Get Started
Infrastructure Security Database
This is a custom database of cloud infrastructure security rules that CodeAnt AI scans in any given infrastructure. Every policy in this database explains why it is important, what the impact is if it is violated, and how to implement a fix for it.
Alibaba Cloud OSS bucket accessible to public
Alibaba Cloud OSS bucket accessible to public
- The Alibaba Cloud OSS bucket accessible to public policy is crucial because it dictates who can access the stored data. If the policy is misconfigured, sensitive data could be exposed to unauthorized individuals, resulting in a potential data breach.
- This policy impacts the overall security posture of a network. If a bucket is publicly accessible, it increases the attack surface. Hackers can exploit the data for information, resulting in cyber-crimes like identity theft, credit card fraud, or corporate espionage.
- This policy is implemented using Terraform, a popular Infrastructure as Code (IaC) tool. IaC makes configuration changes traceable, facilitating auditing and reducing the likelihood of unauthorized changes going unnoticed. Terraform’s ability to version control also aids in maintaining consistent security settings.
- With this policy in place for the ‘alicloud_oss_bucket’ resource type, IT teams can enforce best practices for Alibaba Cloud OSC bucket permissions, bolstering data security. They can easily ensure that public access to data is controlled, monitored, and secure, thus promoting regulatory compliance and protecting critical data assets.
Ensure no security groups allow ingress from 0.0.0.0:0 to port 22
Ensure no security groups allow ingress from 0.0.0.0:0 to port 22
- The policy puts a curb on unauthorized access to your EC2 instances by ensuring that none of your security groups allow unrestricted ingress (inbound traffic) to port 22, which is typically used for Secure Shell (SSH) connections.
- If ingress from 0.0.0.0/0 to port 22 is permitted, it exposes your resources to potential attack from any IP address, thereby introducing a significant security risk.
- This policy enforces the principle of least privilege, a critical security concept that implies that a user or system must only be able to access the information and resources necessary for its legitimate purpose, by limiting who can attempt to connect to your instances.
- By enforcing this policy, it reduces the likelihood of a successful brute-force attack as it limits the IP range that can directly interact with port 22, effectively making your resources less visible and reducing the attack surface.
Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389
Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389
- This policy is crucial to prevent unauthorized remote access, as it restricts public ingress from any IP address (0.0.0.0/0) to port 3389, commonly used for remote desktop protocol (RDP) connections.
- It minimizes the attack surface of your infrastructure by significantly reducing exposure to potential brute-force attacks and intrusion attempts targeting the widely exploited RDP port.
- If not implemented, it opens the possibility for attackers to breach, take control of, or disrupt the operation of the network resources protected by the security group, potentially leading to data breaches and severe operational disruptions.
- The policy is designed to enforce best practices in infrastructure, using Infrastructure as Code (IaC) to automate and standardize cloud environment configurations, lowering the likelihood of human error and significantly improving overall security postures.
Ensure Action Trail Logging for all regions
Ensure Action Trail Logging for all regions
- Ensuring Action Trail Logging for all regions enhances monitoring capabilities by keeping a record of every action taken across all resources located in various regions of Alibaba Cloud (AliCloud) network, improving the visibility of operations within the infrastructure.
- The policy automates the process of enabling logs for every region in AliCloud, which significantly reduces the possibility of human errors, such as forgetting to turn on logging for a region, thereby ensuring continuous security monitoring and consistency.
- This policy, when implemented using Infrastructure as Code (IaC) tool like Terraform, makes infrastructure management more scalable and efficient as Terraform allows managing service configurations not just individually but as an entire data center.
- By enforcing this policy, cloud audits become more effective as logs from all regions can be used for deep investigations when a security incident occurs. This could speed up incident response times and improve data availability for forensic analysis.
Ensure Action Trail Logging for all events
Ensure Action Trail Logging for all events
- This policy ensures that all actions performed in the environment are logged, providing a comprehensive auditing capability. This bolsters accountability by allowing tracking and monitoring of activities performed by each user.
- The ‘Action Trail Logging for all events’ policy helps in troubleshooting by providing event history, which can be used to identify and understand the actions that occurred just before a problem emerged.
- It enhances security by enabling the detection of irregularities and potential security incidents. If an unauthorized or anomalous activity is detected, immediate action can be taken to mitigate potential damage.
- By implementing this policy using Terraform infrastructure as code (IaC), it ensures a more consistent and efficient deployment. This approach minimizes the possibility of error while simultaneously maintaining a high level of security across all resources mentioned in the ‘alicloud_actiontrail_trail’.
Ensure OSS bucket is encrypted with Customer Master Key
Ensure OSS bucket is encrypted with Customer Master Key
- The policy ensures that the data stored in alicloud_oss_bucket is encrypted using Customer Master Key (CMK), enhancing the confidentiality and integrity of the information when it is at rest, preventing unauthorized access.
- By mandating encryption through a customer managed key, it enables the user to have control of the key management, i.e., the rotation, deletion and use of the encryption key, adding an extra layer of security.
- The policy encourages user responsibility and accountability. As the user has control over the encryption key, they also have an obligation to maintain its security, fostering a proactive approach towards data protection.
- Non-fulfillment of the policy can lead to data breaches as it leaves the data in alicloud_oss_bucket vulnerable to attacks and unauthorized access, which can have considerable financial and reputational impacts.
Ensure disk is encrypted
Ensure disk is encrypted
- Encrypting the disk in alicloud_disk resources ensures the confidentiality and integrity of data stored, even if the physical hardware is compromised, reducing the potential impact of data breaches.
- Implementing this policy via Terraform’s Infrastructure as Code approach allows for consistency, predictability, and scalability in enforcing encryption across multiple disk resources.
- When disk encryption is enforced, it hampers the ability of unauthorized individuals to read or alter sensitive data, thus limiting the opportunities for exploitation of stolen data.
- Non-compliance with this policy could pose significant risks to data privacy and may contravene legal or regulatory requirements for data protection, leading to potentially significant penalties.
Ensure Disk is encrypted with Customer Master Key
Ensure Disk is encrypted with Customer Master Key
- This policy ensures that data stored on alicloud_disk is encrypted using a Customer Master Key (CMK), thus providing an additional level of security that prevents unauthorized access.
- Encrypting disk with a CMK enhances data protection by allowing customers to manage and control the keys used to encrypt and decrypt their data which may contain sensitive information.
- Implementing the policy as an Infrastructure as Code (IaC) through Terraform allows automated and consistent application of security measures across different environments, reducing the risk of human errors.
- Non-compliance with the policy may pose security risks as unencrypted data may be easily accessible and can be misused if it falls into the wrong hands, potentially causing financial loss, reputational damage, and regulatory issues for entities.
Ensure database instance is not public
Ensure database instance is not public
- Ensuring a database instance is not public is critical to mitigate unauthorized access and potential data breaches, as it prevents any unauthorized guest or foreign source from remotely accessing or manipulating the data.
- Keeping database instances private also aids in safeguarding sensitive information such as user credentials, customer data, and financial data that the database could be storing, thereby maintaining the business’s integrity and user trust.
- Implementing this policy helps organizations comply with legal and industry-standard data privacy regulations as data exposure can lead to hefty penalties, possible legal action, and loss of reputation.
- Using Infrastructure as Code (IaC) tool Terraform, specifically the ‘alicloud_db_instance’ resource, can enforce this security rule programmatically across the infrastructure, ensuring consistency and reduced human error, thereby strengthening the overall security posture.
Ensure OSS bucket has versioning enabled
Ensure OSS bucket has versioning enabled
- Enabling versioning on an Alicloud OSS bucket is crucial because it allows you to preserve, retrieve, and restore every version of every file in your bucket, thus preventing data loss from both unintended user actions and application failures.
- When versioning is enabled on an OSS bucket, even when a file gets accidentally deleted or overwritten, a previous version of the file can be retrieved ensuring business continuity and maintaining the integrity of data.
- This security policy aids in meeting compliance and audit requirements. Most industry standards and regulations (like HIPAA, GDPR, and PCI-DSS) require maintaining various versions of data over time and having the ability to restore previous file versions.
- Using Infrastructure-as-Code (IaC) tool like Terraform to automate the enforcement of this policy mitigates the risk of manual errors and ensures a consistent and secure setup across all OSS buckets.
Ensure OSS bucket has transfer Acceleration enabled
Ensure OSS bucket has transfer Acceleration enabled
- Enabling Transfer Acceleration on an OSS bucket in Alibaba Cloud optimizes and increases the speed of transferring data to and from OSS, essentially making file uploads and downloads quicker.
- The policy ensures improved performance by rerouting internet traffic from the client to the bucket through Alibaba Cloud’s edge locations, reducing network latency.
- It minimizes the risk of failed transactions and enhances user experience, especially critical when dealing with high volumes of data or international data transfers.
- Non-compliance to this policy could lead to inefficient data transfer, slower operations, possible business disruptions and added costs due to inefficiencies in the data migration process.
Ensure the OSS bucket has access logging enabled
Ensure the OSS bucket has access logging enabled
- Enabling access logging on the OSS bucket is important as it provides a record of all requests made against the bucket, offering visibility and transparency into who is accessing the bucket and how they are using the data.
- Access logs serve as a critical component in monitoring and auditing activities, it helps in identifying suspicious activities or breaches and can be used for forensics in the event of a security incident.
- The rule impacts the overall security posture by enforcing the logging of access events, resulting in improved control and management of data access, and reduced risk of unauthorized activity going undetected.
- Through the Terraform link provided, entities can programmatically ensure that their OSS buckets comply with this policy, promoting consistent adherence to security best practices across all alicloud_oss_bucket resources.
Ensure RAM password policy requires minimum length of 14 or greater
Ensure RAM password policy requires minimum length of 14 or greater
- Ensuring a minimum password length of 14 or greater enhances the security of the alicloud_ram_account_password_policy resource by making it more difficult for unauthorized individuals to guess or crack the password, therefore protecting infrastructure from potential breaches.
- This policy enhances the effectiveness of Terraform’s Infrastructure as Code (IaC) capabilities by enforcing good security practices in an automated and reproducible manner, reducing the risk of human error.
- It helps organizations to comply with best practices and regulatory standards related to password complexity and security, potentially protecting against penalties or reputational damage associated with non-compliance.
- Implementing this policy using the provided RAMPasswordPolicyLength.py script can help to streamline the security process, making it easier for administrators to ensure consistent and ongoing adherence to the policy across the entire infrastructure.
Ensure RAM password policy requires at least one number
Ensure RAM password policy requires at least one number
- This policy enhances the security of the alicloud_ram_account_password_policy entity by ensuring that the passwords are not easily predictable. Incorporating at least one number in RAM password makes it more complex and reduces the chances of unauthorized access through brute force or dictionary attacks.
- Execution of this specific infra security policy allows compliance with standard cybersecurity practices for passwords. Many cybersecurity benchmarks and regulations mandate the use of alphanumeric passwords to increase security.
- Checking this policy’s implementation helps in risk assessment and vulnerability management of your Terraform-deployed resources. Detecting any non-compliance or weak passwords can help prevent potential data breaches or unauthorized modifications of your deployed resources.
- The implementation of this policy using Infrastructure as Code (IaC) tool Terraform, makes it easier to enforce this password criterion across the entire infrastructure. It’s much more efficient and less prone to errors compared to manually setting and checking password policies.
Ensure RAM password policy requires at least one symbol
Ensure RAM password policy requires at least one symbol
- This policy enhances the security of the Alicloud account by requiring the inclusion of at least one symbol in a password, making it more complex and not easily guessed or broken by brute-force attacks.
- It enforces good password hygiene practice which reduces the risk of unauthorized access to important infrastructure resources and sensitive data stored in the Alicloud RAM account.
- The specified Terraform IaC checks the password policy resource in Alicloud to ensure that it complies with this regulation, providing an automated and reliable way to manage and enforce this critical security measure.
- Non-compliance with this policy could potentially result in compromised accounts, leading to data breaches, loss of confidentiality and possible non-compliance with data protection regulations.
Ensure RAM password policy expires passwords within 90 days or less
Ensure RAM password policy expires passwords within 90 days or less
- This policy reduces the risk of unauthorized access by ensuring that passwords are not static and are frequently updated, thus reducing the impact of any previous compromise to an account’s credentials.
- An expiration period of 90 days strikes a balance between security and convenience. Passwords that are seldom changed can become a security vulnerability, whereas passwords that are changed too frequently can lead to users forgetting them or keeping them noted insecurely.
- Noncompliance with this policy could lead to a potential increase in security breach incidents due to the usage of outdated or compromised credentials, causing financial and reputational damage.
- Regular password expiration encourages users to create stronger, complex passwords, improving the overall security of the alicloud_ram_account_password_policy resource and preventing brute-force attacks.
Ensure RAM password policy requires at least one lowercase letter
Ensure RAM password policy requires at least one lowercase letter
- This policy enhances the security by adding a degree of complexity to the password, thus reducing the risk of brute force or dictionary attacks on alicloud_ram_account_password_policy.
- By requiring at least one lowercase letter in RAM passwords, it makes the password pool larger, hence increasing the time required for potential unauthorized attacks to guess or crack the password.
- As the policy is enacted through Infrastructure as Code (IaC) using Terraform, it ensures consistent application of this security rule across all instances, improving overall system security.
- Non-compliance to this policy could lead to weaker passwords that leave the infrastructure and its resources on AliCloud more susceptible to various types of cyber threats and attacks.
Ensure RAM password policy prevents password reuse
Ensure RAM password policy prevents password reuse
- The policy ensures that old passwords aren’t reused, providing an extra layer of security against attackers who might have gained access to previous passwords, thus making a brute force attack more difficult.
- It promotes the use of unique passwords for the alicloud_ram_account_password_policy, reducing the risk of a security breach due to password compromise.
- Through this policy, password complexity is increased as users cannot fall back on previously used easier-to-remember passwords, forcing them to create new and potentially more secure ones.
- The policy’s implementation via Infrastructure as Code (IaC) tool Terraform ensures that it can be applied consistently across infrastructure, reducing the potential for human error in manual security configurations.
Ensure RAM password policy requires at least one uppercase letter
Ensure RAM password policy requires at least one uppercase letter
- Ensuring the RAM password policy requires at least one uppercase letter enhances the complexity of passwords, making it harder for unauthorized individuals to guess or decode passwords.
- This policy directly contributes to reducing the risk of security breaches as an attacker would need more attempts to ‘brute force’ a password, preventing quick unauthorized access to critical resources.
- Implementing this policy through IaC Terraform allows automated enforcement and consistent deployment across the infrastructure, minimizing human error and enhancing overall security.
- Enforcing this policy on ‘alicloud_ram_account_password_policy’ ensures the security of account-level access in the Alibaba Cloud platform, protecting user information and system configurations stored in the RAM.
Ensure RDS instance uses SSL
Ensure RDS instance uses SSL
- Ensuring RDS instance uses SSL enhances data security by encrypting the data that is transmitted between the RDS instance and the application, thus limiting the possibility of data leakage or interception during transmission.
- Implementing this policy using Terraform for Alibaba Cloud instances protects against various types of threats, like ‘man-in-the-middle’ attacks, where an unauthorized entity can eavesdrop or manipulate the communication between the RDS instance and the client.
