DNS managed zones.
+  impact: |
+    Not enabling DNSSEC for DNS zones can increase the risk of DNS spoofing and cache poisoning, compromising the security of domain resolutions.
+  remediation: |
+    Enable DNSSEC for each Google Cloud DNS managed zone through the Google Cloud Console or using the `gcloud dns managed-zones update` command with the `--dnssec-state=on` flag.
+  reference:
+    - https://cloud.google.com/dns/docs/dnssec
+  tags: cloud,devops,gcp,gcloud,dns,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let managedZone of iterate(template.managedZones)){
+      set("managedZoneName", managedZone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dns managed-zones list --project $projectId --format="json(name,visibility)"
+
+    extractors:
+      - type: json
+        name: managedZones
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dns managed-zones describe $managedZoneName --project $projectId --format="json(dnssecConfig.state)"
+
+    matchers:
+      - type: word
+        words:
+          - 'off'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"DNSSEC not enabled for Managed Zone: " + managedZoneName + " in Project: " + projectId'
+# digest: 4a0a00473045022100a63467b5c1df819e70daa1a522e5d82b1ebf323053c6059515d504ba3b21a7440220585e48a1e6f01417b987f45713c14ed23a02dcd48f34715a0a31287678703e63:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dnssec-keysigning-rsasha1.yaml

@@ -0,0 +1,72 @@
+id: gcloud-dnssec-keysigning-rsasha1
+
+info:
+  name: DNSSEC RSASHA1 Algorithm Deprecated Usage
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Domain Name System Security Extensions (DNSSEC) feature is not using the deprecated RSASHA1 algorithm for the Key-Signing Key (KSK) associated with your DNS managed zone file.
+  impact: |
+    Using the deprecated RSASHA1 algorithm in DNSSEC configurations can expose DNS infrastructure to vulnerabilities and compromise the integrity and security of DNS data.
+  remediation: |
+    Update the DNSSEC configuration for each DNS managed zone to use more secure algorithms like RSASHA256 or ECDSAP256SHA256 for the Key-Signing Key (KSK).
+  reference:
+    - https://cloud.google.com/dns/docs/dnssec-config
+  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let managedZone of iterate(template.managedZones)){
+      set("managedZone", managedZone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dns managed-zones list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: managedZones
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dns managed-zones describe $managedZone --project $projectId --format="json(dnssecConfig)"
+
+    matchers:
+      - type: word
+        words:
+          - 'rsasha1'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Deprecated RSASHA1 algorithm found in DNS managed zone: " + managedZone + " in Project: " + projectId'
+# digest: 4a0a00473045022100f1fba22253f98b9a21cc53aa6992c05c36ec882ebaee328c6b76b5ac3c5688b402206dcf925a8f866fe1240ba4fe8c20b80730229c5443fc645041aa23c0c3ca6758:922c64590222798bb761d5b6d8e72950

cloud/gcp/dns/gcloud-dnssec-zonesigning-rsasha1.yaml

@@ -0,0 +1,74 @@
+id: gcloud-dnssec-rsasha1-deprecated
+
+info:
+  name: DNSSEC RSASHA1 Algorithm Deprecated
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Domain Name System Security Extensions (DNSSEC) feature is not using the deprecated RSASHA1 algorithm for the Zone-Signing Key (ZSK) associated with your public DNS managed zone.
+  impact: |
+    Using RSASHA1 as the zone-signing algorithm in DNSSEC can expose DNS data to increased risks of being compromised due to weaker cryptographic strength.
+  remediation: |
+    Update the DNSSEC configuration to use a stronger, more secure signing algorithm like RSASHA256 or ECDSAP256SHA256 for your DNS managed zones.
+  reference:
+    - https://cloud.google.com/dns/docs/dnssec-configuring
+  tags: cloud,devops,gcp,gcloud,dns,dnssec,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let managedZone of iterate(template.managedZones)){
+      set("managedZoneName", managedZone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dns managed-zones list --project $projectId --format="json(name,visibility)"
+
+    extractors:
+      - type: json
+        name: managedZones
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud dns managed-zones describe $managedZoneName --project $projectId --format="json(dnssecConfig)"
+
+    matchers:
+      - type: word
+        words:
+          - 'rsasha1'
+          - 'zoneSigning'
+        condition: and
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Deprecated RSASHA1 Algorithm used in DNSSEC for Managed Zone: " + managedZoneName + " in Project: " + projectId'
+# digest: 4b0a00483046022100cb8b9fff2868480c6af2ad01eab469aae458e9d9bab3eff9a7e58b2bcf36d7c7022100d6a35be3a70ec1ae8d2e5abf280603f6b3c1a64e1e2fd5ae89bd0d281d4dda56:922c64590222798bb761d5b6d8e72950

cloud/gcp/filestore/gcloud-filestore-deletion-protection-disabled.yaml

@@ -0,0 +1,73 @@
+id: gcloud-filestore-deletion-protection-disabled
+
+info:
+  name: Filestore Instance Deletion Protection Not Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your Google Cloud Filestore instances have Deletion Protection feature enabled in order to protect them from being accidentally deleted. With the Deletion Protection safety feature enabled, your Filestore instances are guaranteed to be protected from accidental deletion, ensuring your data remains safe.
+  impact: |
+    Without deletion protection, Filestore instances could be accidentally or maliciously deleted through the console, CLI, or API calls, leading to data loss and service disruption.
+  remediation: |
+    Enable deletion protection for your Filestore instances using the 'gcloud filestore instances update' command with the '--deletion-protection' flag or through the Google Cloud Console.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/Filestore/enable-deletion-protection.html
+    - https://cloud.google.com/filestore/docs/prevent-deletion
+  tags: cloud,devops,gcp,gcloud,filestore,security,deletion-protection,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      set("instanceName", instance.name)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud filestore instances list --project $projectId --format="json"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud filestore instances describe $instanceName --format="json(deletionProtectionEnabled)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Filestore instance " + instanceName + " in project " + projectId + " does not have deletion protection enabled"'
+# digest: 490a0046304402201f1c070c1098bf7fa609ca22c7dc6a9f43fcbefc3927c4651db7b6d2ec0aef8602201e6e829d477893c68f25c7c8281a12c671e80f6d8f28f57c4d7b6436ac169d31:922c64590222798bb761d5b6d8e72950

cloud/gcp/filestore/gcloud-filestore-no-backups.yaml

@@ -0,0 +1,75 @@
+id: gcloud-filestore-no-backups
+
+info:
+  name: Filestore Instance Not Using On-Demand Backup
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that on-demand backup and restore functionality is in use for your Google Cloud Filestore instances to ensure data protection, disaster recovery, and regulatory compliance. The backup and restore process does not consume provisioned capacity and has no impact on the performance and availability of your Filestore applications.
+  impact: |
+    Without backups, data loss from accidental deletion, corruption, or disaster events could lead to extended application downtime and inability to recover critical data.
+  remediation: |
+    Create on-demand backups for your Filestore instances using the 'gcloud filestore backups create' command or through the Google Cloud Console. Configure regular backup schedules to ensure point-in-time recovery capabilities.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/Filestore/backup-and-restore.html
+    - https://cloud.google.com/filestore/docs/backup-restore
+  tags: cloud,devops,gcp,gcloud,filestore,security,backup,disaster-recovery,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      set("zone", instance.zone)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud filestore instances list --project $projectId --format="json"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud filestore backups list --project $projectId --format="json" --filter='"sourceInstance":"$instanceName"'
+
+    matchers:
+      - type: word
+        words:
+          - "[]"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Filestore instance " + instanceName + " in project " + projectId + " has no backups configured for data protection and disaster recovery"'
+# digest: 4b0a0048304602210099362bbd987d58593729ab1de3e9c1a78816637d818bfbee6e7dced0f4867579022100f118e76f422b5701c21a05b147797f03c199b52056177b08e18d97911c1ca409:922c64590222798bb761d5b6d8e72950

