Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🧹 Updating AWS Policies to Align with Recent Developments #385

Merged
merged 33 commits into from
Apr 21, 2024
Merged

🧹 Updating AWS Policies to Align with Recent Developments #385

Changes from 1 commit
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
3a2f834
first step adding filters
HRouhani Apr 17, 2024
a77b50b
Improving Ensure no root user account access key exists
HRouhani Apr 17, 2024
de691bf
Improving Ensure MFA is enabled for the root user account
HRouhani Apr 17, 2024
59c2d79
Improving Ensure strong account password policy requirements are used
HRouhani Apr 17, 2024
ca8c07b
Improving several more
HRouhani Apr 17, 2024
e45c7ca
Improving Ensure public access to S3 buckets is blocked at the accoun…
HRouhani Apr 18, 2024
873c1e9
Improving Verify Bucket-Level Public Access restrictions for Amazon S…
HRouhani Apr 18, 2024
ef48427
Improving Ensure EC2 instances use IMDSv2
HRouhani Apr 18, 2024
2a54d6a
Improving Ensure VPC flow logging is enabled in all VPCs
HRouhani Apr 18, 2024
0702975
Improving Ensure Lambda functions are configured with function-level …
HRouhani Apr 18, 2024
89e7621
Improving Ensure all RDS instances are not publicly accessible
HRouhani Apr 18, 2024
ecd021d
Variance issue
HRouhani Apr 18, 2024
522c1cf
Improving 2 test redshift and Ensure EBS volumes attached to EC2 inst…
HRouhani Apr 18, 2024
b033605
Improving Ensure EBS snapshots are not publicly restorable
HRouhani Apr 18, 2024
51b382d
Improving Ensure EFS is configured to encrypt file data using KMS
HRouhani Apr 18, 2024
dbdd0f1
Improving Ensure CloudWatch logs are encrypted at rest using KMS CMKs
HRouhani Apr 18, 2024
d40163b
Improving Ensure Application Load Balancers are Configured with delet…
HRouhani Apr 18, 2024
154c654
Improving Ensure Amazon OpenSearch Service Domains are Configured wit…
HRouhani Apr 18, 2024
cb13fab
Improving Ensure rotation for customer created CMKs is enabled
HRouhani Apr 18, 2024
89fed73
Improving Ensure CloudTrail trails are configured to use the server-s…
HRouhani Apr 18, 2024
68235fc
Improving Ensure security groups restrict incoming SSH traffic
HRouhani Apr 18, 2024
0f4cc20
change the version to 3.0.0 as the major changes
HRouhani Apr 18, 2024
4fb1597
Improve Ensure IAM groups have at least one IAM user
HRouhani Apr 18, 2024
5087331
Improve Ensure IAM users receive permissions only through groups
HRouhani Apr 18, 2024
1ca805e
Improve score
HRouhani Apr 18, 2024
cf6858d
adding threshold to Ensure Lambda functions are configured with funct…
HRouhani Apr 19, 2024
df587f7
correcting variance Ensure No Public IP associated with EC2 Instances
HRouhani Apr 19, 2024
d7ed904
correcting variante Ensure EC2 instances use IMDSv2
HRouhani Apr 19, 2024
c5cc015
correcting variant Ensure DynamoDB tables are encrypted with AWS Key …
HRouhani Apr 19, 2024
f87b91e
adding variant for redshift cluster
HRouhani Apr 19, 2024
3de868e
adding variant for Ensure EBS volumes attached to EC2 instances are c…
HRouhani Apr 19, 2024
19fa112
adding variant for Ensure EBS snapshots are not publicly restorable
HRouhani Apr 19, 2024
55caf1f
adding a variant and fixing filters issue
HRouhani Apr 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Improving Ensure EFS is configured to encrypt file data using KMS 
Signed-off-by: Hossein Rouhani <h_rouhani@hotmail.com>
  • Loading branch information
@HRouhani
HRouhani committed Apr 18, 2024
commit 51b382d6adb323b0b76959228eba6361b2c37fc6
5 changes: 2 additions & 3 deletions core/mondoo-aws-security.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1945,7 +1945,7 @@
.where(publiclyAccessible != false)
.none(securityGroups.where(
vpc.routeTables.where(
routes.any(GatewayId == /igw-/ && DestinationCidrBlock == "0.0.0.0/0")

Check failure on line 1948 in core/mondoo-aws-security.mql.yaml

View workflow job for this annotation

GitHub Actions / Run spell check 

`igw` is not a recognized word. (unrecognized-spelling)
)
)
)
Expand All @@ -1956,7 +1956,7 @@
aws.rds.dbinstance.publiclyAccessible == false
aws.rds.dbinstance.securityGroups.none(
vpc.routeTables.where(
routes.any(GatewayId == /igw-/ && DestinationCidrBlock == "0.0.0.0/0")

Check failure on line 1959 in core/mondoo-aws-security.mql.yaml

View workflow job for this annotation

GitHub Actions / Run spell check 

`igw` is not a recognized word. (unrecognized-spelling)
)
)
- uid: mondoo-aws-security-rds-instance-public-access-check
Expand Down Expand Up @@ -2232,9 +2232,8 @@
filters: |
asset.platform == "aws-efs-filesystem"
mql: |
aws.efs.filesystems
.where(id == asset.name)
.all(encrypted == true && kmsKey != null)
aws.efs.filesystems.all(encrypted == true)
aws.efs.filesystems.all(kmsKey != empty)
docs:
desc: |
Amazon EFS supports two forms of encryption for file systems, encryption of data in transit and encryption at rest. This check ensures that all EFS file systems are configured with encryption at rest across all enabled regions in the account.
Expand Down
Loading