- Non-compliance with the policy increases the risk of potential breaches as the data could be read by anyone who manages to intercept the communication, which could have significant legal, financial, and reputational implications.
- Since SSL certificates also provide authentication, this policy ensures that the communication is sent only to the correct RDS instance and is not diverted to a malicious server, thereby enhancing the overall trust in cloud-based services.
Ensure API Gateway API Protocol HTTPS
Ensure API Gateway API Protocol HTTPS
- Ensuring API Gateway API protocol HTTPS contributes to the secure transmission of data in the alicloud_api_gateway_api, effectively preventing unwanted third parties from intercepting or tampering with this data.
- Using HTTPS protocol in API Gateway assures the authenticity of the server. Clients can trust the server they communicate with, as it’s too complex for attackers to convincingly fake an HTTPS-enabled API.
- Implementing this policy can help a company with compliance efforts, such as General Data Protection Regulation (GDPR) and other data protection laws, as secure data transmission is often a significant requirement in this legislation.
- Usage of Terraform allows for Infrastructure as Code (IaC) that makes managing and provisioning technical infrastructure more efficient and less error-prone. If HTTPS is not used, the benefits of IaC can be offset by the security vulnerability.
Ensure Transparent Data Encryption is Enabled on instance
Ensure Transparent Data Encryption is Enabled on instance
- Enabling Transparent Data Encryption (TDE) on Alicloud DB Instance is crucial as it helps in preventing unauthorized access to data by encrypting it at storage level, ensuring data security and privacy.
- This policy, when implemented with the help of Terraform, can automate the process of enabling TDE, thereby reducing the chances of human errors and improving speed and efficiency in protecting sensitive data.
- A disabled TDE can result in non-compliance with several key industry regulations and standards related to data security, such as GDPR or HIPAA, which could lead to legal penalties and loss of customer trust.
- If TDE is not enabled, it increases the risks associated with breaches of sensitive data and could potentially lead to significant financial loss, reputational damage or operational disruption.
Ensure Ram Account Password Policy Max Login Attempts not > 5
Ensure Ram Account Password Policy Max Login Attempts not > 5
- This policy ensures that only a maximum of five login attempts is allowed to prevent unauthorized users from gaining access to your Alicloud RAM account through brute force attacks, thereby reducing the risk of security breaches.
- It aids in enforcing a strict password management policy, thereby creating a robust security infrastructure that protects valuable RAM account data.
- Non-compliance with this policy might lead to an increased risk of unauthorized access, leading to potential data theft, system misuse, or disruption to business operations.
- The policy’s implementation using Infrastructure as Code (IaC) provider Terraform ensures consistency and repeatability, making it scalable across multiple systems, and simplifying security management.
Ensure RAM enforces MFA
Ensure RAM enforces MFA
- Enforcing MFA (Multi-Factor Authentication) on RAM (Relational Database Service) increases security by adding an extra layer of identity verification, beyond usernames and passwords, thereby minimizing unauthorized access to critical data.
- This policy mitigates the risk of breaches resulting from stolen or guessed credentials, significantly reducing potential damages to the organization’s resources and reputation.
- Implementing this policy using Infrastructure as Code (IaC) tool like Terraform ensures that the requirement of MFA is established as a standard security measure, thereby ensuring consistency across all alicloud_ram_security_preference resources.
- Non-compliance with this policy can expose the alicloud_ram_security_preference resources to potential security risks and may violate regulatory compliance requirements related to information security and data protection.
Ensure RDS Instance SQL Collector Retention Period should be greater than 180
Ensure RDS Instance SQL Collector Retention Period should be greater than 180
- This policy ensures that data collected from SQL Server queries on RDS instances is retained for a sufficient length of time, over 180 days, allowing for detailed analysis and security reviews. Inadequate retention limits may lead to loss of crucial forensic data.
- It helps in supporting compliance with data retention regulations and standards such as GDPR and HIPAA which require certain types of data to be stored for defined periods. If the retention period is less than 180 days, it could lead to non-compliance issues and potential legal consequences.
- Setting a longer retention period for SQL Collector data aids in identifying historical trends and long-term performance metrics. Insight into usage patterns establishes baselines for normal activity and supports anomaly detection.
- This policy also reinforces the importance of data retention for effective incident response. If an incident occurs, having a longer retention period enables a more thorough root cause analysis, which contributes to effective preventive strategies.
Ensure Kubernetes installs plugin Terway or Flannel to support standard policies
Ensure Kubernetes installs plugin Terway or Flannel to support standard policies
- This policy is crucial because it enforces the installation of either the Terway or Flannel plugin for Kubernetes, both of which support network policies that allow you to govern how pods communicate with each other and with other network endpoints, directly enhancing the security of your deployments.
- It helps to maintain the consistency and predictability of network traffic among pods, thereby improving the overall reliability and performance of applications running in the Kubernetes environment, and reducing the risk of network connectivity issues affecting your resources.
- The use of Infrastructure as Code (IaC) tool like Terraform in implementing this policy makes it possible to automate the installation and configuration process, enhancing efficiency and ensuring that network policies are consistently enforced across all Kubernetes clusters, avoiding human error.
- By maintaining the standardization of network policies across different Kubernetes environments in Alibaba Cloud (alicloud_cs_kubernetes), this policy can assist with compliance to regulations or internal security standards, making audits more straightforward and reducing potential penalties for non-compliance.
Ensure KMS Key Rotation is enabled
Ensure KMS Key Rotation is enabled
- Enabling KMS Key Rotation in AliCloud enhances data security by periodically changing the backend cryptographic key, thus decreasing the probability of successful brute force attacks or key leaks.
- As the policy is implemented via Terraform, any infrastructure-as-code security errors associated with key rotation could be avoided, increasing reliability and robustness by ensuring policy adherence during resource creation.
- This policy specifically targets the ‘alicloud_kms_key’ resource, ensuring each key used in Alibaba Cloud services is consistently rotated, thereby maintaining cryptocurrency security across multiple services and applications.
- Failure to enable regular KMS key rotation can potentially expose sensitive data, or compromise the entire system, and can also lead to non-compliance with various regulatory standards, inviting legal repercussions and brand reputation damage.
Ensure KMS Keys are enabled
Ensure KMS Keys are enabled
- Enabling KMS Keys is crucial for the secure management of cryptographic keys, ensuring that data encryption and decryption procedures can run smoothly on the AliCloud platform.
- If KMS Keys are disabled, access to important encrypted data may be lost or hindered, leading to potential operational disruptions and loss of business-critical information.
- Compliance with this policy ensures that alicloud_kms_key resources are readily available for use, facilitating secure communication and transactions by providing consistent encryption and decryption services.
- Implementing this policy through Infrastructure as Code (IaC) using Terraform allows for efficient key management across multiple servers or environments, enabling secure processes and adherence to security best practices in an automated, error-free manner.
Alibaba ALB ACL does not restrict Access
Alibaba ALB ACL does not restrict Access
- This policy ensures that access to the Alibaba Application Load Balancer (ALB) Access Control List (ACL) is restricted to certain users or entities. This is necessary to prevent unauthorized individuals or systems from gaining access to sensitive information or from manipulating the load balancer’s behavior.
- Having unrestricted access to the ALB ACL can lead to various security threats. Attackers can potentially gain unrestricted access to your network or applications, exploit vulnerabilities, or launch Denial of Service (DoS) attacks on your system.
- Enforcing this policy would mean limiting the number of entities that can make changes to the ACL, which in turn minimizes the potential attack surface. A smaller number of authorized entities potentially increases the difficulty for any attacker trying to compromise system security.
- The application of the policy on Terraform’s Infrastructure as Code (IaC) system streamlines the enforcement of access restrictions applied via ALB ACL, making it more efficient to establish and maintain robust security measures.
Ensure RDS instance auto upgrades for minor versions
Ensure RDS instance auto upgrades for minor versions
- Ensuring RDS instance auto-upgrades for minor versions significantly improves the security posture of a system as it applies the latest security patches automatically, protecting the system from known vulnerabilities.
- Auto-upgrades of minor versions can enhance operational efficiency as it eliminates manual intervention for system updates, minimizing downtime and allowing the IT team to focus on other critical tasks.
- The implementation of this policy via Infrastructure-as-Code (IaC) tool, Terraform, provides consistency and repeatability, thereby reducing the potential for human error during configuration.
- Compliance with this policy ensures that the system is always running the latest and possibly most stable version of the software which, apart from security, can also influence performance and availability of an application using the RDS instance.
Ensure K8s nodepools are set to auto repair
Ensure K8s nodepools are set to auto repair
- Enabling the auto repair feature in K8s nodepools ensures that nodes which fail health checks are automatically repaired, maintaining the stability and efficiency of the Kubernetes cluster and reducing potential downtime.
- This policy helps automate the process of identifying and resolving issues associated with a node’s health, minimizing the need for manual intervention and enabling more rapid response to potential infrastructure problems.
- By utilizing the Infrastructure as Code (IaC) tool Terraform to implement this policy, changes and updates to infrastructure configurations can be executed consistently and reliably, reducing the risk of human errors and inconsistencies.
- The implementation of this policy specifically impacts the ‘alicloud_cs_kubernetes_node_pool’ resource, supporting the efficient management and maintenance of Alibaba Cloud Container Service for Kubernetes (ACK) nodepools.
Ensure launch template data disks are encrypted
Ensure launch template data disks are encrypted
- Ensuring launch template data disks are encrypted protects potentially sensitive data from unauthorized access, adding an additional layer of security to your cloud infrastructure.
- This policy directly affects alicloud_ecs_launch_template entities, implying that any user data or application data stored on these entities will be secure, even if the physical storage is compromised.
- This security policy applied through Infrastructure as Code (IaC) such as Terraform, would enhance automation and enforce consistent security rules across all instances, reducing manual error and resource dependency.
- Not encrypting data disks can cause compliance violations and potential fines if the organization is subject to regulations concerning data protection and privacy such as GDPR, HIPAA or SOX, thus enforcing this policy ensures regulatory compliance.
Alibaba Cloud Cypher Policy are secure
Alibaba Cloud Cypher Policy are secure
- The Alibaba Cloud Cypher Policy ensures that all encrypted communications between the client and server use a secure version of cyphers that protect data from eavesdropping, third-party theft, and alterations in transit.
- The policy being secure inhibits threat actors’ ability to exploit any vulnerabilities in the encryption and decryption process, thereby providing a safe environment for sensitive data or personal information housed on the Alibaba cloud platform.
- Enforcing this policy using Infrastructure as Code practices like Terraform automates the management of secure resources, making the task more scalable, efficient, and less prone to manual error.
- The policy is particularly essential for the ‘alicloud_slb_tls_cipher_policy’ resource, which manages the Server Load Balancer (SLB) Transport Layer Security (TLS) cipher policy, as it ensures secure network traffic management and boosts the overall security posture of the alibaba cloud infrastructures.
Ensure RDS instance has log_duration enabled
Ensure RDS instance has log_duration enabled
- Ensuring that RDS instance has log_duration enabled is crucial for auditing purposes and maintaining the integrity of the database. It allows for the tracking of session lengths and the time duration of certain commands, which can be used in detailed analysis and investigation of any suspicious activities.
- With this policy in place, potential performance issues can be easily diagnosed. Long duration logs provide critical insights into the detailed operations, helping identify any resource-intensive or time-consuming processes that may be affecting the overall performance of your RDS instance.
- Compliance with certain regulatory requirements might require logging to be enabled on database systems. Therefore, having the policy of enabling log_duration on RDS instances will ensure organizations adhere to these regulations, avoiding potential fines or sanctions.
- The policy also aids in the resolution of technical issues or bugs by offering an invaluable source of information for technical support teams. It can provide a trace of what might have led to an issue, making error detection and troubleshooting quicker and more precise.
Ensure RDS instance has log_disconnections enabled
Ensure RDS instance has log_disconnections enabled
- Enabling log_disconnections in RDS instances provides vital data on when and how a client was disconnected from a database, allowing for effective monitoring and troubleshooting of database accessibility issues.
- It increases the security of the infrastructure by tracking and logging any unauthorized or abnormal disconnections, which could signal potential security breaches or hacking attempts.
- With the implementation via Terraform, as outlined in the resource link, automation and consistency across all alicloud_db_instance resources can be ensured, reducing the risk of human error or overlooked instances.
- In the case of any disruptions or performance issues, having log_disconnections enabled allows for a quicker response and resolution, minimizing potential downtime and loss of service for users.
Ensure RDS instance has log_connections enabled
Ensure RDS instance has log_connections enabled
- Enabling log_connections on AliCloud RDS instances allows the tracking of all connections and disconnections to the database. This aids in understanding the database’s usage patterns and identifying any unusual or unauthorized access attempts.
- By setting log_connections to true, detailed logs are produced that can provide insights into the types of queries being run, their performance, and who is running them. This can improve accountability and assist in debugging and optimizing applications.
- The generated logs can be used for audit purposes, providing a record of who accessed what data, when, and from where. This can help in maintaining regulatory compliance and investigating any data breaches or misuse.
- Without log_connections enabled, it becomes significantly harder to identify and address the root causes of database performance issues, security incidents, or transaction failures. This can reduce system reliability, negatively impact system security, and delay incident response times.
Ensure log audit is enabled for RDS
Ensure log audit is enabled for RDS
- Enabling log audit for RDS is essential as it allows logging and monitoring of all activities happening in the database. This enhances the traceability of actions performed by users and systems, assisting in identifying any potential breaches or security issues.
- Log auditing aids in compliance with various regulations and standards related to data security and privacy. Organizations under such regulations need to ensure complete visibility of data access and manipulation, which is made possible by activated log audits.
- Potential database problems or performance issues can be spotted and diagnosed early by examining the logs. Timely detection of faults allows prompt intervention, reducing the impacts of downtime and maintaining high availability of the database.
- Log audit is integral to incident response and forensics. In case of a security breach, the logs provide crucial information on what happened, when, and how. This can aid in the investigation and understanding the extent of the damage, enabling effective recovery and future preventative actions.
Ensure MongoDB is deployed inside a VPC
Ensure MongoDB is deployed inside a VPC
- This policy ensures that MongoDB instances are isolated within a private Virtual Private Cloud (VPC), mitigating the risk of security threats by reducing direct exposure of the database to the internet.
- By enforcing this policy, organizations can have tight control over MongoDB’s network settings, enabling them to manage inbound and outbound traffic, thereby preventing unauthorized data access and ensuring data confidentiality.
- This policy promotes the infrastructure-as-code (IaC) practices using Terraform for creating MongoDB instances with standardized configurations. It simplifies and automates the process of implementing and maintaining MongoDB deployments in a secure environment.
- Implementing MongoDB within a VPC improves security governance by providing fine granular access control, thereby offering a robust and dedicated environment that ensures the integrity and availability of the database service.
Ensure Mongodb instance uses SSL
Ensure Mongodb instance uses SSL
- Enforcing this policy ensures the encryption of data in transit between the MongoDB instance and client applications, safeguarding it from potential eavesdropping or data leakage, which can cause significant security issues including data breaches.