cloud/gcp/filestore/gcloud-filestore-no-cmek.yaml

@@ -0,0 +1,74 @@
+id: gcloud-filestore-no-cmek
+
+info:
+  name: Filestore Instance Not Using Customer-Managed Encryption Keys
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that data stored on your Google Cloud Filestore instances is encrypted at rest with Customer-Managed Encryption Keys (CMEK) instead of Google-managed encryption keys. CMEKs provide greater control over the encryption and decryption process, enabling you to meet stringent compliance requirements.
+  impact: |
+    Without Customer-Managed Encryption Keys, you have less control over data encryption and key management, potentially impacting compliance requirements and security controls.
+  remediation: |
+    Re-create your Filestore instances with Customer-Managed Encryption Keys using Cloud KMS. Configure a key ring and CMK in Cloud KMS, then specify the key when creating the instance using the '--kms-key' flag or through the console.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/Filestore/instances-encrypted-with-cmeks.html
+    - https://cloud.google.com/filestore/docs/encryption
+  tags: cloud,devops,gcp,gcloud,filestore,security,encryption,cmek,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud filestore instances list --project $projectId --format="json"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud filestore instances describe $instanceName --format="json(kmsKeyName)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Filestore instance " + instanceName + " in project " + projectId + " is not encrypted with Customer-Managed Keys"'
+# digest: 4b0a00483046022100fd2570405f1c980b4b00e67f6196382afe7256a57a48e0e84d7cfe692829cb69022100818fb544dedb23d518adf3957d5f3204d55a58873afd58e13283777684a714e8:922c64590222798bb761d5b6d8e72950

cloud/gcp/filestore/gcloud-filestore-no-vpc-controls.yaml

@@ -0,0 +1,79 @@
+id: gcloud-filestore-no-vpc-controls
+
+info:
+  name: Filestore Instance Not Protected by VPC Service Controls
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that VPC Service Controls are used to configure a security perimeter around your Google Cloud Filestore instances. VPC Service Controls is a powerful security tool that allows you to restrict access to your cloud resources, including Filestore instances, to specific networks and clients. This helps prevent data exfiltration and enhances the security posture of your cloud environment.
+  impact: |
+    Without VPC Service Controls, Filestore instances may be vulnerable to unauthorized access and data exfiltration, as there is no security perimeter controlling data flow between resources.
+  remediation: |
+    Configure VPC Service Controls perimeter to protect your Filestore instances by including the Cloud Filestore API (file.googleapis.com) in the restricted services list and adding your project to the perimeter's protected resources.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/Filestore/use-vpc-service-controls.html
+    - https://cloud.google.com/vpc-service-controls/docs/supported-products
+  tags: cloud,devops,gcp,gcloud,filestore,security,networking,vpc,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let perimeter of iterate(template.perimeters)){
+      set("perimeterName", perimeter.name)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud access-context-manager perimeters list --project $projectId --format="json"
+
+    extractors:
+      - type: json
+        name: perimeters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud access-context-manager perimeters describe $perimeterName --format="json(status.restrictedServices)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "file.googleapis.com"
+        negative: true
+
+      - type: word
+        words:
+          - "restrictedServices"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Project " + projectId + " does not have VPC Service Controls configured to protect Filestore instances"'
+# digest: 490a00463044022047203b2ac5e8e7a0dd1069752f630b226115d376645bb92272f09926f0840db102201c4ac85f65ae0cfc1003a9a94ece3e630bd6e0bb99bf165707f84b73741b9c04:922c64590222798bb761d5b6d8e72950

cloud/gcp/filestore/gcloud-filestore-unrestricted-access.yaml

@@ -0,0 +1,74 @@
+id: gcloud-filestore-unrestricted-access
+
+info:
+  name: Filestore Instance Client Access Not Restricted by IP
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that client access to your Google Cloud Filestore instances is limited to specific (trusted) IP addresses or IP address ranges in order to protect your data against unauthorized access. By default, Filestore instances provide full (root-level read/write) access to all clients within the same Google Cloud project and VPC network.
+  impact: |
+    Granting untrusted clients access exposes Filestore instance data to unapproved access, modification, or deletion. Without IP-based access rules, any client in the same project and VPC can access the instance.
+  remediation: |
+    Configure IP-based access rules for your Filestore instances to restrict access to specific IP addresses or ranges. Once configured, any IP address or range not explicitly allowed will be denied access.
+  reference:
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/Filestore/restrict-client-access.html
+    - https://cloud.google.com/filestore/docs/access-control
+  tags: cloud,devops,gcp,gcloud,filestore,security,networking,access-control,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let instance of iterate(template.instances)){
+      instance = JSON.parse(instance)
+      set("instanceName", instance.name)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud filestore instances list --project $projectId --format="json"
+
+    extractors:
+      - type: json
+        name: instances
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud filestore instances describe $instanceName --format="json(fileShares[].nfsExportOptions)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Filestore instance " + instanceName + " in project " + projectId + " has unrestricted client access and is not limited to specific IP addresses"'
+# digest: 4a0a00473045022015227977ae287e23e7ff3a7fe02ab1e22cb3f9452e7270651f2dba02685071890221009812ea9204d9da21ef99f129a3426fa9b6f8cb6dd1a5a1743f2b64f1fcb4d7fb:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcloud-func-auto-runtime-updates-disabled.yaml

@@ -0,0 +1,72 @@
+id: gcloud-func-auto-runtime-updates-disabled
+
+info:
+  name: Automatic Runtime Security Updates Disabled in Google Cloud Functions
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that automatic runtime security updates are enabled for your Google Cloud functions in order to keep the functions secure and protected against vulnerabilities without manual intervention.
+  impact: |
+    Having automatic runtime security updates disabled can expose Google Cloud functions to vulnerabilities which could be mitigated by timely updates.
+  remediation: |
+    Enable automatic runtime security updates for each Google Cloud function by setting the `serviceConfig.minInstanceCount` to a non-null value, ensuring functions are automatically updated with the latest security patches.
+  reference:
+    - https://cloud.google.com/functions/docs/securing/managing-security
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionDetail of iterate(template.functions)){
+      set("functionName", functionDetail)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --format="json(serviceConfig.minInstanceCount)"
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Automatic Runtime Security Updates Disabled in function: " + functionName + " in Project: " + projectId'
+# digest: 4b0a00483046022100f41be90788c213768a91b9c804665007a6c775591d782d20231cd9998493e0e0022100b4216a242eded9560fcb101e7f96643795aa055c7fe359c346a82eca90de74cb:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcloud-func-cmek-not-used.yaml

