🧹 Updating AWS Policies to Align with Recent Developments

[HRouhani]

No description provided.

[mm-weber]

Generally it's a good idea to update the checks to keep in line with the new developments, but there's a problem with changing the asset_filters: of existing checks to other assets.

Many checks have been moved from the single asset, to the cluster asset, which 1) isn't the direction we're moving with checks in general and 2) more importantly, existing customers might have already worked with the single asset checks.

Would be great if we can keep the asset_filter scopes and just update the checks as needed.

[mm-weber]

Thanks for the changes to the checks @HRouhani . Those all look good.

We need to double check and most likely remove all filters: asset.platform == "aws" at group level as those will never allow any of the single asset level variants: to run.

[HRouhani]

@mm-weber It should be fine now, I did it exactly like what we did in Azure, using asset.runtime. You can test all variant using following script:

#!/bin/bash

# List of AWS resource types to check
resource_types=(
  "ssm-instances"
  "ssm-instances-api"
  "ecr"
  "ecs"
  "s3-buckets"
  "cloudtrail-trails"
  "rds-dbinstances"
  "rds-dbclusters"
  "vpcs"
  "security-groups"
  "iam-users"
  "iam-groups"
  "cloudwatch-loggroups"
  "lambda-functions"
  "dynamodb-tables"
  "redshift-clusters"
  "ec2-volumes"
  "ec2-snapshots"
  "efs-filesystems"
  "gateway-restapis"
  "elb-loadbalancers"
  "es-domains"
  "kms-keys"
  "sagemaker-notebookinstances"
  "accounts"
  "ec2-instances-api"
  "instances"
)

# Path to the cnspec binary and the MQL file
cnspec_path="/home/.../cnspec"
bundle="/home/....mondoo-aws-security.mql.yaml"

# Loop over each resource type and execute the scan
for resource in "${resource_types[@]}"; do
  echo "********Discovering the $resource  resources and Starting to scan it respectively.....*********"
  $cnspec_path scan aws -f $bundle --discover "$resource"
done

echo "Scanning completed."

Change the cnspec path to your binary as well as the bundle path.

[mm-weber]

Good stuff @HRouhani !
Thank you.