- SSL is a widely-accepted security protocol for establishing secure connections. Without it, attackers could intercept communications and gain unauthorized access to sensitive data, which might open avenues for malicious manipulations.
- Non-compliance with standards and regulations related to data transmission security can also lead to significant financial penalties. Utilizing SSL for MongoDB instances helps meet these compliance requirements, mitigating potential legal risks.
- Using SSL also helps in confirming the identity of the MongoDB instance. It provides assurance to the client applications that they are communicating with the correct MongoDB instance and not a forged one, effectively preventing potential security breaches like Man-in-the-Middle attacks.
Ensure MongoDB instance is not public
Ensure MongoDB instance is not public
- This policy is important to ensure the privacy and security of data stored in the MongoDB instance. If the instance is public, the data could be accessed and potentially manipulated by unauthorized users.
- The implementation of this policy helps in adhering to best practices for database security by restricting public access, thus reducing the attack surface and chances of data breach incidents.
- By ensuring the MongoDB instance is not public, critical system or customer information stored in the database are shielded from potential hackers or malicious entities looking to exploit open databases.
- The policy also influences the reliability of the application using the MongoDB instance. If unauthorized changes could be made because the instance is public, those changes might disrupt the normal functioning of the application.
Ensure MongoDB has Transparent Data Encryption Enabled
Ensure MongoDB has Transparent Data Encryption Enabled
- This policy ensures that data at rest in MongoDB is protected by enabling transparent data encryption, adding a crucial layer of security to protect sensitive data from unauthorized access or breaches.
- Transparent Data Encryption prevents potential attackers from bypassing the database and reading sensitive data directly from physical files, thus protecting data even if the physical media (hard disks, backups) are compromised.
- By enforcing this policy via Infrastructure as Code (IaC) tool like Terraform, it helps to automate the security settings across all instances of MongoDB in an organization, thus maintaining consistent security standards and reducing manual configuration errors.
- Non-compliance to this policy could result in exposing the content of database files to malicious actors that can access the file system, leading to possible data leakage, privacy breaches, regulatory violations, and reputational damage to the organization.
Ensure that certificate validation isn't disabled with uri
Ensure that certificate validation isn't disabled with uri
- This security policy is important as it ensures that the certificate validation feature, when making network requests using Ansible modules, is not disabled. This prevents bad actors from exploiting unencrypted network connections which could potentially compromise sensitive data.
- The policy reinforces the security of remote servers as it maintains an enforced level of trust between the client-side Ansible module and the server it is interacting with. If validation is disabled, it may allow communication with untrusted or malicious servers.
- Following this policy can help in avoiding MITM (Man-in-the-Middle) attacks as certificate validation helps to confirm the identity of the remote server. Disabling this might allow data to be intercepted, manipulated or stolen.
- It also reduces the chances of intrusion in mission-critical infrastructure. A breech due to disabling certificate validation can interrupt workloads, cause data loss and lead to downtime impacting business operations.
Ensure that certificate validation isn't disabled with get_url
Ensure that certificate validation isn't disabled with get_url
- Ensuring certificate validation isn’t disabled with get_url in Ansible is crucial as it mitigates the risk of Man-In-The-Middle (MITM) attacks by confirming that the server’s SSL certificate is valid and trusted.
- It boosts the integrity of the data across the network as the validation checks the identity of the server, and prevents from inadvertently downloading malicious content from spoofed servers, protecting the infrastructure.
- The policy enhances security by preventing exposure of sensitive data. If certificate validation is skipped, encrypted data could be intercepted, decrypted, and then manipulated by attackers.
- Non-compliance with this policy translates to a serious security flaw in the Ansible infrastructure, which may leave the entire system vulnerable to attacks; hence, it is essential to follow this policy for creating a secure and reliable infrastructure.
Ensure that certificate validation isn't disabled with yum
Ensure that certificate validation isn't disabled with yum
- Ensuring certificate validation with yum is crucial as it verifies the authenticity of packages being installed, deterring malicious packages or replications from being installed in the system, which can compromise data and system safety.
- If the ‘yum’ package manager certificate validation is disabled, it may leave your infrastructure open to Man-in-the-Middle (MITM) attacks because without validation, yum can’t confirm the source of packages and updates.
- The policy aligns with the best practices of Secure Software Development Lifecycle (SSDLC) and it aids in maintaining the performance and security of the system, by ensuring only secure and authenticated packages are being introduced.
- Ensuring certificate validation is not disabled with ansible.builtin.yum is importantly aligned with regulatory compliance guidelines. Non-compliance might make organization liable to litigation, penalties or loss of trust amongst clients and customers.
Ensure that SSL validation isn't disabled with yum
Ensure that SSL validation isn't disabled with yum
- This policy ensures that Secure Socket Layer (SSL) protocols aren’t disabled when using ‘yum’, a package manager for the Linux operating system. SSL provides a secure channel for sending sensitive data over insecure networks, contributing to the preservation of data integrity and confidentiality.
- Disabling SSL validation compromises ‘yum’ security, making it susceptible to man-in-the-middle attacks where an attacker can intercept and possibly alter communication between two parties who believe they are directly communicating with each other. This policy serves as a safeguard against such threats.
- The policy, when enforced, ensures the authenticity of the server to which ‘yum’ connects. By ensuring the server’s certificate is issued by a trusted Certificate Authority (CA), it mitigates the risk of connecting to malicious servers pretending to be legitimate ones.
- Adhering to this policy promotes security compliance and best practices. Organizations with strict security and compliance requirements, such as those under PCI-DSS or GDPR, will often need to demonstrate that they have mechanisms in place to ensure secure exchange of data over networks. Following this policy assists in compliance with such regulations.
Ensure that packages with untrusted or missing signatures are not used
Ensure that packages with untrusted or missing signatures are not used
- Ensuring packages with untrusted or missing signatures are not used is crucial to maintain the integrity of the infrastructure. Packages without verified signatures may contain malicious content, potentially compromising the system.
- The policy decreases the risk of a supply-chain attack. In this type of attack, a hacker might compromise a package, then distribute it to unknowing users, potentially leading to data theft, system damage or unauthorised network access.
- Strictly enforcing the policy leads to trusted, reproducible builds. This enhances the reliability of the infrastructure and ensures the predictability of its behavior as the risk of package-related inconsistencies or malfunctions decreases.
- The policy contributes to overall compliance efforts. Many data protection regulations and industry best practices require the use of signed and trusted packages in information systems: non-compliance can lead to fines, penalties or loss of certifications.
Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state
Ensure that the force parameter is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state
- The policy ensures the integrity of packages by enforcing signature validation. Disabling signature validation by using the force parameter could lead to installation of compromised or unauthorized packages, which pose a security risk.
- Disallowing the use of force parameter helps to maintain the system in a stable and consistent state. This ensures that package installations or upgrades do not introduce conflicts or break dependencies leading to an unstable system.
- The policy mitigates the risk of software downgrade attacks, which can introduce previously patched vulnerabilities back into the system, making the system susceptible to known exploits.
- The policy rules promote best practices in package management using Ansible. This ensures the safe and controlled operation of Ansible as an Infrastructure as Code (IaC) tool, where configuration mistakes could potentially impact the entire infrastructure.
Ensure that HTTPS url is used with uri
Ensure that HTTPS url is used with uri
- Ensuring HTTPS URLs are used with URI is crucial for data protection as it encrypts the data transmitted between the user’s device and the server. Without this policy, sensitive data such as usernames, passwords, and credit card details could be intercepted by malicious actors.
- Non-HTTPS URLs are more susceptible to cyber-attacks such as man-in-the-middle (MitM) – where attackers access, read, modify and reroute the communication between two parties without their knowledge. Implementing this policy reduces the risk of such attacks.
- Using HTTPS URLs with URI also improves the trust and credibility of the system. Browsers often warn users when they’re entering a non-secured site, which may deter users from interacting with the system.
- This policy ties directly into compliance with information security standards and legal requirements around data protection. Non-compliance could lead to penalties, litigation, and reputational damage.
Ensure that HTTPS url is used with get_url
Ensure that HTTPS url is used with get_url
- This policy ensures the secure transmission of data by enforcing the use of HTTPS when using the get_url function in Ansible. Unsecured HTTP links are vulnerable to man-in-the-middle attacks where sensitive information can be intercepted and altered.
- Implementation of this policy minimizes the risk of data breaches, protecting both the integrity and confidentiality of the data being transmitted. HTTPS urls provide an additional security layer by encrypting the data during transmission.
- The policy directly impacts how resources are accessed and utilized in Ansible-based infrastructures. It sets a standard for best security practices and ensures consistent application of those practices across all tasks and operations.
- By enforcing this policy, it provides security by default, reducing the likelihood of security vulnerabilities being introduced through human error or oversight during configuration of Ansible tasks.
Ensure block is handling task errors properly
Ensure block is handling task errors properly
- This policy ensures that errors that occur within the ‘block’ section of Ansible playbooks are properly handled. This is crucial in maintaining the reliability and integrity of the infrastructure, as it prevents unhandled errors from causing unexpected issues or outages.
- Proper error handling has the effect of improving the overall resiliency and robustness of the infrastructure. It ensures that when a failure or unexpected event happens, the system has mechanisms in place to handle it and recover without causing significant disruption to services.
- Compliance with this policy has the potential to greatly improve debugging processes. When task errors are correctly handled, it becomes easier to identify and resolve issues, leading to faster recovery times, increased productivity and reduced downtime.
- Lastly, not handling block errors properly can lead to security issues, as it can provide an attacker with means to exploit the system. This policy is therefore critical when it comes to ensuring infrastructure security and protecting the system against potential threats.
Ensure that packages with untrusted or missing GPG signatures are not used by dnf
Ensure that packages with untrusted or missing GPG signatures are not used by dnf
- The policy is critical to ensuring system integrity and security. Packages with untrusted or missing GPG signatures could be malicious or modified, introducing vulnerabilities to the system if they are used by dnf.
- Implementing this policy greatly reduces the risk of executing tampered or harmful software unknowingly. GPG signatures serve as a way to verify the authenticity of the packages, ensuring they are from a trusted source and have not been altered.
- This policy also promotes adherence to best practices in software distribution and installation. As a standard, important software providers mostly sign their products using GPG keys to assure users of their integrity.
- Non-compliance to this policy not only jeopardizes system security, it also poses potential legal and reputational damages if compromised software leads to data breaches or other security incidents.
Ensure that SSL validation isn't disabled with dnf
Ensure that SSL validation isn't disabled with dnf
- Ensuring that SSL validation isn’t disabled with dnf enhances the security measures by checking the authenticity of repositories. This prevents any tampering or unintended manipulation of configurations on server side.
- This security policy protects against man-in-the-middle and other cryptographic attacks that can interfere with secured communications, enhancing the overall integrity and authenticity in data exchanges.
- Disabling SSL validation can unknowingly open paths for infiltration into the infrastructure, which could lead to unauthorized access to sensitive data or even disruption of services.
- Implementing such a policy via Ansible allows for automation and uniformity across different system components, reducing the risk of human error or inconsistencies in configuration, thereby maintaining a consistent security posture.
Ensure that certificate validation isn't disabled with dnf
Ensure that certificate validation isn't disabled with dnf
- Ensuring that certificate validation isn’t disabled with DNF contributes to the secure communication between client-system and the DNF repositories, by verifying the authenticity, thereby safeguarding the IaC deployments from cyber threats and attacks.
- When certificate validation is not disabled, it can prevent man-in-the-middle attacks where a hacker might try to intercept the data exchange between client and server, keeping the integrity of the installed packages and the application code intact.
- Misconfiguration that disables certificate validation can expose sensitive information like server credentials, IP addresses, etc, during the data transfer process. Enforcing this policy helps mitigate this data exposure risk.
- Compliance with this policy ensures that Ansible tasks involving DNF will only interact with trusted repositories and maintain the standard, intended behaviour throughout the application or stack. When certificate validation is not disabled, only the actions of authenticated and trusted entities would be processed.
Ensure Workflow pods are not using the default ServiceAccount
Ensure Workflow pods are not using the default ServiceAccount
- Ensuring Workflow pods are not using the default ServiceAccount is crucial as it prevents unintended elevated permissions. The default ServiceAccount has more privileges than necessary for most applications and thus increases potential attack surface.
- This policy helps maintain least privilege principle in the security architecture, ensuring entities have just enough permissions to perform their jobs, but not more. Compromised pods with least privileges can cause less damage compared to those with broad access rights.
- Enforcing the policy aids in protecting sensitive data and functions. If a Workflow Pod were to use the default ServiceAccount, it could potentially access any API and perform actions that might compromise the system, including data manipulation or escalation of privileges.
- Implementing this policy also helps organizations meet various compliance and regulatory requirements which mandate minimal access permissions to decrease the likelihood and impact of security breaches.
Ensure Workflow pods are running as non-root user
Ensure Workflow pods are running as non-root user
- Running Workflow pods as non-root user significantly reduces potential security vulnerabilities. If a root user’s credentials are compromised, the intruder has the ability to make major changes or cause significant damage.
- This policy ensures that even in the case of a security breach, malicious activities would be limited, as non-root users do not have full system-wide privileges, thus limiting the potential scope of damage or data breach.
- Enforcing this policy aids in compliance with best-practice security guidelines and regulations, which often require limiting root access to essential use-cases only.
- Adherence to this policy enforces the principle of least privilege, a key standard in information security. This principle minimizes the potential damage from accidental or unauthorized changes.
Ensure IAM policies that allow full '*-*' administrative privileges are not created
Ensure IAM policies that allow full '*-*' administrative privileges are not created
- Restricting the creation of IAM policies that allow full ’-’ administrative privileges helps in maintaining a principle of least privilege, ensuring only necessary permissions are granted. This significantly reduces the risk of unauthorized access or potential misuse of permissions.
- Without this policy, there could be unrestricted access across all services within the AWS environment, increasing the risk of inadvertent modifications or deletions, possibly leading to business disruption, data loss or service unavailability.
- Overly permissive IAM policies could potentially open up avenues for security breaches. A hacker who gains access to these permissions could take control of the entire AWS account, stealing sensitive information, or injecting malicious code.
- Imposing this security policy encourages the adoption of role-based access control (RBAC), increasing accountability and enforceability. This can help an organization monitor and audit user actions more effectively and detect policy violations promptly.
Ensure ALB protocol is HTTPS
Ensure ALB protocol is HTTPS
- Ensuring ALB protocol is HTTPS improves data security during transmission between the client and the server, as HTTPS uses encryption to protect data from getting intercepted or altered.
- This policy will help organisations comply with data privacy laws and regulations that require encryption of sensitive data in transit, potentially safeguarding against legal penalties and reputational damage.
- Non-compliance with this policy could expose traffic to man-in-the-middle (MITM) attacks, where an attacker intercepts and potentially modifies traffic passing between two parties without them knowing.
- Implementing this policy could enhance customer trust, given that web browsers alert or even block users from accessing sites and services not using HTTPS. This could ultimately contribute to user retention and satisfaction.
Ensure all data stored in the EBS is securely encrypted
Ensure all data stored in the EBS is securely encrypted
- This policy ensures that customer data stored in Amazon Elastic Block Store (EBS) volumes is encrypted, providing data security and compliance with regulations that require encryption of sensitive data, thus reducing the risk of data breaches.