@@ -0,0 +1,72 @@
+id: gcloud-func-cmek-not-used
+
+info:
+  name: No Customer-Managed Encryption Keys in Google Cloud Functions
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Google Cloud functions use Customer-Managed Encryption Keys (CMEK) instead of Google-managed encryption keys to encrypt data at rest. CMEKs provide greater control over the encryption and decryption process, enabling you to meet stringent compliance requirements.
+  impact: |
+    Using Google-managed encryption keys instead of CMEKs reduces your ability to control the encryption process and comply with certain regulatory standards.
+  remediation: |
+    Configure your Google Cloud functions to use Customer-Managed Encryption Keys (CMEK) to ensure data encryption at rest is managed according to your compliance and security requirements.
+  reference:
+    - https://cloud.google.com/functions/docs/securing/managing-encryption-keys
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionName of iterate(template.functions)){
+      set("functionName", functionName)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --format="json(kmsKeyName)"
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Function not using CMEK: " + functionName + " in " + projectId + " project"'
+# digest: 4a0a00473045022036beb2fd770344d590d37a8790e66f07d95b0f780fcca88dd87eb122dc5113f5022100ad2e88670bf9c93de176a2c68bc25d3c01a749aa3236f6736614fbf6b46de3a9:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcloud-func-inactive-svc-acc.yaml

@@ -0,0 +1,92 @@
+id: gcloud-func-inactive-svc-acc
+
+info:
+  name: Inactive Service Accounts in Google Cloud Functions
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Google Cloud functions are referencing existing, active service accounts in order to prevent execution failures and operational disruptions.
+  impact: |
+    Using inactive or deleted service accounts in Google Cloud Functions can lead to runtime errors and potential service disruption, affecting the stability and reliability of cloud services.
+  remediation: |
+    Verify and update the service accounts associated with your Google Cloud functions to ensure they are active and have the necessary permissions for function execution.
+  reference:
+    - https://cloud.google.com/functions/docs/securing/managing-access-iam
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionName of iterate(template.functions)){
+      set("functionName", functionName)
+      code(3)
+        for(let serviceAccountEmail of iterate(template.serviceAccountEmail)){
+        set("serviceAccountEmail", serviceAccountEmail)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --format="json(serviceConfig.serviceAccountEmail)"
+
+    extractors:
+      - type: json
+        name: serviceAccountEmail
+        internal: true
+        json:
+          - '.[].serviceAccountEmail'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud iam service-accounts describe $serviceAccountEmail --format="json(disabled)"
+
+    matchers:
+      - type: word
+        words:
+          - 'PERMISSION_DENIED:'
+          - 'ERROR:'
+          - 'disabled'
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Inactive Service Account: " + serviceAccountEmail + ", Function: " + functionName + " in " + projectId + " project"'
+# digest: 4b0a00483046022100b3a88d907cebddde0a630870a7c5ca519f91bcc44458251a401c29d179f8d1a7022100a890c368897f632fea8e9340f73adde68fe56e87c3f8b55fdd7d8d5aa7a3d73d:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcloud-func-min-instances-unset.yaml

@@ -0,0 +1,72 @@
+id: gcloud-func-min-instances-unset
+
+info:
+  name: Unset Minimum Instances for Cloud Functions
+  author: princechaddha
+  severity: medium
+  description: |
+    To minimize cold start latency and enhance performance, ensure that your Google Cloud Functions have a sufficient number of warm instances configured.
+  impact: |
+    Not setting a minimum number of instances for Google Cloud functions can result in potential cold start delays and degraded performance, especially for critical or latency-sensitive functions.
+  remediation: |
+    Configure the serviceConfig.minInstanceCount parameter for your Google Cloud Functions to an appropriate value that suits your workload demands.
+  reference:
+    - https://cloud.google.com/functions/docs/scaling#setting_a_minimum_number_of_instances
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionDetail of iterate(template.functions)){
+      set("functionName", functionDetail)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --format="json(serviceConfig.minInstanceCount)"
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Minimum Instances not configured for function: " + functionName + " in " + projectId + " project"'
+# digest: 4a0a0047304502207b15e888724a1775d166f4d95b30cc734beb8bb8ba06aa18fd3f1a4103b597ca022100ad28c25adefc1443d4d79d24b113bb3f989f4c470674804b8928c305c5dc5e40:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcloud-func-missing-labels.yaml

@@ -0,0 +1,72 @@
+id: gcloud-func-missing-labels
+
+info:
+  name: Missing User-Defined Labels in Google Cloud Functions
+  author: princechaddha
+  severity: low
+  description: |
+    Ensure that user-defined labels are being used to tag, collect, and organize Google Cloud functions within your Google Cloud Platform (GCP) projects. User-defined labels are a lightweight and efficient way to group together related or associated cloud resources.
+  impact: |
+    Not using labels can lead to challenges in managing, identifying, and organizing resources, potentially increasing the complexity of operations and governance.
+  remediation: |
+    Define and apply user-defined labels to all Google Cloud functions to enhance resource management capabilities and improve operational efficiency.
+  reference:
+    - https://cloud.google.com/resource-manager/docs/creating-managing-labels
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionDetail of iterate(template.functions)){
+      set("functionName", functionDetail)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --format="json(labels)"
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Missing labels for function: " + functionName + " in " + projectId + " project"'
+# digest: 4a0a004730450221009067d1e03e4170ee7a43672d9b82b01904b5ac69c5a3194e5f7d9b7722365dae02207f5df45308acb20653a56a1a8321d8feb4f6d9a4cb414be431bea5822becee13:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcloud-func-no-vpc-access.yaml

@@ -0,0 +1,72 @@
+id: gcloud-func-no-vpc-access
+
+info:
+  name: No Serverless VPC Access in Google Cloud Functions
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Google Cloud functions are configured to use Serverless VPC Access in order to connect functions directly to your VPC network, allowing access to other VPC resources such as VM instances, MemoryStore instances, or any other cloud resources with an internal IP address. Without Serverless VPC Access, these functions may not be able to communicate efficiently with other resources in the same VPC.
+  impact: |
+    Lack of Serverless VPC Access in Google Cloud functions can lead to inefficient or failed communications between your serverless functions and other resources within the same VPC, impacting application performance and increasing latency.
+  remediation: |
+    Configure Serverless VPC Access for your Google Cloud functions by setting the vpcConnector parameter to the name of an already configured VPC connector in your project settings.
+  reference:
+    - https://cloud.google.com/functions/docs/connecting-vpc
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionName of iterate(template.functions)){
+      set("functionName", functionName)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --region=us-central1 --format="json(vpcConnector)"
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"No Serverless VPC Access in function: " + functionName + " in " + projectId + " project"'
+# digest: 4a0a004730450220397c7cc5e8bbd815dc87d42001c3d67f3ad2a5472ae673d8a30ae79533a5298d0221009dc8716a28b3dbf002ecacb0ea76d8df3890c5fa966d55041b173ea247e57cd4:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcloud-func-public-access.yaml

@@ -0,0 +1,74 @@
+id: gcloud-func-public-access
+
+info:
+  name: Publicly Accessible Google Cloud Functions
+  author: princechaddha
+  severity: high
+  description: |
+    Identify any publicly accessible Google Cloud functions within your GCP account and update their IAM policy to protect against unauthorized users sending requests to invoke these functions. To deny access from anonymous and public users, remove the bindings for allUsers and allAuthenticatedUsers members from your function's IAM policy. The allUsers member represents any user on the Internet, while allAuthenticatedUsers represents any user or service account that can sign into Google Cloud Platform (GCP) with a Google account.
+  impact: |
+    Allowing public access to Google Cloud functions can lead to unauthorized use and potential security breaches.
+  remediation: |
+    Update the IAM policies of your Google Cloud functions to remove allUsers and allAuthenticatedUsers from the bindings to ensure that the functions are not publicly accessible.
+  reference:
+    - https://cloud.google.com/functions/docs/securing/managing-access-iam
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionDetail of iterate(template.functions)){
+      set("functionName", functionDetail)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions get-iam-policy $functionName --project $projectId --format=json
+
+    matchers:
+      - type: word
+        words:
+          - 'allUsers'
+          - 'allAuthenticatedUsers'
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Publicly Accessible Function: " + functionName + " in " + projectId + " project"'
+# digest: 490a00463044022054047032f873c063e6b06345f7ad406078d0cf08dd78848ffabcd133ed5fb8980220105c2dc6c2fc146108b01f2ee12c583705d22a93b09f11ea6420f97a8dd8b39f:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcloud-func-pubsub-dlt-missing.yaml

@@ -0,0 +1,72 @@
+id: gcloud-func-pubsub-dlt-missing
+
+info:
+  name: Configure Dead Lettering for Pub/Sub-Triggered Functions
+  author: princechaddha
+  severity: low
+  description: |
+    Ensure that Google Cloud functions triggered by Pub/Sub have a Dead-Letter Topic (DLT) configured to handle undeliverable messages. To achieve this, configure your Pub/Sub subscriptions with a maximum number of delivery attempts. If a message cannot be delivered, it will be sent to the designated Dead-Letter Topic (DLT).
+  impact: |
+    Not having a Dead-Letter Topic for Pub/Sub-triggered functions can result in lost messages and unhandled failures, affecting the reliability of your application.
+  remediation: |
+    Configure a Dead-Letter Topic for each Pub/Sub-triggered function by setting up the necessary Pub/Sub subscription settings.
+  reference:
+    - https://cloud.google.com/functions/docs/calling/pubsub#retry
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionDetail of iterate(template.functions)){
+      set("functionName", functionDetail)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name, region)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --format="json(eventTrigger.pubsubTopic)"
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Missing Dead Letter Topic for function: " + functionName + " in Project: " + projectId'
+# digest: 4a0a004730450220413fa19c6137c829d6f051961cdbf60971ca8b29c0a50244d60abd051dc20a1a022100ba1ad384103c418a748417d271f5e4cc1d236779ed5599770e04e08915dc0e3d:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcloud-func-secrets-unmanaged.yaml

@@ -0,0 +1,78 @@
+id: gcloud-func-secrets-unmanaged
+
+info:
+  name: Use Secrets Manager for Managing Secrets in Google Cloud Functions
+  author: princechaddha
+  severity: medium
+  description: |
+    To prevent unauthorized access or accidental exposure of sensitive information, ensure that Secrets Manager service is used to store and manage secrets instead of storing them in cleartext within Cloud Functions environment variables.
+  impact: |
+    Storing secrets in environment variables without encryption can expose sensitive information to unauthorized access, potentially leading to security breaches and compliance issues.
+  remediation: |
+    Refactor your Google Cloud Functions to use Secrets Manager for managing sensitive configuration settings instead of storing them directly in environment variables.
+  reference:
+    - https://cloud.google.com/functions/docs/securing/managing-secrets
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionName of iterate(template.functions)){
+      set("functionName", functionName)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --format="json(serviceConfig.environmentVariables,buildConfig.environmentVariables)"
+
+    matchers:
+      - type: word
+        words:
+          - 'PASSWORD'
+          - 'API_KEY'
+          - 'SECRET_KEY'
+          - 'ACCESS_TOKEN'
+          - 'TOKEN'
+        case-insensitive: true
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Sensitive information found in environment variables for function: " + functionName + ", Project: " + projectId'
+# digest: 4a0a00473045022100e990f9b65300b3b54057775bf8ae1b94bd107ba5a3196832aa226ae9ddfee08d02202b6647b244be5159434a48b5d76dd66c833a6de473ab15128114639326f01dc9:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcloud-func-unrestricted-outbound.yaml

@@ -0,0 +1,74 @@
+id: gcloud-func-unrestricted-outbound
+
+info:
+  name: Unrestricted Outbound Network Access in Google Cloud Functions
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that your Google Cloud functions are not configured to allow unrestricted outbound network access in order to prevent security vulnerabilities and minimize cloud costs. To ensure that your function's outbound traffic is restricted to internal IP ranges and can't communicate with external networks or the public Internet, set the VpcConnectorEgressSettings parameter to PRIVATE_RANGES_ONLY.
+  impact: |
+    Allowing unrestricted outbound network access can lead to potential security risks such as data exfiltration and increased cloud costs from unexpected external network communications.
+  remediation: |
+    Configure the VpcConnectorEgressSettings of your Google Cloud functions to PRIVATE_RANGES_ONLY to ensure all outgoing traffic is limited to internal IP ranges only.
+  reference:
+    - https://cloud.google.com/functions/docs/networking/network-settings
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionDetail of iterate(template.functions)){
+      set("functionName", functionDetail)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --format="json(serviceConfig.vpcConnectorEgressSettings)"
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+          - 'ALL_TRAFFIC'
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Unrestricted Outbound Network Access in function: " + functionName + ", Region: " + functionRegion + ", Project: " + projectId'
+# digest: 4b0a00483046022100a75b77f6381dd1f3ca9111e082c1350f036c6632e7d5f8ca4ae70a2ff607073b022100eaa16389e41d43946e1f6a7aa2c230084341a13c49f03ca90a57eab049b3b02f:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcp-cloud-func-gen1-deprecated.yaml