- Application of this policy can prevent unauthorized disclosure of information, as all data at rest and moving between EC2 instances and EBS storage is encrypted, adding an extra layer of protection against data leaks or breaches.
- The encryption process incorporates industry standard AES-256 encryption algorithm, providing a robust and secure method of making sure your data on the EBS is unreadable to those without appropriate access permissions.
- An exception to this security policy might expose an organization’s data to potential cybersecurity threats, leading to financial losses, reputation damages, and non-compliance with data protection regulations.
Ensure all data stored in the Elasticsearch is securely encrypted at rest
Ensure all data stored in the Elasticsearch is securely encrypted at rest
- This policy helps to protect sensitive information from unauthorized access by encrypting all data at rest in Elasticsearch. This adds an extra layer of security, making it difficult for intruders to read and utilize the data if they somehow get access to storage.
- Ensuring encryption at rest for Elasticsearch data can help organizations comply with regulatory standards like GDPR or HIPAA, which require specific measures for protecting data and may result in penalties if not followed.
- Implementing this policy would also improve system reliability by minimizing the potential attack surface for exploits that can steal unprotected data, thereby adding an extra layer of defense against data breaches and leaks.
- Encrypting data at rest can also prevent data corruption, as encryption can add redundancy checks that ensure data integrity and prevent accidental alterations or deletions. This could potentially save the organization from enormous reparation costs and loss of customer confidence.
Ensure all Elasticsearch has node-to-node encryption enabled
Ensure all Elasticsearch has node-to-node encryption enabled
- Ensuring all Elasticsearch nodes have node-to-node encryption enabled provides an additional security layer against unauthorized access and data breaches. Without node-to-node encryption, the data transmitted between Elasticsearch nodes could be intercepted and read, posing a significant security risk.
- Enabling node-to-node encryption in Elasticsearch helps organizations meet compliance requirements. Many industries have regulations that mandate the encryption of data both in transit and at rest, so enabling this feature can help companies in regulated industries stay within compliance guidelines.
- Configuring Elasticsearch without node-to-node encryption may lead to data leakage, providing cybercriminals with sensitive information. Once the information has been leaked, it can have severe effects on both the organization’s reputation and its financial status.
- Implementing this policy can prevent potential network eavesdropping attacks by encrypting communication between Elasticsearch nodes. This kind of attack can be conducted by an attacker with access to the network to intercept and even potentially manipulate data packets being transmitted between nodes.
Ensure rotation for customer created CMKs is enabled
Ensure rotation for customer created CMKs is enabled
- Enabling rotation for customer created CMKs (Cloud Management Keys) in AWS enhances the security of your AWS services by making it difficult for unauthorized entities to decode the encrypted data, even if they manage to get old CMKs.
- Following this policy reduces the risk of a single key being compromised and potentially leading to a security breach, as the keys regularly rotate and retire, making them obsolete for deciphering data.
- The implementation of this policy ensures compliance with security best practices and regulations, such as GDPR and PCI DSS, which require key rotation for cryptographic keys to maintain data privacy.
- Failure to adhere to this policy could result in security vulnerabilities, increased penetration risks, non-compliance fines by regulatory bodies, and potential reputation damage due to data breaches.
Ensure all data stored in the Launch configuration EBS is securely encrypted
Ensure all data stored in the Launch configuration EBS is securely encrypted
- Encryption of data stored in the Launch configuration EBS is crucial to protect sensitive information from unauthorized access. If the data is not encrypted, it can be easily accessed or altered by malicious users, potentially leading to data breaches or loss.
- This policy ensures regulatory compliance, as many industry standards and regulations require data to be encrypted at rest. Non-compliance can result in hefty fines and damage to the organization’s reputation.
- Implementing encryption safeguards the integrity and confidentiality of the data. If a disk were to be compromised, the encrypted data would remain secure as it could not be read without the encryption keys.
- The given rule, when enforced, increases confidence and trust with stakeholders and customers as it demonstrates a robust approach to data security. Any potential data breach could severely damage the organization’s relations with its partners and customers.
Ensure IAM password policy expires passwords within 90 days or less
Ensure IAM password policy expires passwords within 90 days or less
- This policy is significant because it mandates the expiration of IAM account passwords within 90 days or less, encouraging users to frequently change their passwords, thereby minimizing the risk of password-related security breaches.
- It has a direct impact on the integrity of user credentials by lowering the probability of unauthorized access due to often-used or stolen passwords, hence enhancing the security level of the entire aws_iam_account_password_policy entity.
- Implementing this policy using Infrastructure as Code (IaC) tool like Terraform automates password expiration, making the management of the policy more efficient, and reducing potential human error.
- Ensuring a password policy expiration also enables compliance with certain security standards and regulations which require regular password changes, making it crucial for organizations that need to meet these compliance requirements.
Ensure IAM password policy requires minimum length of 14 or greater
Ensure IAM password policy requires minimum length of 14 or greater
- The policy ensures that passwords used in AWS IAM have a minimum length of 14 characters, making it harder for malicious actors to guess or crack passwords, hence reducing the risk of unauthorized access to AWS resources.
- Implementation of this policy promotes good cyber hygiene, as longer passwords often translate to a significant increase in password combinations, making brute-force attack much less feasible.
- Non-compliance to this policy could potentially lead to exploited security vulnerabilities in infrastructure served by Terraform, thereby putting sensitive data and operations at risk of interference or theft.
- By enforcing a minimum password length of 14 or greater, the policy contributes to the overall robustness of the IAM system, its resilience against cyber threats, and the security of the operations managed on the platform.
Ensure IAM password policy requires at least one lowercase letter
Ensure IAM password policy requires at least one lowercase letter
- This policy is critical because it demands a higher complexity for IAM passwords by enforcing the use of at least one lowercase letter, reducing the risk of brute force or dictionary attacks.
- It enhances the security of the AWS IAM accounts by making the password harder to guess or crack, hence offering an additional layer of protection against unauthorized access.
- Through increasing requirement for password complexity, it contributes to the conformance of security best practices and compliance requirements which often demand the inclusion of a mix of uppercase and lowercase characters.
- Utilizing Infrastructure as Code (IaC) tools like Terraform helps ensure this policy is consistently applied across all IAM accounts, aspects of the AWS environment, thereby reducing the likelihood of human errors in policy implementation.
Ensure IAM password policy requires at least one number
Ensure IAM password policy requires at least one number
- This policy enhances the security of IAM user accounts by requiring the inclusion of at least one numerical character in the password, making it harder for unauthorized users to guess or crack passwords.
- By implementing this policy via Terraform, it can be ensured that it is applied consistently across the infrastructure, reducing the risk of human error and maintaining the necessary security standard.
- It supports the best practice of password complexity to secure sensitive data and resources in an AWS environment and helps organizations comply with certain regulatory standards that dictate strong password policies.
- The policy can potentially deter or slow down brute-force attacks that guess passwords, as the attackers have to try a larger combination of possibilities, therefore increasing the security of IAM accounts.
Ensure IAM password policy prevents password reuse
Ensure IAM password policy prevents password reuse
- The policy ensures that users can’t reuse old passwords, thereby reducing the risks related to compromised passwords. If a hacker gets access to old passwords, they won’t be able to use them.
- This policy improves the security posture of the AWS IAM, as enforcing unique passwords for accounts requires users to constantly change and update their passwords, making it difficult for unauthorized users to gain access.
- Enforcing a no password reuse policy encourages the use of strong and unique passwords among users. This, in turn, makes the system more secure by hardening authentication processes.
- It fosters better password management practices among users, leading to a culture of security consciousness and vigilance against potential cybersecurity threats.
Ensure IAM password policy requires at least one symbol
Ensure IAM password policy requires at least one symbol
- Requiring a symbol in an IAM password policy enhances security by making the password harder to guess or crack by brute-force attacks. Its complexity increases as it requires combinations of alphanumeric and special characters.
- The policy helps to protect critical AWS resources and data as it implies a high standard of security measures are being implemented. Loss of data integrity or data breach might be greatly minimized when tougher password protocols are followed.
- It helps organizations comply with various data protection regulations and standards, such as PCI DSS, GDPR, and ISO 27001, which demand strong access controls, including complex password policies.
- Implementing this policy with Infrastructure as Code (IaC) as Terraform, makes it easier and more efficient to deploy across multiple accounts or regions within AWS environment. Changes can easily be tracked and reversed if necessary.
Ensure IAM password policy requires at least one uppercase letter
Ensure IAM password policy requires at least one uppercase letter
- This security policy increases the complexity of IAM passwords, making them difficult to guess or crack through methods like brute force attacks, thereby helping to safeguard IAM accounts that are vital to AWS operations.
- If uppercase letters aren’t required in the IAM password policy, it can lead to creation of weak and easily guessable passwords, increasing the risk of unauthorized access which may lead to potential data breaches or misuse of AWS resources.
- With this policy in place, automated tools like Terraform can consistently enforce the requirement of uppercase letters in every IAM password across the various AWS accounts, ensuring uniformity in security practices.
- The consideration of this policy is significant for compliance with various information security standards and regulations which recommend or require passwords to contain a mix of uppercase and lowercase letters along with other character types.
Ensure all data stored in the RDS is securely encrypted at rest
Ensure all data stored in the RDS is securely encrypted at rest
- Encrypting data at rest in the RDS helps prevent unauthorized users and malicious actors from illegally accessing sensitive information, thereby significantly enhancing the security of the database.
- In the event of a security breach or intrusion, encryption ensures that the stolen data is unreadable and essentially useless, further protecting customer data and other essential business information.
- Using secure encryption methods in RDS as prescribed by the policy ensures compliance with various regulations pertaining to data security, such as GDPR or HIPAA, which in turn can save the organization from hefty fines and legal implications.
- Encryption policies like this mitigates risks related to data exfiltration or leakage, which can cause reputational damage, financial losses, and loss of customer trust for the business, thus maintaining the integrity of business operations.
Ensure all data stored in RDS is not publicly accessible
Ensure all data stored in RDS is not publicly accessible
- This policy safeguards sensitive information by ensuring no unauthorized users can access the data stored in RDS, thereby reducing the risk of data breaches and maintaining the confidentiality and integrity of the data.
- It helps in mitigating potential legal and financial repercussions. If sensitive data such as personal identifiable information (PII) gets breached, the company might face heavy penalties and damage of reputation.
- Enforcing this policy aligns with the best practices for data security in cloud computing environments, especially within AWS, fostering trust among stakeholders, clients and regulatory bodies.
- By automatically blocking public access through Infrastructure as Code (IaC) methods like Cloudformation, the policy minimizes human error and the risk associated with manual configuration adjustments, thus enhancing the overall security posture of the cloud environment.
Ensure the S3 bucket has access logging enabled
Ensure the S3 bucket has access logging enabled
- Enabling access logging for the S3 bucket provides detailed records for the requests made to this bucket. This is essential as it helps track any changes made to the bucket and allows for easy tracing of the activities in the event of security breaches or for general auditing.
- It helps protect against unauthorized access or data breaches by keeping track of all the access requests including the source, time of access, the object that was accessed, and the action performed. Identifying any unexpected behavior or malicious activity becomes more efficient.
- This access log can serve as a research base when working towards compliance with different standards or legal requirements. Companies with significant regulatory burdens can use these logs to establish patterns, corroborate events, or provide evidence in support of an investigation.
- This policy will also provide a hindsight into the bucket’s typical usage patterns and help identify any unnecessary or redundant access actions. Such an understanding can lead to optimization of operations and cost management in relation to data storage and management in an AWS environment.
Ensure the S3 bucket has server-side-encryption enabled
Ensure the S3 bucket has server-side-encryption enabled
- Server-side encryption for S3 buckets adds an additional layer of protection to the data by encrypting it as soon as it arrives at the server, providing data security during transit and while at rest, thereby reducing the risk of unauthorized data access.
- It aids in meeting compliance requirements for data sensitivity and privacy, such as the GDPR and HIPAA, which mandate that data stored in the cloud must be encrypted.
- It helps to prevent data breaches and the potential financial and reputational damage that might result, offering an extra safeguard against hackers and minimizing the possibility of sensitive data being compromised.
- Without this policy in place, essential encrypted data storage standards may be overlooked, leading to unprotected cloud storage, ease of access for hackers, and potential data loss.
Ensure the S3 bucket does not allow READ permissions to everyone
Ensure the S3 bucket does not allow READ permissions to everyone
- This policy is important because it prevents unauthorized access to sensitive information stored in your S3 buckets. If read permissions are allowed to everyone, anyone can access and download the data, leading to potential data leakage or breaches.
- This policy’s impact is to significantly enhance the security of S3 buckets by enforcing access control measures. It ensures that only authorized personnel can have access to the data stored in the buckets.
- It promotes the principle of least privilege, a standard security practice which recommends that users be given the minimum levels of access necessary to perform their job functions, thereby reducing the risk of accidental or malicious misuse of sensitive information.
- If the policy is not implemented, it could lead to non-compliance with various data protection regulations like GDPR, HIPAA among others which can result in significant legal fines and reputation damage to the organization.
Ensure the S3 bucket has versioning enabled
Ensure the S3 bucket has versioning enabled
- Enabling versioning on an S3 bucket ensures easy recovery in case of a data loss situation, as all previous versions of an object are preserved, thus making it important for data integrity and continuity.
- Without versioning, any accidental deletions, overwrites, or incorrect modifications made to objects within the bucket are permanent. Therefore, its implementation increases the level of resilience against human errors and system failures, providing an extra layer of data protection.
- The policy is crucial for disaster recovery strategies as versioning allows rollback to a specific version in the event of a security incident, such as ransomware attack or malicious deletion, thus ensuring the availability of data when needed.
- Enabling versioning can also contribute towards meeting compliance requirements where maintaining an audit trail and historical data is mandated. This ultimately results in improved accountability and the ability to perform in-depth investigations when necessary.
Ensure SageMaker Notebook is encrypted at rest using KMS CMK
Ensure SageMaker Notebook is encrypted at rest using KMS CMK
- This policy aims to safeguard sensitive data processed or stored in the SageMaker Notebook by encrypting it at rest using Key Management Service (KMS) Customer Master Key (CMK), reducing the risk of unauthorized access or data exposure.
- Encryption using KMS CMK provides an additional layer of security beyond the default AWS managed keys, as the customer has direct control over the CMK, including its rotation and revocation, increasing data security and compliance standards.
- Failing to use encryption at rest could result in non-compliance with data protection regulations and organizations might face hefty fines or other legal consequences.
- This policy also supports Infrastructure as Code (IaC) practices by leveraging Terraform scripts for resource implementation, allowing efficient deployment, versioning, and management of the AWS resources and security settings.
Ensure every security groups rule has a description
Ensure every security groups rule has a description
- Having descriptions for every security group rule can help in identifying the purpose of each rule, making it simpler for teams to understand and manage complex infrastructures. This reduces the likelihood of inadvertently changing or deleting important rules, thereby minimizing risks of potential security breaches.
- A detailed description for each security group rule contributes to better documentation of the system providing easy reference and increased efficiency when troubleshooting security issues. This can help in saving time and resources and reduce downtime during incidents.