@@ -0,0 +1,72 @@
+id: gcp-cloud-func-gen1-deprecated
+
+info:
+  name: Deprecated 1st Generation Google Cloud Functions
+  author: princechaddha
+  severity: high
+  description: |
+    Ensure that none of your Google Cloud functions are 1st (first) generation functions. 1st generation Google Cloud functions are considered deprecated and no longer receive updates or support, making them less secure, less performant, and lacking in new features compared to newer generations.
+  impact: |
+    Using deprecated 1st generation functions can expose your applications to security vulnerabilities, degrade performance, and miss out on new features provided by newer generations.
+  remediation: |
+    Migrate all 1st generation Google Cloud functions to newer generation runtimes as recommended by Google to ensure continued support and access to the latest features and security enhancements.
+  reference:
+    - https://cloud.google.com/functions/docs/migrating
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionDetail of iterate(template.functions)){
+      set("functionName", functionDetail)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --format="json(environment)"
+
+    matchers:
+      - type: word
+        words:
+          - 'null'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Deprecated 1st Generation function: " + functionName + " in Project: " + projectId'
+# digest: 4a0a0047304502210086da9298c287a6dad8e2e2435bc1c7d31f691ccbf2169e471d878ac20baf04d5022036776312a4e1594caa72525f396fd8a7e755c2ac84bc5ea99238256f2c6a2162:922c64590222798bb761d5b6d8e72950

cloud/gcp/function/gcp-func-default-svc-acc.yaml

@@ -0,0 +1,74 @@
+id: gcp-func-default-svc-acc
+
+info:
+  name: Google Cloud Functions Using Default Service Account
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your Google Cloud functions are configured to use user-managed service accounts instead of the default service account managed by Google Cloud in order to follow the Principle of Least Privilege (POLP) and enhance the security posture of your functions.
+  impact: |
+    Using default service accounts can grant more permissions than required to your functions, violating the Principle of Least Privilege and increasing security risks.
+  remediation: |
+    Configure your Google Cloud functions to use user-managed service accounts that have only the permissions necessary for the function to operate.
+  reference:
+    - https://cloud.google.com/functions/docs/securing/managing-access-iam
+  tags: cloud,devops,gcp,gcloud,google-cloud-functions,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let functionDetail of iterate(template.functions)){
+      set("functionName", functionDetail)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions list --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: functions
+        internal: true
+        json:
+          - '.[].name'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud functions describe $functionName --format="value(serviceConfig.serviceAccountEmail)"
+
+    matchers:
+      - type: word
+        words:
+          - '@appspot.gserviceaccount.com'
+          - '@developer.gserviceaccount.com'
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Default Service Account used in function: " + functionName + " in " + projectId + " project"'
+# digest: 4a0a0047304502207fc6a953b87cb78ff44c19096ded2962ce2b34b8f899da6e3c028c21ed62e080022100abe481b531bf4d078a50657118954d54ced272d83f731725c10a25d24b946975:922c64590222798bb761d5b6d8e72950

cloud/gcp/gcp-env.yaml

@@ -0,0 +1,36 @@
+id: gcp-env
+
+info:
+  name: GCP Environment Validation
+  author: princechaddha
+  severity: info
+  description: |
+    Checks if Google Cloud CLI (gcloud) is set up and all necessary tools are installed on the environment.
+  reference:
+    - https://console.cloud.google.com/
+  tags: cloud,devops,google,gcp,gcp-cloud-config
+
+self-contained: true
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud config get-value account --format="json"
+
+    matchers:
+      - type: word
+        words:
+          - '@'
+
+    extractors:
+      - type: json
+        name: account
+        json:
+          - '.'
+        internal: true
+
+      - type: dsl
+        dsl:
+          - '"Google Cloud CLI is properly configured for account \"" + account + "\"."'
+# digest: 4a0a00473045022062ce09ad9923c5f5cf0d8c4019c41920f13268e3788abc3587939c3627905ae60221009bd228cc7e8114257c43f5036ec937fbd7643290d4b2e275413fb18958e0e799:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-auto-repair-disabled.yaml

@@ -0,0 +1,96 @@
+id: gcloud-gke-auto-repair-disabled
+
+info:
+  name: GKE Node Pools Without Auto-Repair Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that the Auto-Repair feature is enabled for all your GKE cluster nodes to help maintain node health. Google Kubernetes Engine (GKE) triggers a repair action if a node reports consecutive unhealthy status reports for a given time threshold, such as when a node broadcasts a "NotReady" status, fails to broadcast any status, or runs out of disk space.
+  impact: |
+    Without auto-repair enabled, unhealthy nodes may remain in a degraded state indefinitely, potentially affecting the availability and reliability of your workloads running on those nodes.
+  remediation: |
+    Enable auto-repair for your GKE cluster node pools using:
+    gcloud container node-pools update POOL_NAME --cluster=CLUSTER_NAME --region=REGION --enable-autorepair
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-repair
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-auto-repair.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,reliability,maintenance,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+      for(let nodePool of iterate(template.nodePools)){
+        nodePool = JSON.parse(nodePool)
+        set("nodePoolName", nodePool.name)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools list --cluster $clusterName --location $location --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: nodePools
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools describe $nodePoolName --cluster $clusterName --location $location --project $projectId --format="yaml(management.autoRepair)"
+
+    matchers:
+      - type: word
+        words:
+          - "management: {}"
+          - "null"
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Node pool " + nodePoolName + " in GKE cluster " + clusterName + " (" + location + ") of project " + projectId + " does not have auto-repair enabled"'
+# digest: 4a0a004730450220650dfbe4698de5fd0774f8caaada58ef598cf8c58b89fb2bbbc4ac82e9f6c0c902210096aaf12a7d2fdab29352f5ef9d832c8fb67a20a2b9308c668307b5d13e6130bb:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-auto-upgrade-disabled.yaml

@@ -0,0 +1,96 @@
+id: gcloud-gke-auto-upgrade-disabled
+
+info:
+  name: GKE Node Pools Without Auto-Upgrade Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that the Auto-Upgrade feature is enabled for all the nodes running within your Google Kubernetes Engine (GKE) clusters. This feature helps you keep your cluster nodes up to date with the latest supported version of Kubernetes, automatically applying security fixes and new functionalities.
+  impact: |
+    Without auto-upgrades enabled, cluster nodes may run outdated Kubernetes versions, missing critical security patches and feature updates, which could expose your clusters to known vulnerabilities.
+  remediation: |
+    Enable auto-upgrade for your GKE cluster node pools using:
+    gcloud container node-pools update POOL_NAME --cluster=CLUSTER_NAME --region=REGION --enable-autoupgrade
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-upgrades
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-auto-upgrade.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,updates,maintenance,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+      for(let nodePool of iterate(template.nodePools)){
+        nodePool = JSON.parse(nodePool)
+        set("nodePoolName", nodePool.name)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools list --cluster $clusterName --location $location --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: nodePools
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools describe $nodePoolName --cluster $clusterName --location $location --project $projectId --format="yaml(management.autoUpgrade)"
+
+    matchers:
+      - type: word
+        words:
+          - "management: {}"
+          - "null"
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Node pool " + nodePoolName + " in GKE cluster " + clusterName + " (" + location + ") of project " + projectId + " does not have auto-upgrade enabled"'
+# digest: 490a004630440220700f02c7f46cd893d2c350339f69038c82b95ec459197553400b3c9ae36a7a5c022017f38313e61466940c8968ad08c60f7db19c39f299c9f68fccdc28f1633f1645:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-backups-disabled.yaml

@@ -0,0 +1,76 @@
+id: gcloud-gke-backups-disabled
+
+info:
+  name: GKE Clusters Without Backups Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that backups are enabled for your Google Kubernetes Engine (GKE) clusters to protect your workloads and enable disaster recovery capabilities. GKE backups capture both configuration and volume data, allowing selective or comprehensive restoration of workloads, which is valuable for disaster recovery, CI/CD pipelines, workload cloning, and managing upgrades.
+  impact: |
+    Without backups enabled, you risk potential data loss and extended downtime in case of disasters, and lack the ability to efficiently roll back workloads, migrate between clusters, or clone environments for testing and development.
+  remediation: |
+    Enable backups for your GKE clusters using:
+    gcloud container clusters update CLUSTER_NAME --region=REGION --update-addons=BackupRestore=ENABLED
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/backup-restore
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-cluster-backups.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,backup,disaster-recovery,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters describe $clusterName --location $location --project $projectId --format="json(addonsConfig.gkeBackupAgentConfig.enabled)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"GKE cluster " + clusterName + " in " + location + " of project " + projectId + " does not have backups enabled"'
+# digest: 490a0046304402207090814fc020658847b199ab5d4485e1db92675fa3a269d7fa3980acd227b2b00220707cc7dd2c4ed9e6f7e341f85d2b7e11df710fd9749220bd49b7ad7898eb3532:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-binary-authorization-disabled.yaml

@@ -0,0 +1,78 @@
+id: gcloud-gke-binary-authorization-disabled
+
+info:
+  name: GKE Clusters Without Binary Authorization Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Binary Authorization is enabled for your Google Kubernetes Engine (GKE) clusters to enforce container image security policies. Binary Authorization enhances security by ensuring only trusted container images can be deployed, reducing the risk of deploying vulnerable or unauthorized software.
+  impact: |
+    Without Binary Authorization enabled, there is no policy enforcement to prevent the deployment of untrusted or unauthorized container images, increasing the risk of deploying vulnerable or malicious software.
+  remediation: |
+    Enable Binary Authorization for your GKE clusters using:
+    gcloud container clusters update CLUSTER_NAME --zone=ZONE --binauthz-evaluation-mode=project-singleton-policy-enforce
+  reference:
+    - https://cloud.google.com/binary-authorization/docs/overview
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-binary-authorization.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,container,authorization,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters describe $clusterName --location $location --project $projectId --format="json(binaryAuthorization.evaluationMode)"
+
+    matchers:
+      - type: word
+        words:
+          - '"evaluationMode": "DISABLED"'
+          - "null"
+        condition: or
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"GKE cluster " + clusterName + " in " + location + " of project " + projectId + " does not have Binary Authorization enabled"'
+# digest: 4a0a0047304502207c0b2033ab71b019e749d4b57ba39a48f60d68d15487aef9f5eca8f2c096090a022100f121d847779291dcd5ed5e1bce1e5812aa0ad849c8447ca6d0c7b4ca18a90fe0:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-client-certificate-enabled.yaml

@@ -0,0 +1,76 @@
+id: gcloud-gke-client-certificate-enabled
+
+info:
+  name: GKE Clusters With Client Certificate Authentication Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that authentication using client certificates is disabled for your Google Kubernetes Engine (GKE) clusters. Client certificates require manual key rotation for authentication and are difficult to revoke. It is highly recommended to use alternative authentication methods like OpenID Connect, which is the default authentication method used by gcloud and handles token management automatically.
+  impact: |
+    Using client certificate authentication introduces security management challenges as certificates don't auto-rotate and are difficult to revoke, potentially leading to security risks if certificates are compromised or not properly rotated.
+  remediation: |
+    Re-create your clusters without client certificates using:
+    gcloud container clusters create NEW_CLUSTER_NAME --no-issue-client-certificate
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/disable-client-certificate.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,authentication,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters describe $clusterName --location $location --project $projectId --format="value(masterAuth.clientCertificateConfig.issueClientCertificate)"
+
+    matchers:
+      - type: word
+        words:
+          - "True"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"GKE cluster " + clusterName + " in " + location + " of project " + projectId + " has client certificate authentication enabled"'
+# digest: 4b0a0048304602210087636d212af56d9476c7ea4969014543270225810903357de90d5bae207d3f43022100ef99ebca6eaf626a5d1661e3025aafa173f5e2a2fe1c44e78f53de49afce8987:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-confidential-nodes-disabled.yaml

@@ -0,0 +1,94 @@
+id: gcloud-gke-confidential-nodes-disabled
+
+info:
+  name: GKE Clusters Not Using Confidential Nodes
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your Google Kubernetes Engine (GKE) cluster node pools use confidential GKE nodes to encrypt all running workloads. Confidential GKE nodes employ hardware-based memory encryption to safeguard your data and applications from unauthorized access or modification while in use.
+  impact: |
+    Without confidential GKE nodes enabled, workload data may be vulnerable to unauthorized access or modification while in use, even if the underlying hardware is compromised.
+  remediation: |
+    Enable confidential GKE nodes for your cluster node pools using:
+    gcloud container node-pools update POOL_NAME --cluster=CLUSTER_NAME --region=REGION --enable-confidential-nodes
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/confidential-gke-nodes
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-confidential-gke-nodes.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,encryption,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+      for(let nodePool of iterate(template.nodePools)){
+        nodePool = JSON.parse(nodePool)
+        set("nodePoolName", nodePool.name)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools list --cluster $clusterName --location $location --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: nodePools
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools describe $nodePoolName --cluster $clusterName --location $location --project $projectId --format="json(confidentialNodes.enabled)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Node pool " + nodePoolName + " in GKE cluster " + clusterName + " (" + location + ") of project " + projectId + " does not have confidential nodes enabled"'
+# digest: 4b0a00483046022100b0e6356da4fd4cbd884550060526a32197cdb3a4a613b2f9f671a91c0a79bd48022100ff425b92399cdfc3d5e1a8452cb0e95012edc64f1f48ef740819bb56eb85ea00:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-cos-containerd-disabled.yaml

@@ -0,0 +1,100 @@
+id: gcloud-gke-cos-containerd-disabled
+
+info:
+  name: GKE Clusters Not Using Container-Optimized OS
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your Google Kubernetes Engine (GKE) cluster nodes use the Container-Optimized OS (cos_containerd), a managed, optimized, and hardened base OS provided by GKE to limit the host's attack surface. cos_containerd's layered architecture enables advanced GKE features like gVisor and Image Streaming, and offers improved resource efficiency and security.
+  impact: |
+    Not using Container-Optimized OS with containerd can result in reduced security posture and inability to use advanced GKE features. Other OS images may have larger attack surfaces and lack the optimizations specific to container workloads.
+  remediation: |
+    Update your GKE node pools to use Container-Optimized OS with containerd using the command:
+    gcloud container clusters upgrade CLUSTER_NAME --node-pool POOL_NAME --image-type cos_containerd
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/concepts/node-images
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/use-cos-containerd.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,containers,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+      for(let nodePool of iterate(template.nodePools)){
+        nodePool = JSON.parse(nodePool)
+        set("nodePoolName", nodePool.name)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools list --cluster $clusterName --location $location --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: nodePools
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools describe $nodePoolName --cluster $clusterName --location $location --project $projectId --format="json(config.imageType)"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        words:
+          - "COS_CONTAINERD"
+        negative: true
+
+      - type: regex
+        regex:
+          - '(?m)^.*$'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Node pool " + nodePoolName + " in GKE cluster " + clusterName + " (" + location + ") of project " + projectId + " is not using Container-Optimized OS with containerd"'
+# digest: 490a004630440220384831859cdde26777efea3694796ead3e70bcc77f3747cf9f912d33d823e06d022054ebbfa9e21bec19af80d2159e99b1d38b24a1d8c8679ff621572b4dc117e569:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-cost-allocation-disabled.yaml