- Specifying descriptions for all rules within security groups can enhance auditability by providing detailed context for each rule, which is crucial for regulatory compliance. For example, auditors can easily trace and verify if necessary security controls are in place and operating effectively.
- Enforcing this policy could prevent unnecessary exposure due to misinterpretation of rules. A missing or vague description may lead to incorrect assumptions, potentially leading to unnecessary exposure of resources, resulting in heightened vulnerability to attacks.
Ensure all data stored in the SNS topic is encrypted
Ensure all data stored in the SNS topic is encrypted
- This policy guarantees that all data stored in the Simple Notification Service (SNS) topic is encrypted, meaning even if the data is intercepted, it cannot be read without decryption access. This offers an extra layer of security and protection against data breaches.
- Without the added security of this policy, unauthorized users may easily read intercepted data, resulting in potential privacy issues, sensitive data leakage, and non-compliance penalties.
- By encoding the data stored in the SNS topic, it also helps maintain the integrity of the information. The encryption acts as a barrier against tampering, as illegitimate changes to the data would be apparent when it’s decrypted.
- Enforcing this policy leverages AWS SNS’s encryption capabilities and helps organizations meet regulatory and compliance requirements for data protection, increasing their credibility and trustworthiness in the eyes of customers and other stakeholders.
Ensure all data stored in the SQS queue is encrypted
Ensure all data stored in the SQS queue is encrypted
- Encrypting data stored in the SQS queue helps to protect sensitive or confidential information from unauthorized access and potential misuse by cybercriminals, providing an added level of security.
- If the data stored in the SQS queue is not encrypted, it could lead to a potential data breach in the event of a cyberattack, which could have serious legal and financial implications for the organization.
- The use of encryption ensures compliance with industry standards and regulations regarding data protection. Non-compliance could result in hefty fines and damage to the organization’s reputation.
- By following the policy and enabling SQS queue encryption, organizations can build trust with stakeholders, clients, and customers, knowing that their data is being stored securely.
Ensure DynamoDB point in time recovery (backup) is enabled
Ensure DynamoDB point in time recovery (backup) is enabled
- Enabling DynamoDB point in time recovery (backup) ensures data resilience by providing protection against inadvertent write or delete operations. If tables are accidentally deleted or modified, the changes can be reversed, maintaining data integrity.
- It results in operational efficiency and financial savings by negating the need for manual backups or having to recreate data due to any accidental loss. The entire backup and restore process gets automated, reducing the administrative efforts.
- Compliance to industry standards like GDPR, HIPAA, and PCI DSS may require businesses to maintain databases with backup and restore capabilities. Using DynamoDB point in time recovery helps meet these regulatory requirements and avoid potential legal issues.
- Mistaken deletions or catastrophic events can lead to serious business disruptions. Activating the point in time recovery feature for DynamoDB acts as a safety net, ensuring businesses continuity and reputation management.
Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest
Ensure all data stored in the ElastiCache Replication Group is securely encrypted at rest
- This policy ensures that all data at rest within the ElastiCache Replication Group is encrypted, providing an extra layer of security against unauthorized access or potential breaches.
- The policy impacts the security posture of the entire AWS structure since ElastiCache is a crucial resource for deploying, operating, and scaling an in-memory cache, which often has sensitive application data.
- Encrypting data at rest can reduce the likelihood of a successful attack by making it more difficult for attackers to access raw data, even if they gain unauthorized access to storage.
- Implementing this policy through Infrastructure as Code (IaC) with Cloudformation allows for consistent enforcement across all deployments, ensuring a uniform level of protection across the organization’s infrastructure.
Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit
Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit
- Encrypting data stored in the ElastiCache Replication Group during transit ensures information confidentiality and prevents unauthorized access to sensitive data, protecting it from intruders or potential cyber threats.
- Implementing this policy mitigates the risk of data interception during transmission. Even if data traffic is somehow intercepted, the information would remain unreadable and useless to the attacker due to encryption.
- Encryption at transit within an ElastiCache Replication Group aligns with compliance regulations and industry standards for data protection such as PCI-DSS, GDPR, and HIPAA, potentially reducing legal and financial ramifications for the entities involved.
- The policy encourages adoption of best practices in regards to infrastructure security. By implementing it in IaC (Infrastructure as Code) via CloudFormation, it becomes less prone to human error, ensuring a reliable and consistent security rule across different operational environments.
Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token
Ensure all data stored in the ElastiCache Replication Group is securely encrypted at transit and has auth token
- This policy ensures that data transferred within the ElastiCache Replication Group is consistently encrypted, maintaining the confidentiality and integrity of the data, reducing potential data breaches, and increasing overall data security.
- It requires the use of an authentication token, providing an additional layer of security by verifying the identity of user requests, thereby preventing unauthorized access and modifications to the data.
- Ensuring encryption at transit and authentication helps in compliance with various global privacy regulations and standards, such as GDPR and PCI DSS, which mandate secure data handling and protection against unauthorized access.
- Implementing this policy via Infrastructure as Code (IaC) automates security enforcement across all ElastiCache Replication Groups, ensuring consistent application of security measures and making it easier to manage and audit.
Ensure ECR policy is not set to public
Ensure ECR policy is not set to public
- This policy helps protect against unauthorized access to your Elastic Container Registry (ECR). By ensuring the policy is not set to public, you limit access to only the necessary entities.
- Setting the ECR policy to public would make your AWS ECR repositories and the contained images accessible to anyone on the internet, leading to potential data breaches or unauthorized changes to your container images.
- Unauthorized access can lead to misuse of sensitive information contained within the ECR such as proprietary application codes, credentials or configurations, thus resulting in severe security risks.
- The policy can also help you maintain compliance with certain standards and regulations, such as GDPR or HIPAA, which require that access to data is restricted and carefully managed. Such compliance is integral to avoid legal and financial repercussions.
Ensure KMS key policy does not contain wildcard (*) principal
Ensure KMS key policy does not contain wildcard (*) principal
- This policy ensures that no unidentified or unauthorized entity can gain access to the Key Management Service (KMS), thereby preventing potential security breaches and unauthorized data access.
- By disallowing wildcard principle in KMS key policy, the risk of unauthorized encryption or decryption events is minimized, thus ensuring the data’s confidentiality and integrity.
- Restricting the use of wildcards (’*’) in KMS key principal policies enforces the principle of least privilege, meaning that entities only have the required access rights and nothing beyond that.
- A KMS key with a wildcard in the principal could lead to untraceable or unaccounted actions on the data as it becomes impossible to tie actions to specific entities, causing difficulties in auditing and compliance checks.
Ensure CloudFront Distribution ViewerProtocolPolicy is set to HTTPS
Ensure CloudFront Distribution ViewerProtocolPolicy is set to HTTPS
- This policy ensures that all client-to-CloudFront interactions are encrypted, offering protection against potential interception, tampering, or spoofing of data while in transit and safeguarding confidentiality and integrity of data.
- Setting the ViewerProtocolPolicy to HTTPS prevents unsecured HTTP communications, thereby mitigating risks associated with the exposure of sensitive information due to non-secure data transmissions.
- The policy also helps to achieve compliance with standards and regulations that require encryption of data in transit such as GDPR, PCI-DSS or HIPAA.
- Misconfiguration in cloud resources can lead to security vulnerabilities; thus, enforcing this policy through Infrastructure as Code (IaC) like Cloudformation allows for proactive security and continual compliance in the cloud environment.
Ensure CloudTrail logs are encrypted at rest using KMS CMKs
Ensure CloudTrail logs are encrypted at rest using KMS CMKs
- Encrypting CloudTrail logs at rest using Key Management Service (KMS) Customer Master Keys (CMKs) enhances data security by adding an extra layer of protection against unauthorized access, manipulation, and potential data breaches.
- KMS CMKs enable secure key storage and generation, and their use with CloudTrail logs ensures auditability. This setup provides a trail of user activity and data access, which is critical for compliance with regulations like GDPR and HIPAA.
- Using KMS CMKs, as compared to AWS-managed keys, gives entities greater control over their security by allowing them to define and enforce their own access policies, making it more difficult for entities outside of the organization to gain access to logs.
- If CloudTrail logs are not encrypted at rest, the potential risk of exposing sensitive information is increased. This could lead to exploited vulnerabilities, attacks targeting the infrastructure, and significant reputational damage in the event of a data loss or breach.
Ensure CloudTrail log file validation is enabled
Ensure CloudTrail log file validation is enabled
- Ensuring CloudTrail log file validation is enabled provides an additional layer of security by verifying that the CloudTrail logs have not been tampered with. This safeguard helps maintain the integrity of logs and the reliability of audit activities in the AWS environment.
- This policy is critical because log file validation allows for the detection of unauthorized changes to log files. If a log file is modified, deleted, or moved from its original location, it will fail validation, notifying admins about potential security breaches.
- The enabled log file validation policy contributes to establishing a robust security posture in AWS. It supports compliance with industry security standards and regulations that require monitoring and logging of activities in the IT infrastructure.
- It can prevent potential data loss situations. If a CloudTrail log file is inadvertently modified or deleted, the log record remains intact because it retains a copy of the content. This policy helps to ensure traceability and accountability of actions made in the AWS environment.
Ensure Amazon EKS control plane logging is enabled for all log types
Ensure Amazon EKS control plane logging is enabled for all log types
- Enabling Amazon EKS control plane logging for all log types helps maintain a thorough record of vital system activity, thus allowing for better monitoring of actions taken within the AWS EKS clusters. This enhances the ability to detect any unauthorized or suspicious activities early and respond promptly.
- This policy promotes transparency and accountability in the management of critical infrastructure resources within AWS EKS clusters. All actions can be tracked back to the entity or individual that initiated them, creating a precise audit trail.
- In case of any system failures, issues, or unexpected behavior, these logs serve as valuable troubleshooting resources. They provide detailed insight into the internal system processes leading up to the event, so appropriate corrective measures can be implemented.
- The policy reinforces regulatory compliance, ensuring that industries dealing with sensitive data comply with required standards. Often, standards such as the General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA) require the logging of all activities of certain systems.
Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0
Ensure Amazon EKS public endpoint not accessible to 0.0.0.0/0
- This policy prevents unauthorized access to the Amazon EKS public endpoint, greatly improving the security of the system by ensuring only approved CIDR blocks have access.
- By restricting access to 0.0.0.0/0, the policy limits potential attack vectors, reducing the likelihood of security breaches and and data loss.
- Ensuring Amazon EKS public endpoint is not accessible to 0.0.0.0/0 also helps to maintain compliance with industry and business security standards and regulations, thus avoiding potential penalties and reputation damage.
- Using Infrastructure as Code (IaC) tool like Terraform allows for efficient and reliable enforcement of this policy, enabling the organizations to automate their security measures and easily incorporate this rule in their development workflows.
Ensure Amazon EKS public endpoint disabled
Ensure Amazon EKS public endpoint disabled
- Disabling Amazon EKS public endpoint ensures an additional layer of security to your Kubernetes clusters by preventing unauthorized access from outside the VPC, thereby thwarting potential attacks.
- Enabling public access can expose the cluster’s API server to the internet, leading to risks like DDoS attacks, data breaches, or unauthorized changes to your EKS resources. This policy prevents any such vulnerabilities.
- Disabling public endpoints translates to enforcing secure, private access only, which aligns with best practices for minimizing the attack surface and adhering to the principle of least privilege.
- Implementing this policy with infrastructure as code using Terraform can ensure consistent enforcement across all EKS clusters, reducing manual intervention, and enabling detecting misconfigurations early during the development cycle.
Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)
Ensure IAM policies are attached only to groups or roles (Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.)
- Ensuring IAM policies are only attached to groups or roles can minimize potential security risks by limiting the ability for a single user to receive excessive privileges, thus reducing the surface area for any potential unauthorized access or actions.
- Implementing this policy will streamline access management by simplifying the process, making it easier to monitor, control, and alter as required. This could lead to more efficient administration and less possibility for error or oversight.
- Code for enforcing this policy is available in Python (via the provided GitHub link). This readily available implementation lowers the barrier to entry for enforcing such a policy, making it easier for organizations to adopt and maintain.
- This policy directly impacts resources such as AWS::IAM::Policy, aws_iam_policy_attachment, aws_iam_user_policy, and aws_iam_user_policy_attachment, suggesting it’s essential in structuring and managing AWS IAM elements effectively and maintaining secure access protocols in an AWS environment.
Ensure no hard coded AWS access key and secret key exists in provider
Ensure no hard coded AWS access key and secret key exists in provider
- This policy is important as hard coding AWS access keys and secret keys in a provider can present a significant security risk. If the provider’s source code is leaked or exposed, the hardcoded keys could be misused to gain unauthorized access to the AWS services and data.
- Implementing this policy minimizes the risk of unauthorized access and potential data breaches. If an unauthorized individual gains access to the code, they would not be able to retrieve the AWS keys and misuse them, hence safeguarding critical and sensitive data.
- The policy ensures best practice for the security of Infrastructure as Code. By disabling hardcoding, it encourages the use of more secure methods to store and retrieve sensitive data, such as AWS Secrets Manager or environment variables, which can significantly reduce the chances of unintentional exposure.
- The application of this policy can help in achieving compliance with various data security standards and regulations. The presence of hardcoded keys is often flagged in audits and can result in non-compliance with standards like the PCI-DSS or GDPR, leading to potential fines and reputational damage.
Ensure EFS is securely encrypted
Ensure EFS is securely encrypted
- Ensuring that EFS (Elastic File System) is securely encrypted helps protect sensitive data stored in the AWS EFS, providing an extra layer of safety against unauthorized access and data breaches.
- Enforcing this policy can significantly enhance the security posture of the AWS environment since EFS, primarily used for sharing data across multiple instances, without encryption, can expose sensitive data to potential eavesdropping activities.
- Compliance with regulations: Many industries and jurisdictions have mandatory data protection laws and regulations that require encryption-at-rest for certain types of data. Implementing EFS encryption ensures compliance with such regulatory requirements.
- This policy, implemented via Infrastructure as Code (IaC) such as Cloudformation, enables automated, repeatable, and scalable encryption process which will reduce manual errors and overhead of manual configuration, thus improving efficiency while assuring compliance continuously.
Ensure Kinesis Stream is securely encrypted
Ensure Kinesis Stream is securely encrypted
- Ensuring Kinesis Stream encryption is crucial because it protects sensitive data from unauthorized access and breaches by encrypting all the data records using AWS Key Management Service (KMS) keys.
- It safeguards the confidentiality and integrity of the data transmitted through the stream, thereby ensuring that information isn’t compromised if intercepted during transit or at rest.
- Implementing this policy via Infrastructure as Code (IaC) using Cloudformation allows for better scalability, manageability, and consistency, preventing misconfigurations that could leave the data vulnerable.
- Non-compliance to this policy could lead to regulatory fines if found in violation of standards like GDPR or HIPAA, which require robust measures for protection of personal data.
Ensure Neptune storage is securely encrypted
Ensure Neptune storage is securely encrypted
- Encryption of Neptune storage ensures the security and confidentiality of stored data, preventing unauthorized access and offering an additional layer of protection against potential cyber attacks such as data breaches.