@@ -0,0 +1,76 @@
+id: gcloud-gke-cost-allocation-disabled
+
+info:
+  name: GKE Clusters Without Cost Allocation Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that cost allocation is enabled for your Google Kubernetes Engine (GKE) clusters to gain detailed insights into resource usage. This feature allows you to break down resource consumption by Kubernetes namespaces and labels, making it easier to associate costs with specific entities and access detailed cost reports through billing data exported to BigQuery.
+  impact: |
+    Without cost allocation enabled, you lack detailed visibility into resource consumption and cost distribution across Kubernetes components, making it difficult to make informed decisions for cost optimization, budgeting, and chargeback allocation.
+  remediation: |
+    Enable cost allocation for your GKE clusters using:
+    gcloud container clusters update CLUSTER_NAME --region=REGION --enable-cost-allocation
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-usage-metering
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-cost-allocation.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,cost,monitoring,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters describe $clusterName --location $location --project $projectId --format="json(costManagementConfig.enabled)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"GKE cluster " + clusterName + " in " + location + " of project " + projectId + " does not have cost allocation enabled"'
+# digest: 4b0a00483046022100a335e96ed39d59f29bf4c52683a4c46f13abcf1306f72e9f3081377983e32e9e022100930b95594fc5920f5f39e0c5de255f78c0c0b5e7021e32e18a4f7385845a1975:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-default-service-account.yaml

@@ -0,0 +1,93 @@
+id: gcloud-gke-default-service-account
+
+info:
+  name: GKE Clusters Using Default Service Account
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that your Google Kubernetes Engine (GKE) clusters are configured to use user-managed service accounts instead of the default service account managed by Google Cloud. The default service account has broad permissions across your GCP project, which violates the Principle of Least Privilege (POLP).
+  impact: |
+    Using the default service account increases security risks as it has broad permissions that could be exploited if compromised, potentially leading to unauthorized access across project resources.
+  remediation: |
+    Create a custom service account with minimal required permissions and update your node pools to use it instead of the default service account.
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#use_least_privilege_sa
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/remove-default-service-account.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,iam,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+      for(let nodePool of iterate(template.nodePools)){
+        nodePool = JSON.parse(nodePool)
+        set("nodePoolName", nodePool.name)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools list --cluster $clusterName --location $location --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: nodePools
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools describe $nodePoolName --cluster $clusterName --location $location --project $projectId --format="value(config.serviceAccount)"
+
+    matchers:
+      - type: word
+        words:
+          - "default"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Node pool " + nodePoolName + " in GKE cluster " + clusterName + " (" + location + ") of project " + projectId + " is using the default service account"'
+# digest: 490a00463044022076bf265981036c9db2bd630fe371e3f583723757c70fb00e17ef74491570539702205602607493cebac53057a0e78004697ef29ab4be20df016ae99f5efd401bce44:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-integrity-monitoring-disabled.yaml

@@ -0,0 +1,95 @@
+id: gcloud-gke-integrity-monitoring-disabled
+
+info:
+  name: GKE Node Pools Without Integrity Monitoring
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Integrity Monitoring is enabled for your Google Kubernetes Engine (GKE) cluster nodes to monitor and automatically check the runtime boot integrity using Google Cloud Monitoring service. This feature helps verify that the boot loader and other measured components remain untampered.
+  impact: |
+    Without Integrity Monitoring enabled, there is no automated verification of boot integrity for cluster nodes, making it harder to detect potential tampering or compromises of the boot components.
+  remediation: |
+    Re-create your node pools with Integrity Monitoring enabled using:
+    gcloud container node-pools create POOL_NAME --cluster=CLUSTER_NAME --shielded-integrity-monitoring
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-integrity-monitoring.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,monitoring,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+      for(let nodePool of iterate(template.nodePools)){
+        nodePool = JSON.parse(nodePool)
+        set("nodePoolName", nodePool.name)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools list --cluster $clusterName --location $location --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: nodePools
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools describe $nodePoolName --cluster $clusterName --location $location --project $projectId --format="yaml(config.shieldedInstanceConfig.enableIntegrityMonitoring)"
+
+    matchers:
+      - type: word
+        words:
+          - "shieldedInstanceConfig: {}"
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Node pool " + nodePoolName + " in GKE cluster " + clusterName + " (" + location + ") of project " + projectId + " does not have Integrity Monitoring enabled"'
+# digest: 4b0a00483046022100e0450daa83613fb6bb5b9c14ebe08dbf94f072ae5b4ef68f0fa29996e7000921022100eb217161ae34a9d85c7b14d6e35b8eccece9f313377b60b544eda7dde99f7c18:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-intranode-visibility-disabled.yaml

@@ -0,0 +1,76 @@
+id: gcloud-gke-intranode-visibility-disabled
+
+info:
+  name: GKE Clusters Without Intranode Visibility Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that intranode visibility is enabled for your Google Kubernetes Engine (GKE) clusters. This allows you to monitor and troubleshoot network traffic between pods running on the same node, enhancing both visibility and security. When enabled, packets exchanged between Pods are always processed by the VPC network.
+  impact: |
+    Without intranode visibility enabled, you cannot capture flow logs, enforce firewall rules, or use packet mirroring for traffic between pods on the same node, limiting your ability to monitor and secure intra-node communications.
+  remediation: |
+    Enable intranode visibility for your GKE clusters using:
+    gcloud container clusters update CLUSTER_NAME --region=REGION --enable-intra-node-visibility
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/intranode-visibility
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-intranode-visibility.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,networking,visibility,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters describe $clusterName --location $location --project $projectId --format="json(networkConfig.enableIntraNodeVisibility)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"GKE cluster " + clusterName + " in " + location + " of project " + projectId + " does not have intranode visibility enabled"'
+# digest: 4b0a004830460221008899b36800ba2b1293816df2d2f2f4b054b412d5a45f2c8aa6fa0abb79408248022100930a25b265acb2988e89345e9ab7d51d7a9423a094aad1bf3c169d8bb63c6f26:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-labels-missing.yaml