- The policy ensures compliance with regulatory standards and legal requirements regarding data protection, such as GDPR, HIPAA, and PCI-DSS, by making sure sensitive data is encrypted in Neptune DBClusters.
- Implementing this policy through Infrastructure as Code (IaC) with CloudFormation helps ensure consistent application across all AWS::Neptune::DBClusters, reducing the possibility of human error and increasing the overall robustness of system security.
- Failure to follow this policy can lead to severe consequences, including loss of sensitive data, financial penalties for non-compliance with data protection regulations, and loss of customer trust due to perceived inadequate security practices.
Ensure no hard-coded secrets exist in Lambda environment
Ensure no hard-coded secrets exist in Lambda environment
- Hard-coding secrets like API keys or credentials in a lambda function environment could lead to potential security risks like unauthorized access or data breach, as anybody with the access to the codebase can access these secrets.
- This policy ensures that the confidentiality of sensitive data is maintained by preventing practices that might make it visible to users who are not authorized to see it.
- Retrieved from the given Python script, this policy compliance enhance a good security practice of keeping secrets and sensitive information out of source code, instead storing them securely, such as in secret management services.
- By mitigating the risk of hardcoded secrets, Lambda functions and serverless applications on AWS can maintain a more secure, reliable, and efficient environment, increasing trust and credibility in the overall infrastructure.
Ensure no hard-coded secrets exist in EC2 user data
Ensure no hard-coded secrets exist in EC2 user data
- This policy is vital as hard-coded secrets in EC2 user data can expose sensitive information to unauthorized entities, potentially leading to severe data breaches and violating the principle of least privilege.
- Ensuring no hard-coded secrets exist in EC2 user data helps in compliance with data protection regulations. Non-compliance can result in legal penalties, financial losses, and damage to the organization’s reputation.
- Implementing this policy would encourage the use of secure practices like utilizing AWS Secrets Manager or environment variables, providing an extra layer of security by keeping secrets encrypted and away from the codebase.
- By enforcing this policy, organizations can better manage their secrets, making it easier to rotate, revoke and establish fine-grained access controls, which is crucial in a highly dynamic cloud environment.
Ensure DAX is encrypted at rest (default is unencrypted)
Ensure DAX is encrypted at rest (default is unencrypted)
- This policy ensures that data stored in DAX (DynamoDB Accelerator) clusters is encrypted at rest, adding an additional layer of security to protect from data breaches or unauthorized accesses.
- Not using DAX encryption can expose sensitive data stored in the DynamoDB tables, including Personally Identifiable Information (PII), making the organization vulnerable to data exploitation by malicious parties.
- The default setting for DAX is unencrypted, making the policy essential to remind and enforce encryption setting to secure data at rest, and comply with legal and regulatory requirements.
- The policy’s implementation using Cloudformation allows the configuration of encryption settings to be automated, reducing human errors and streamlining security in infrastructure management processes.
Ensure MQ Broker logging is enabled
Ensure MQ Broker logging is enabled
- Enabling MQ Broker logging provides a record of activities that take place on the MQ broker, helping to identify unauthorized access or unusual activities that could indicate a security breach.
- This policy ensures that necessary data for post-incident forensic investigation is available. Logging data is crucial to understand the exact sequence of events that culminated in a security incident.
- By meticulously recording administrative operations, authentication attempts, and system events, MQ Broker logging can be used to alert and develop effective response methods to anomalous behavior.
- When implemented using Terraform’s Infrastructure as Code (IaC), MQ Broker logging can be scalable and consistent across a cloud environment, improving efficiency in security administration and reducing the potential for human error.
Ensure no IAM policies documents allow '*' as a statement's actions
Ensure no IAM policies documents allow '*' as a statement's actions
- This policy ensures that overly broad permissions aren’t given out, which could lead to unauthorized access. By stopping the usage of ’*’ as a statement’s actions in IAM policies, it ensures that permissions are granted only to specific resources and actions.
- Enforcing this rule prevents potential misuse or exploitation, reducing the risk of a major data breach. If compromised, an overly permissive policy can lead to substantial damage inside the AWS Infrastructure.
- Ensuring no IAM policies allow ’*’ as a statement’s actions promotes the best practice of least privilege, meaning that users, roles, or services are granted only the minimum permissions necessary to perform their tasks. This significantly minimizes the potential impact if a security breach does occur.
- An IAM policy that allows ’*’ as a statement’s actions is not compliant with industry standards and regulatory frameworks such as ISO 27001, PCI-DSS, or GDPR, potentially leading to legal implications and penalties. The enforcement of this rule keeps the infrastructure compliant.
X-Ray tracing is enabled for Lambda
X-Ray tracing is enabled for Lambda
- This policy, when enabled, provides enhanced visibility into the behavior of your Lambda applications by permitting the collection, centralization, and visualization of distributed data, aiding in pinpointing bottlenecks, latency spikes, and functionality issues.
- It strengthens security by offering in-depth insights into request behavior, allowing for faster identification and rectification of anomalies or potential security threats, like DDoS attacks, thereby reducing the incidence of data breaches.
- The rule contributes to the optimization of the performance and the efficiency of the Lambda functions through detection and diagnosis of errors in the code or failures in the execution environment, making it possible to isolate and fix problematic components, leading to overall system improvement.
- By monitoring and recording the services’ operations in near real-time with AWS X-Ray, the policy aids in compliance with audit requirements and industry standards for logging and monitoring, reducing regulatory risks and potential legal implications.
Ensure ECR Image Tags are immutable
Ensure ECR Image Tags are immutable
Ensure S3 bucket has block public ACLs enabled
Ensure S3 bucket has block public ACLs enabled
- Enabling block public ACLs on S3 buckets mitigates the risk of inadvertent data exposure by preventing public access via bucket ACLs, a type of access control list applied to S3 buckets.
- This policy strengthens the defense-in-depth strategy for protecting sensitive data by adding another layer of security which prevents public read/write access permissions regardless of other permissions.
- Non-conformance with this policy could expose the organization to potential security threats like unauthorized data access, data leakage, or even loss of sensitive data which could lead to legal compliance issues and financial losses.
- The configuration for blocking public ACLs can be automated and checked using infrastructure as code (IaC) tools such as CloudFormation, ensuring continuous and consistent application of security controls across all S3 buckets in AWS.
Ensure S3 bucket has block public policy enabled
Ensure S3 bucket has block public policy enabled
- Enabling block public policy on S3 buckets ensures that the contents are not unintentionally exposed to the internet, thereby reducing the risk of unauthorized access and potential data loss.
- The policy ensures adherence to best practices with regards to cloud asset confidentiality and external attack surface reduction, as it prevents the writing of public access permissions granted, increasing overall security.
- It reduces the potential for human error during security configurations in AWS environments, as the S3 bucket would automatically deny all public access, irrespective of other permission settings.
- Compliance with this policy also helps in meeting privacy and compliance regulations/standards such as GDPR and HIPAA, that demand secure handling and storage of sensitive data.
Ensure S3 bucket has ignore public ACLs enabled
Ensure S3 bucket has ignore public ACLs enabled
- Enabling the ‘Ignore Public ACLs’ on S3 buckets helps maintain data privacy and confidentiality by preventing unauthorized public access to the bucket and its data, which could otherwise lead to data breaches.
- This policy ensures that even if erroneous permissions are set in future, AWS will ignore public ACLs and prevent inadvertent data exposure, thus adding an extra layer of protection for your sensitive data.
- It supports regulatory compliance efforts by organizations, as it aligns with data privacy laws and regulations that forbid unauthorized data access.
- Lack of the ‘Ignore public ACLs’ policy can negatively impact the data integrity and business reputation because cybercriminals or hackers can easily access or manipulate sensitive data stored in the buckets.
Ensure S3 bucket has RestrictPublicBuckets enabled
Ensure S3 bucket has RestrictPublicBuckets enabled
- The policy helps protect sensitive data from being unintentionally exposed to the public. By enabling ‘RestrictPublicBuckets’, only authorized users are allowed access to the bucket, reducing the likelihood of a data breach.
- It allows organizations to better comply with data privacy regulations. Certain industries, like healthcare and finance, are subject to regulations that require certain data to be securely stored and not publicly accessible.
- A failure to restrict public access to S3 buckets may lead an organization to fail an AWS Well-Architected Review or a PCI DSS audit, resulting in potential financial and reputational repercussions.
- The ‘RestrictPublicBuckets’ setting helps in reducing the attack surface for potential cyber threats. If a bucket is publicly accessible, it’s more likely to become a target for malicious activities such as data theft, denial of service attacks or data corruption.
Ensure the S3 bucket does not allow WRITE permissions to everyone
Ensure the S3 bucket does not allow WRITE permissions to everyone
- This policy aims to prevent unauthorized users from altering or deleting existing data in an S3 bucket, thus maintaining the integrity of the stored data. WRITE permissions given to everyone can potentially lead to unauthorized modifications or data breaches.
- Unrestricted WRITE permissions could allow an attacker or malicious user to upload inappropriate or harmful content to a company’s S3 bucket, which can lead to legal and reputational damage for the company.
- WRITE permissions for everyone can lead to an overflow of unintended or malicious data. This could result in unwanted costs due to increased data storage and needless data traffic.
- Ensuring that S3 buckets do not allow WRITE permissions to everyone, helps in maintaining a robust security architecture for the infrastructure. It puts a protective layer to safeguard business-critical and sensitive information stored in the S3 buckets.
Ensure EKS Cluster has Secrets Encryption Enabled
Ensure EKS Cluster has Secrets Encryption Enabled
- Enabling secrets encryption for EKS Cluster ensures that sensitive data like passwords, access keys, and tokens are always stored safely and securely. This prevents unauthorised users from accessing and manipulating these sensitive details, which can otherwise result in serious security breaches.
- Enabling secrets encryption on EKS Cluster helps to achieve regulatory compliance. Many standards and regulations require sensitive data to be encrypted while at rest, so this policy helps to meet those requirements.
- The impact of not enabling secrets encryption can be devastating as it can lead to significant data loss, unauthorized data access, and consequent financial and reputational damage.
- If an unauthorized user gains access to unencrypted secrets, they can potentially take control over the entire EKS Cluster and disrupt its functioning. Therefore, enabling secrets encryption in EKS Cluster is crucial for protecting against potential attacks and threats.
Ensure there is no open access to back-end resources through API
Ensure there is no open access to back-end resources through API
- The policy prevents unauthorized users from gaining access to the back-end resources that might contain sensitive data, thereby ensuring the protection of data and minimizing the risk of data breaches.
- Not following this policy can potentially lead to API abuse, causing unnecessary costs due to the increase in server load and bandwidth usage.
- Ensuring that there is no open access to back-end resources through API is crucial for meeting compliance standards and regulations related to data privacy, like GDPR and HIPAA.
- With this policy in place, the chances of malicious activities, such as unauthorized data manipulation, data theft, or even system compromise, carried out through an open API on AWS infrastructure, are significantly reduced.
Ensure IAM role allows only specific services or principals to assume it
Ensure IAM role allows only specific services or principals to assume it
- This policy helps prevent unauthorized and potentially malicious actors from assuming an IAM role, hence it significantly reduces the risk of security breaches by ensuring that only specified services or principals can assume the role.
- By restricting who can assume IAM roles, the policy provides a layer of access control, which can limit the potential damage done if a service’s or user’s credentials are compromised.
- This policy enables the principle of least privilege (PoLP), a key security concept whereby a user, program or process should have the bare minimum privileges necessary to perform its function. This limits potential escalation paths for an attacker who has compromised a low-privilege account or service.
- Non-compliance with this policy could result in broad and unnecessary permissions, potentially leading to accidental exposure of resources or data within an organization’s AWS account, or even system compromise in some cases.
Ensure AWS IAM policy does not allow assume role permission across all services
Ensure AWS IAM policy does not allow assume role permission across all services
- This policy ensures that entities within the AWS Infrastructure maintain tight control over access privileges, by preventing a user/role from having ‘assume role’ permissions across all services, thus minimizing the potential attack surface.
- The policy enforces least privilege principles, meaning individuals, systems, or applications only gain access to the resources they absolutely need for their tasks, reducing the risk of unauthorized access or accidental changes.
- Preventing ‘assume role’ permissions across all services ensures clear segregation of duties and responsibilities within the AWS environment, enhancing the traceability and accountability of actions performed within AWS.
- This policy helps to prevent potential security breaches or unwanted disruption to business operations as malicious attacks or changes can be made if broad ‘assume role’ permissions are granted, potentially impacting the confidentiality, integrity, and availability of information.
Ensure no IAM policies that allow full '*-*' administrative privileges are not created
Ensure no IAM policies that allow full '*-*' administrative privileges are not created
- This policy is crucial in limiting the blast radius in the event of a security compromise. If an IAM entity with the ’-’ permission set is compromised, attackers can have unrestricted access to all AWS resources and services leading to potential data compromise and system damage.
- The policy is also significant for enforcing the least privilege principle which states that a user should have only those privileges which are essential to perform his job function. Granting full administrative privileges unnecessarily increases the attack surface.
- This policy ensures all IAM policies strictly adhere to AWS best practices which discourage overly permissive policies as they can result in unintended resource access, thereby escalating privileges and enhancing opportunities for malicious activities.
- Implementation of this policy supports better audit compliance as it tracks the creation and management of IAM policies, ensuring only necessary permissions are granted. This helps meet regulatory requirements and avoids penalties for non-compliance.
Ensure all data stored in the Redshift cluster is securely encrypted at rest
Ensure all data stored in the Redshift cluster is securely encrypted at rest
- The policy ensures that sensitive data stored in Redshift clusters is not easily accessible or readable by unauthorized individuals or systems, thus providing an additional layer of security against data breaches and unauthorized access.
- The encryption of data at rest mitigates the risk of data loss and compromises in case the physical hardware or storage mediums are compromised, as the data will remain encrypted and therefore unreadable without the correct decryption keys.
- Addiction to this policy can help organizations comply with data protection laws and regulations, such as the GDPR and CCPA, which require such data to be encrypted and properly secured during storage to protect the privacy of individuals.
- Implementing this policy creates a more secure environment for sensitive data storage by eliminating the potential for human error in manual processes of data encryption in the Redshift clusters and ensures that all the data, without exception, is encrypted.
Ensure container insights are enabled on ECS cluster
Ensure container insights are enabled on ECS cluster
- Enabling container insights on an ECS cluster enables the collection of important metadata information such as CPU and network usage, providing a detailed understanding of the cluster’s performance and helping to identify potential bottlenecks or inefficiencies.
- Container insights provide critical security-related information, including identifying unusual activity that could suggest a potential security issue or attack on the ECS cluster. It thus forms an essential part of an effective security defense strategy in AWS environment.
- Keeping insights enabled ensures that one can trace the cause of any application or service error back to its root, helping to decrease downtime and maintain the stability of the ECS cluster. It can help detect events like sudden spikes in resource usage that might indicate a problem.
- The policy’s implementation through Infrastructure as Code (IaC) via Cloudformation allows consistent enforcement across all ECS clusters, ensuring comprehensive resource monitoring. It enables scalable and automated deployment that is less prone to manual errors, enhancing the security policy’s effectiveness.
Ensure that CloudWatch Log Group specifies retention days
Ensure that CloudWatch Log Group specifies retention days
- The policy ensures that logs in AWS CloudWatch Log Group are not stored indefinitely, contributing to cost efficiency by avoiding unnecessary storage charges.
- Specifying retention days helps in maintaining data integrity and lifecycle management as logs older than the specified retention days are automatically deleted.
- It assists in compliance with data retention policies and legal requirements, which may mandate certain data to be stored for a specific period.
- The policy enforces as a preventive measure against possible data breaches by ensuring potentially sensitive data isn’t held longer than required and exposed to any potential vulnerabilities.
Ensure CloudTrail is enabled in all Regions
Ensure CloudTrail is enabled in all Regions
- Enabling CloudTrail in all regions is important as it provides visibility into user activity by recording actions taken on your AWS infrastructure, thereby increasing transparency and accountability.
- This policy aids in detecting unusual or unauthorized activities by allowing you to review detailed CloudTrail event logs that track every API call made across all regions, providing an additional layer of security.
- It facilitates compliance with various regulations by providing an auditable record of all changes and administrative actions on AWS resources across every region, increasing the traceability and meeting various IT governance requirements.
- Disabling CloudTrail in any region could result in not detecting potential security threats in those regions. This could seriously harm the organization’s valuable resources and data, making this policy crucial for maintaining and improving overall security posture.
CloudFront Distribution should have WAF enabled
CloudFront Distribution should have WAF enabled
- Enabling WAF (Web Application Firewall) on CloudFront distribution adds an extra layer of protection by inspecting incoming web traffic and providing a shield against common exploits like SQL Injection and Cross-Site Scripting attacks, thus reducing vulnerability.
- As CloudFront is a content delivery service, a security gap may result in congestion, Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks on assets. Enabling WAF helps prevent such threats, maintaining the availability of services.
- The policy ensures regulatory and compliance requirements are met, especially for businesses processing large amounts of sensitive data, by providing necessary safeguards and traffic controls on the edge locations close to the user.
- The policy encourages the use of Infrastructure as Code (IaC), which allows for automated security checks and prevent vulnerabilities right from the development stage. This allows for quicker threat detection and reduces the risk of human error during manual inspections.
Ensure Amazon MQ Broker should not have public access
Ensure Amazon MQ Broker should not have public access
- Ensuring that Amazon MQ Broker does not have public access is essential for maintaining data confidentiality and preventing unauthorised or malicious access. If the Broker is publicly accessible, important data can be exposed or compromised.
- Disabling public access supports compliance with data protection and privacy regulations. Regulations like GDPR or HIPAA require strict control of who can access certain types of data, and having a publicly accessible broker could result in non-compliance.
- Having a public access to Amazon MQ Broker may increase the number of attack vectors for potential cyber threats. By restricting public access, the risks associated with Distributed Denial of Service (DDoS) attacks, data breaches, or other malicious activities are significantly reduced.
- Ensuring no public access to Amazon MQ Broker using Infrastructure as Code in CloudFormation allows automation of security configurations and makes it easier to enforce security at scale. This reduces the chances of misconfigurations and human error, while relieving security teams of tedious, manual tasks.
Ensure S3 bucket does not allow an action with any Principal
Ensure S3 bucket does not allow an action with any Principal
- This policy ensures that the access to the S3 buckets is only granted to specific principals (users, roles, services, etc). This restriction prevents unauthorized access, reducing the step-up for potential security breaches.
- By not permitting actions with any principal, the policy reduces the risk of data loss or alteration, providing a stronger control over who can interact with the stored data.
- Ensuring that an S3 bucket does not allow an action with any principal enhances data integrity and confidentiality, as the bucket’s content is only accessible to select, authenticated and authorized entities.
- This policy plays a critical role in adhering to compliance requirements related to data protection and privacy, such as GDPR, making it an integral part of an organization’s overall security strategy.
Ensure Redshift Cluster logging is enabled
Ensure Redshift Cluster logging is enabled
- Enabling Redshift Cluster logging helps provide transparency and visibility of actions taken on your AWS Redshift cluster. This allows for the identification, troubleshooting, and resolution of issues in a timely manner.
- This policy aids in the forensics investigation in case of any security breach or data leak in the Redshift cluster. Log files contain crucial information about all queries and sessions executed by the cluster which can be used as evidence in the aftermath of an incident.
- The Redshift Cluster logging is a critical aspect of compliance with various regulations, such as GDPR, HIPAA, and PCI DSS. Organizations can demonstrate they have robust monitoring and auditing mechanisms in place by enabling logging.
- Lastly, by verifying logging via Infrastructure as Code (IaC) in the form of CloudFormation, organizations standardize configurations and prevent accidental logging deactivation. This practice reduces the chances of human error and improves the overall security posture.
Ensure SQS policy does not allow ALL (*) actions.
Ensure SQS policy does not allow ALL (*) actions.
- Limiting SQS policy actions is critical to minimize the potential attack surface, as allowing ALL (*) actions can provide unnecessary permissions, including those that could compromise the security of the resource.
- Restricting permissions to the minimum required for functionality adheres to the principle of least privilege, a key security best practice, which can prevent exploitation of unintended permissions by malicious entities.
- Implementing this policy via Infrastructure as Code (IaC) using Terraform allows for consistent, repeatable, and trackable security configurations, improving overall security posture and policy compliance.
- Non-compliance with this policy could lead to unauthorized data access, manipulation, or deletion in the SQS queue, potentially causing data loss, system disruption, and compromising the integrity and availability of services.
Ensure API Gateway has X-Ray Tracing enabled
Ensure API Gateway has X-Ray Tracing enabled
- Enabling X-Ray Tracing on API Gateway aids in performance optimization by allowing developers to trace and analyze user requests as they travel through the API Gateway, enabling a detailed view into the behavior of the system.
- X-Ray Tracing in API Gateway assists in troubleshooting and identifying bottlenecks in the system by providing insights into the latency of various components involved in processing a request.
- This policy prevents potential security issues by offering diagnostic capabilities like service mapping and tracing for concurrent executions, aiding in the detection of performance issues and anomalies in the application.
- Non-adherence to this policy could result in lack of transparency and control over the application, causing higher risk of unidentified performance problems or even malicious activity within the system.
Ensure DocumentDB is encrypted at rest (default is unencrypted)
Ensure DocumentDB is encrypted at rest (default is unencrypted)
- This policy is important as it ensures that DocumentDB data is encrypted at rest, significantly reducing the potential risk of unauthorized access and data theft. Without this policy, the data is unencrypted by default which makes it vulnerable to security breaches.
- The encryption at rest feature promotes data integrity and confidentiality. If a malicious actor were to gain physical or virtual access to the storage, they would be unable to utilize the data without the decryption keys.
- Implementing this policy using Infrastructure as Code (IaC) like CloudFormation improves manageability and provides an automated and consistent way to manage the encryption settings across multiple DocumentDB databases or clusters.
- By not enforcing this policy, sensitive data stored in AWS DocumentDB could fail to meet certain compliance requirements (like PCI-DSS, GDPR, or HIPAA), leading to penalties or loss of certifications critical to business operations.
Ensure Global Accelerator accelerator has flow logs enabled
Ensure Global Accelerator accelerator has flow logs enabled
- Enabling flow logs on Global Accelerator accelerator allows for comprehensive visibility of network traffic, thereby assisting with threat detection and optimizing network performance.
- This policy aids in tracking and debugging network connectivity issues, identifying patterns, and understanding the nature of data packets flowing in and out of the network interface.
- It contributes to regulatory compliance and audit requirements as it enables capturing of metadata about the IP traffic going to and from the network interfaces in the accelerator.
- Any security incidents or unusual activity can be swiftly identified and visualized with flow logs, reducing the risk of cyber threats, malware, and data breaches.
Ensure API Gateway has Access Logging enabled
Ensure API Gateway has Access Logging enabled
- Enabling Access Logging on API Gateway provides detailed records of each API request, enhancing visibility of user activity and data flow which is critical for diagnosing issues and identifying suspicious behavior.
- The detailed logs captured can serve as an invaluable asset during a security event, allowing forensic teams to trace back malicious actions, discover IP addresses of potential attackers or understand the methods employed for the attack.
- Implementing this policy can help with regulatory compliance requirements, as many regulations such as GDPR, HIPAA, and PCI DSS emphasize keeping detailed transaction logs to ensure the safety of data and help with audits.
- By analyzing logs, organizations can gain insights into application performance, user behavior, and can identify optimization opportunities, ultimately enhancing application’s efficiency and user experience.
Ensure Athena Database is encrypted at rest (default is unencrypted)
Ensure Athena Database is encrypted at rest (default is unencrypted)
- The policy ensures that data stored within the AWS Athena Database is protected from unauthorized access, which can occur when the data is at rest or not in active use. This encryption enhances the security measures around sensitive information that an organization may hold.
- Without this policy, the default setting leaves your AWS Athena Database unencrypted, posing a risk of data breaches and unauthorized access to confidential data, hence potentially incurring financial and reputational costs.
- Applying this policy through Terraform automation ensures a standardized approach to database encryption, eliminating human error in manual implementation and maintaining infra security consistency across all databases.
- The policy complies with various data protection regulations and standards such as GDPR and HIPAA, which mandate that personal data be stored and handled securely, therefore reducing the risk of non-compliance penalties.
Ensure that CodeBuild Project encryption is not disabled
Ensure that CodeBuild Project encryption is not disabled
- Ensuring that CodeBuild Project encryption is not disabled safeguards sensitive data from unauthorized access, as the data is kept obscured when at rest and during transmission.
- This policy minimizes the risk of data breaches and leaks by encrypting the data. It makes the data unreadable and useless for anyone who manages to gain unauthorized access.
- Since many governments, standards organizations, and industries require encryption as part of their regulations and laws, adherence to this policy helps ensure regulatory compliance.
- Neglecting to enforce this policy could damage the reputation of an enterprise and lead to loss of customer trust, given that insecure handling of data can result in its violation.
Ensure Instance Metadata Service Version 1 is not enabled
Ensure Instance Metadata Service Version 1 is not enabled
- This policy is important because enabling Instance Metadata Service Version 1 (IMDSv1) can lead to potential unauthorized access to instance metadata, which could harm the integrity and confidentiality of your AWS resources. Disallowing IMDSv1 reduces this risk.
- If IMDSv1 is enabled, it could allow for features such as open network access or unauthenticated network access, making your infrastructure more prone to attacks from malicious actors.
- Not enforcing this policy and allowing IMDSv1 could lead to a compromise of the EC2 instance’s credentials. Unauthorized individuals could potentially access the IAM role credentials from the instance metadata, which could give them full control of the AWS account.
- Complying with this policy helps in adhering to security best practices and overall improving the security stance of your cloud environment, enhancing the trust of stakeholders or customers in your cloud infrastructure security.
Ensure MSK Cluster logging is enabled
Ensure MSK Cluster logging is enabled
- Enabling MSK Cluster logging is important as it creates an audit trail of all actions performed within the cluster, which aids in diagnosing errors, detecting suspicious activity, and identifying potential security breaches.
- The logging functionality also tracks performance and network metrics, helping highlight any potential capacity and resource utilization issues providing critical information to optimize the cluster usage and manage the cost.
- This policy of logging forms a significant part of compliance requirements for many regulations, including GDPR and HIPAA; therefore, ensuring all activities are logged and auditable is essential for organizations dealing with sensitive data.
- From a troubleshooting perspective, logs can provide insights into why an MSK cluster is not working as expected, helping to reduce the downtime and improve the overall resilience of the application using Amazon MSK service.
Ensure MSK Cluster encryption in rest and transit is enabled
Ensure MSK Cluster encryption in rest and transit is enabled
- Ensuring MSK Cluster encryption in rest and transit is critical in preventing unauthorized disclosure of data while it is stored or in transit within the cluster. This contributes to maintaining the privacy and integrity of data.
- Without this security measure, sensitive data in the clusters such as user details, transaction history and other critical business information are at risk of exposure, potentially leading to significant reputational damage and financial losses due to data breaches.
- By enforcing this policy through CloudFormation, automatic checks can be set up to verify if encryption is enabled, thus reducing manual efforts, the risk of human error, and enhancing overall security robustness.
- The impact of consistent adoption of this policy would also involve compliance with regulations and standards such as GDPR and PCI DSS that mandate data protection including encryption, shielding the organization from potential legal penalties.
Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption
Ensure Athena Workgroup should enforce configuration to prevent client disabling encryption
- This policy helps protect sensitive data by ensuring that client encryption in Athena Workgroup is always enabled. If clients are allowed to disable encryption, they could potentially expose sensitive data to unauthorized users.
- Enforcing this configuration policy can help with compliance with certain industry standards and regulations, such as GDPR and HIPAA, which require strong encryption for data in transit and at rest.
- It reduces the potential attack vector for malicious actors who could exploit unencrypted traffic or data, helping to improve the overall infrastructure security.
- It ensures that any infrastructure as code (IaC) using CloudFormation for AWS Athena Workgroup respects the security best practice of always enforcing encryption, reducing the risk of human error causing a security breach.
Ensure Elasticsearch Domain enforces HTTPS
Ensure Elasticsearch Domain enforces HTTPS
- Ensuring Elasticsearch Domain enforces HTTPS enhances the security of data in transit between the client and the server by encrypting it, which helps prevent unauthorized access and tampering.
- This policy safeguards sensitive information in Elasticsearch Domain from being exposed during transmission, reducing the risk of data breaches or leaks due to eavesdropping on network traffic.
- Non-compliance with this policy could potentially leave the Elasticsearch domains vulnerable to man-in-the-middle attacks where attackers could hijack the connection and steal sensitive information.
- Implementing this policy via Infrastructure as Code (IaC) with CloudFormation allows for scalability, repeatability and helps maintain a secure configuration regardless of the environment size or complexity.
Ensure Elasticsearch Domain Logging is enabled
Ensure Elasticsearch Domain Logging is enabled
- Enabling Elasticsearch Domain Logging is critical as it provides detailed visibility into user activity and system performance, thus making it easier to monitor and diagnose issues within the Elasticsearch environment.
- The policy allows for transparency and traceability, as Elasticsearch Domain Logging stores and organizes logs which can be instrumental in identifying potential security threats, data breaches, or unauthorized access attempts.
- Enforcing this policy improves compliance to regulations and standards, as enabling Domain Logging is a common requirement in many regulatory compliances, thus reducing potential legal and operational risks for businesses.
- By utilizing Infrastructure as Code (IaC) through Cloudformation and referencing the given Python script, the implementation of Elasticsearch Domain Logging becomes streamlined and error-prone manual processes are eliminated, enhancing efficiency and reliability of security measures.
Ensure DocumentDB Logging is enabled
Ensure DocumentDB Logging is enabled
- Enabling DocumentDB Logging enhances monitoring and auditing processes by capturing data modification, access, and authentication attempts, which are critical for adhering to compliance and governance standards, potentially preventing fines and penalties.
- It helps in identifying potential security threats or breaches as abnormal activities, such as suspicious data access or modifications, can be detected and mitigated promptly, therefore protecting sensitive data from unauthorized usage or malicious attacks.