@@ -0,0 +1,75 @@
+id: gcloud-gke-labels-missing
+
+info:
+  name: GKE Clusters Missing Resource Labels
+  author: princechaddha
+  severity: low
+  description: |
+    Ensure that user-defined labels are being used to tag, collect, and organize GKE clusters within your Google Cloud Platform (GCP) projects. User-defined labels are a lightweight and efficient way to group together related or associated cloud resources. These are unrelated to Kubernetes labels.
+  impact: |
+    Without proper resource labels, it becomes difficult to organize, track, and manage GKE clusters effectively, leading to potential operational inefficiencies and cost management challenges.
+  remediation: |
+    Add user-defined labels to your GKE clusters using the 'gcloud container clusters update' command with --update-labels flag or through the Google Cloud Console. Use meaningful labels like environment, team, billing, version, or owner.
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/creating-managing-labels
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/use-labels-for-resource-management.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,labels,management,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters describe $clusterName --location $location --project $projectId --format="json(resourceLabels)"
+
+    matchers:
+      - type: word
+        words:
+          - "null"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"GKE cluster " + clusterName + " in " + location + " of project " + projectId + " does not have any resource labels configured"'
+# digest: 4a0a00473045022100cec40c141ca784c0e611ded193b478d6674d4103b8a7c7f03b6cfe445c636eca022004ecea9e8e1482644003f09fcd28328c7edc3fc19f2c3b1d38850b949e746c24:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-logging-disabled.yaml

@@ -0,0 +1,76 @@
+id: gcloud-gke-logging-disabled
+
+info:
+  name: GKE Clusters Without Cloud Logging Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that logging is enabled for your Google Kubernetes Engine (GKE) clusters to collect logs emitted by your Kubernetes applications and the GKE infrastructure. Once enabled, the logging feature sends logs and metrics to a remote aggregator to reduce the risk of tampering in case of a breach locally.
+  impact: |
+    Without logging enabled, you lack visibility into cluster health, application performance, and security incidents. This makes troubleshooting more difficult and may impact compliance with security standards.
+  remediation: |
+    Enable Cloud Logging for your GKE clusters using:
+    gcloud container clusters update CLUSTER_NAME --region=REGION --logging=SYSTEM,WORKLOAD,API_SERVER,CONTROLLER_MANAGER,SCHEDULER
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/logging
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-and-configure-logging.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,logging,security,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters describe $clusterName --location $location --project $projectId --format="json(loggingService)"
+
+    matchers:
+      - type: word
+        words:
+          - '"loggingService": "none"'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"GKE cluster " + clusterName + " in " + location + " of project " + projectId + " does not have Cloud Logging enabled"'
+# digest: 4a0a004730450221009e4504094846e1c0f9bd8b6b9901658f4f62a4c68c39231429b896973150ef1802203467a6f80cc6546e7c27661cee083291f8932da1e9d9fe0e364b202a367fd01c:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-metadata-server-disabled.yaml

@@ -0,0 +1,94 @@
+id: gcloud-gke-metadata-server-disabled
+
+info:
+  name: GKE Clusters Without Metadata Server Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that GKE Metadata Server is enabled for your Google Kubernetes Engine (GKE) cluster nodes to enhance security by restricting workload access to sensitive instance information. The GKE Metadata Server feature requires Workload Identity for improved authentication and authorization.
+  impact: |
+    Without GKE Metadata Server enabled, pods have unrestricted access to the node's underlying metadata server, which contains sensitive information including kubelet credentials and VM instance identity tokens.
+  remediation: |
+    Enable GKE Metadata Server for your cluster node pools using:
+    gcloud container node-pools update POOL_NAME --cluster=CLUSTER_NAME --workload-metadata-from-node=GKE_METADATA
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-metadata-server.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,security,metadata,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+      for(let nodePool of iterate(template.nodePools)){
+        nodePool = JSON.parse(nodePool)
+        set("nodePoolName", nodePool.name)
+        code(4)
+      }
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools list --cluster $clusterName --location $location --project $projectId --format="json(name)"
+
+    extractors:
+      - type: json
+        name: nodePools
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container node-pools describe $nodePoolName --cluster $clusterName --location $location --project $projectId --format="value(config.workloadMetadataConfig)"
+
+    matchers:
+      - type: word
+        words:
+          - "GCE_METADATA"
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"Node pool " + nodePoolName + " in GKE cluster " + clusterName + " (" + location + ") of project " + projectId + " does not have GKE Metadata Server enabled"'
+# digest: 4a0a004730450220032973e1d5cfb3eca87da458a87738a9748b47831c57c591fb6536e4fbd9ec2a022100ce340afdf94700b4d0ec9782cc9a4bb462793479ed15dee0bdc4b1e2027b5d32:922c64590222798bb761d5b6d8e72950

cloud/gcp/gke/gcloud-gke-monitoring-disabled.yaml

@@ -0,0 +1,76 @@
+id: gcloud-gke-monitoring-disabled
+
+info:
+  name: GKE Clusters Without Cloud Monitoring Enabled
+  author: princechaddha
+  severity: medium
+  description: |
+    Ensure that Cloud Monitoring is enabled for your Google Kubernetes Engine (GKE) clusters to collect metrics emitted by your Kubernetes applications and the GKE infrastructure. Cloud Monitoring helps track cluster health, application reliability, and performance metrics.
+  impact: |
+    Without monitoring enabled, it becomes difficult to identify and address performance bottlenecks, security threats, and potential failures in your GKE clusters. Basic information such as CPU usage, memory usage, and disk usage would not be available for observability metrics.
+  remediation: |
+    Enable Cloud Monitoring for your GKE clusters using:
+    gcloud container clusters update CLUSTER_NAME --region=REGION --monitoring=SYSTEM,API_SERVER,SCHEDULER,CONTROLLER_MANAGER,DAEMONSET,DEPLOYMENT,HPA,POD,STATEFULSET,STORAGE,CADVISOR,KUBELET,DCGM
+  reference:
+    - https://cloud.google.com/kubernetes-engine/docs/how-to/monitoring
+    - https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/GKE/enable-and-configure-cloud-monitoring.html
+  tags: cloud,devops,gcp,gcloud,gke,kubernetes,monitoring,observability,gcp-cloud-config
+
+flow: |
+  code(1)
+  for(let projectId of iterate(template.projectIds)){
+    set("projectId", projectId)
+    code(2)
+    for(let cluster of iterate(template.clusters)){
+      cluster = JSON.parse(cluster)
+      set("clusterName", cluster.name)
+      set("location", cluster.location)
+      code(3)
+    }
+  }
+
+self-contained: true
+
+code:
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud projects list --format="json(projectId)"
+
+    extractors:
+      - type: json
+        name: projectIds
+        internal: true
+        json:
+          - '.[].projectId'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters list --project $projectId --format="json(name,location)"
+
+    extractors:
+      - type: json
+        name: clusters
+        internal: true
+        json:
+          - '.[]'
+
+  - engine:
+      - sh
+      - bash
+    source: |
+      gcloud container clusters describe $clusterName --location $location --project $projectId --format="json(monitoringService)"
+
+    matchers:
+      - type: word
+        words:
+          - '"monitoringService": "none"'
+
+    extractors:
+      - type: dsl
+        dsl:
+          - '"GKE cluster " + clusterName + " in " + location + " of project " + projectId + " does not have Cloud Monitoring enabled"'
+# digest: 4a0a00473045022100c7f351e4167613205be4f5f58df596b99fab803b1b7815cf6fb48597e961dbaa02204d62ac56df1ea09c88adcb73e05ab6d51a11a0c56eb1ed82777c289c8d11e4f2:922c64590222798bb761d5b6d8e72950