- If problems occur in DocumentDB operations, the logged data can assist in diagnosing and resolving issues, hence improving operational efficiency and reducing downtime.
- Providing evidence of all actions in DocumentDB, this policy increases the traceability and visibility over infrastructure changes, which contributes to overall security enforcement and can be used in forensic investigations if necessary.
Ensure CloudFront Distribution has Access Logging enabled
Ensure CloudFront Distribution has Access Logging enabled
- Enabling Access Logging for CloudFront distribution is crucial as it will maintain comprehensive logs of all access requests and activities. This can significantly contribute to data security and monitoring, offering extended visibility over who is accessing data, when, and how.
- Anomalies or suspicious activities can be detected with these logs, helping to identify and mitigate possible breaches or threats promptly. This can further reinforce the robustness of cloud security.
- Adequate logging can support and facilitate post-incident forensics and audits in case any security issue emerges. By analysing these detailed logs, companies can identify the root cause and take necessary actions to prevent future security incidents.
- The policy also ensures compliance with various global safety standards like GDPR, HIPPA, ISO 27001, which makes it paramount for organizations adhering to these protocols. Access Logging is a crucial measure analysed during third-party audits and can help to avoid potential fines or reputational damage due to non-compliance.
Redshift cluster should not be publicly accessible
Redshift cluster should not be publicly accessible
- Making a Redshift cluster publicly accessible increases the risk of a data breach, as it exposes the database to every network connected to the internet, including potential attackers.
- AWS :: Redshift :: Cluster and aws_redshift_cluster entities contain sensitive data, yet making them publicly accessible inadvertently exposes this data to unauthorized access or malicious activity.
- By keeping the Redshift cluster privately accessible, only authorized devices and users can access and interact with it, thus maintaining the data integrity and confidentiality.
- RedshiftClusterPubliclyAccessible.py is a security check script that ensures Redshift clusters are not made publicly accessible, thereby ensuring the policy is adhered to and preventing potential data leakage and breaches.
EC2 instance should not have public IP.
EC2 instance should not have public IP.
- This policy mitigates the potential risk of unauthorized access to the EC2 instances by ensuring that they do not have a public IP address, an important measure given that public IP addresses are accessible from the internet.
- Whence, it significantly reduces the attack surface for potential cyber threats such as data breaches and denial of service attacks.
- By preventing public IP assignment to EC2 instances, the policy indirectly encourages the use of secure connectivity solutions like AWS VPN or AWS Direct Connect for interfacing with these instances, leading to improved security.
- Additionally, this policy aids in orchestrating a better access control by mandating a more controlled access to the instances through private networks or secure gateways rather than open internet.
DMS replication instance should not be publicly accessible
DMS replication instance should not be publicly accessible
- This policy helps prevent unauthorized access and potential data breaches since it ensures that Database Migration Service (DMS) replication instances aren’t exposed to the public, thereby limiting potential attack vectors from malicious entities.
- By only allowing private access to DMS replication instances, the policy aids in maintaining the integrity and confidentiality of the data during transit by reducing the likelihood of interception.
- The policy promotes adherence to the principle of least privilege, a key security best practice, by restricting access to only necessary and trusted entities which reduces the risk to exposure.
- Non-compliance to this policy could lead to increased costs, reputational damage, and regulatory penalties due to potential breach of privacy laws or regulations, if sensitive data is exposed.
Ensure DocumentDB TLS is not disabled
Ensure DocumentDB TLS is not disabled
- Ensuring DocumentDB TLS is not disabled is important for maintaining secure connections between clients and your DocumentDB cluster. Without TLS, data in transit may be exposed to potential interception and unauthorized access, leading to data breaches or loss.
- Enforcing this policy prevents modification of data during transit. TLS provides end-to-end encryption such that any tampering or alteration of data can be detected during the transmission of data between the client and the DB cluster.
- Having enabled TLS for DocumentDB is a compliance requirement for many industry standards such as ISO 27001, PCI-DSS, or HIPAA, which dictate secure transmission of any sensitive or personal data.
- Non-compliance to this policy can lead to a cluster’s vulnerability to ‘man-in-the-middle’ attacks, where an attacker intercepts and potentially modifies communications between two parties without their knowledge. This could severely compromise the integrity and privacy of data on the platform.
Ensure the ELBv2 (Application/Network) has access logging enabled
Ensure the ELBv2 (Application/Network) has access logging enabled
- Enabling access logging on ELBv2 (Application/Network) provides detailed records of all requests made to the load balancer, thus increasing visibility into traffic patterns, usage, and any potential security risks.
- Access logs can help in identifying patterns and anomalies such as repeated requests from a certain IP, indicating a potential cyber-attack, and thus aids in proactive security monitoring and threat detection.
- The log data can facilitate auditing and compliance efforts by verifying who has accessed the service, when, and what actions were performed, enabling organizations to meet regulatory standards for data accountability and transparency.
- By combining Cloudformation IaC and automatic logging as per the linked resource script, companies can streamline their data governance protocols, creating more efficient methods for monitoring and maintaining secure infrastructure.
Ensure the ELB has access logging enabled
Ensure the ELB has access logging enabled
- Enabling ELB (Elastic Load Balancer) access logging provides a detailed record of all requests made to a load balancer. This aids in identifying traffic patterns and potential security vulnerabilities, assisting in threat mitigation and capacity planning.
- Application performance optimization becomes more efficient with ELB access logging enabled as it allows fully detailed understanding of the unique characteristics and behaviors of the traffic flowing through the load balancer.
- If an unexpected data breach or unusual activity is detected in a system, the ELB access logs can be used for forensic analysis to track the incident and assess the impact, which helps cybersecurity teams quickly identify and fix security holes.
- Enabling access logging on ELB balances AWS’s share of responsibility in ensuring the safety and reliability of enterprise cloud systems, and allows IT teams to effectively monitor and enforce corporate and regulatory compliance policies.
Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)
Ensure S3 bucket policy does not lockout all but root user. (Prevent lockouts needing root account fixes)
- Ensuring S3 bucket policies do not exclude all but root users is crucial to maintain smooth operations. If only the root user is allowed access, routine tasks and maintenance would need root level privileges, which can be inefficient and unnecessarily risky.
- This policy can help to lower the risk of data breaches. If an aws_s3_bucket or aws_s3_bucket_policy is accidentally locked to all but the root user, it could possibly enable unauthorized access to confidential data, given the overarching permissions of the root user.
- The policy aids in preventing loss of access to critical AWS resources. If all other users are locked out, it might require root account intervention which can be time-consuming and may lead to downtime, which could hamper business operations.
- Compliance adherence is another significant aspect of this policy. By restricting lockout scenarios to root user only, the policy helps in adherence to specific regulatory requirements and compliance standards related to minimum privileges and access control measures.
Ensure Glue Data Catalog Encryption is enabled
Ensure Glue Data Catalog Encryption is enabled
- Enabling Glue Data Catalog Encryption provides additional layer of security by encrypting the metadata stored in Data Catalog like database and table definitions, thereby preventing unauthorized access to sensitive data.
- The policy significantly reduces the risk of data breach as even if access control mechanisms fail or are bypassed, the encrypted data would remain inaccessible to malicious actors.
- Following the policy ensures compliance with security standards and regulations like GDPR and HIPAA which mandate encryption of sensitive data, thereby avoiding potential legal issues and penalties.
- The policy impacts business reputation positively as compliance with this policy would increase confidence of clients, stakeholders, and users in the organization’s data handling and security practices.
Ensure API Gateway V2 has Access Logging enabled
Ensure API Gateway V2 has Access Logging enabled
- Enabling Access Logging for API Gateway V2 allows tracking and analyzing all API calls made on the platform. This provides a full audit trail and helps to identify any unauthorized or suspicious activity.
- The API Gateway Access Logging not only tracks successful requests but also error responses, offering deeper insights into potential coding or infrastructure issues that could be contributing to API failure or increased latency.
- When Access Logging is turned off, critical data about unique callers, request paths, JWT tokens, or IP addresses could be lost. This information plays a pivotal role during forensic analysis after a security incident.
- Implementing Access Logging on API Gateway V2 using Cloudformation makes the log configuration consistent and reusable. This scalability reduces the risk of human error and saves time for IT teams maintaining the infrastructure.
Ensure all data stored in Aurora is securely encrypted at rest
Ensure all data stored in Aurora is securely encrypted at rest
- Ensuring all data stored in Aurora is securely encrypted at rest helps protect sensitive data from unauthorized access, enhancing data security. If an attacker gains physical access to the hardware, they will not be able to use the data without the encryption key.
- This policy conforms to compliance regulatory standards like GDPR, HIPAA, PCI-DSS, and more that require data encryption in specific fields. Failing to encrypt data can lead to heavy fines and legal consequences against these standard rules.
- Encryption at rest increases data integrity and confidentiality. If the data was compromised, it would be of no value without the decryption keys, thereby securing the data even in worst-case scenarios (e.g., data breaches).
- Implementing this policy with Infrastructure as Code (IaC) tool like CloudFormation ensures a standardized and consistent approach towards data encryption in Aurora across all applicable DB Clusters, reducing the risk of human error or overlooking this crucial security aspect.
Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions
Ensure Encryption in transit is enabled for EFS volumes in ECS Task definitions
- Enabling encryption in transit for EFS volumes in ECS Task definitions ensures the confidentiality and integrity of data as it is passed over networks between the ECS Tasks and EFS file systems. This is particularly relevant when dealing with sensitive information that could be intercepted or corrupted during transmission.
- By applying this policy, any unauthorized modification to the data during transmission will be detected. It prevents ‘man-in-the-middle’ attacks where an intruder intercepts the communication between two points and alters the information.
- ECS Task definitions without encrypting EFS volumes could potentially violate compliance regulations. Enforcing this policy keeps operations within AWS and global security standards, preventing legal ramifications and reputation damage due to non-compliance.
- Additionally, a direct impact of not having this policy could result in increased vulnerability to security breaches, leading to potential financial loss, disruption to operations, and data leaks, which can have severe consequences for businesses.
Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest
Ensure all data stored in the Sagemaker Endpoint is securely encrypted at rest
- This policy ensures the integrity and confidentiality of sensitive data by encrypting it when it’s not in use, reducing the risk of data breaches and unauthorized access that could result in severe fines and damage to brand reputation.
- Using secure encryption methods in AWS Sagemaker Endpoint configurations can protect the data against potential threats such as hacking attempts, internal misuse, or inadvertent data leakage, thereby enhancing data privacy and compliance with legal and regulatory data protection standards.
- The policy also provides a security feature to safeguard in-transit data (when moving from one location to another) by enforcing server-side encryption which makes it unreadable until it is decrypted with the correct key.
- With the Infrastructure as Code (IaC) approach such as Terraform, infrastructure becomes easier to manage, audit, and reproduce, facilitating automation of this policy across various stages of the development life cycle, thereby ensuring continuous security and compliance enforcement.
Ensure Glue Security Configuration Encryption is enabled
Ensure Glue Security Configuration Encryption is enabled
- Ensuring Glue Security Configuration Encryption is enabled protects sensitive data because it encrypts all the data stored in AWS Glue. If an unauthorized user obtains the data, they are unable to read it as it is encrypted.
- Not enabling encryption in Glue Security Configuration poses the risk of a data breach which can have severe consequences including financial loss, reputational damage, and potential legal repercussions for not complying with data protection laws.
- Implementing this policy encourages good infrastructure security practice by enforcing encryption by default. This can help businesses to comply with data protection and privacy regulations, such as GDPR or HIPAA.
- Implementing this Cloudformation policy through IaC means that it is consistently enforced across all AWS environments, reducing the chance of human error when setting up new environments or making changes. Thus, improving the overall security posture of the organization.
Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0
Ensure AWS EKS node group does not have implicit SSH access from 0.0.0.0/0
- The policy ensures the security of AWS Elastic Kubernetes Service (EKS) node groups by restricting unauthorized SSH access. A node group with SSH access from 0.0.0.0/0 is potentially accessible by anyone on the internet, posing a significant security risk.
- Since AWS EKS node groups hold vital system-level data and resources, having this policy in place drastically reduces the chances of a security breach, by limiting access to authorized entities only, which is crucial for maintaining the integrity and confidentiality of the system.
- Enforcing this policy helps organizations comply with industry best practices and regulatory compliance standards related to data security and privacy, as it ensures that the principle of least privilege is followed.
- Blocking SSH access from 0.0.0.0/0 can prevent various types of attacks including brute-force, which rely on unlimited unauthorized access attempts, thereby significantly enhancing the overall security posture of the system.
Ensure Neptune logging is enabled
Ensure Neptune logging is enabled
- Enabling Neptune logging provides visibility of all database events, critical for analyzing and troubleshooting issues. Without it, diagnosing operational problems, bottlenecks or failures is extremely difficult.
- Neptune logging helps the organization adhere to regulatory compliances, as it tracks data access and manipulation. Certain compliance requirements mandate logging and preservation of these logs for a predefined period.
- Logs generated through Neptune logging can be used for audit purposes. They consist of administrative activities and user activities, which can help detect unauthorized access or anomalous activities within the database.
- When enabled, Neptune logging offers a historical record of the Neptune database activity, which can be useful in post-incident forensics and understanding the sequence of events leading up to any issue.
Ensure Neptune Cluster instance is not publicly available
Ensure Neptune Cluster instance is not publicly available
- Ensuring Neptune Cluster instance is not publicly available helps to reduce the attack surface for potential hackers, since they won’t be able to directly target the server if they do not have internal network access.
- This policy can prevent the exposure of sensitive data stored in the Neptune Cluster instance, as it reduces the risk of unauthorized access to the data by malicious entities.
- Following this policy allows organizations to meet compliance with various regulations, and industry standards that require data and systems to be secured and not publicly accessible.
- Implementing this policy via Infrastructure as Code (IaC) using Terraform automates and standardizes the process of securing Neptune Cluster instances across various deployments, thus increasing operational efficiency and reducing human error.
Ensure that Load Balancer Listener is using at least TLS v1.2
Ensure that Load Balancer Listener is using at least TLS v1.2
- The policy ensures that the Load Balancer Listener uses TLS v1.2, providing a high level of security for data transmission. TLS v1.2 protocols have enhanced security features that help protect against common threats like man-in-the-middle attacks and eavesdropping.
- Non-compliance with this policy may result in data being transmitted over connections that are vulnerable to interception and manipulation. This could lead to data breaches, loss of privacy, and possible regulatory penalties.
- This policy impacts the configuration of AWS ElasticLoadBalancingV2::Listener, aws_alb_listener, aws_lb, and aws_lb_listener entities. By enforcing the use of a secure protocol, it helps to ensure the integrity and confidentiality of data transmitted via these entities.
- Enforcing this policy through Infrastructure as Code (IaC) using CloudFormation allows for consistent implementation across resources, simplifies auditing, and enables automatic enforcement. This leads to reduced administrative overhead and lower risk of security misconfigurations.
Ensure DocumentDB has audit logs enabled
Ensure DocumentDB has audit logs enabled
- Having audit logs enabled for DocumentDB provides a thorough record of database activities, which can be useful for debugging, investigating suspicious activities, and ensuring compliance with various data governance and privacy requirements.
- This policy helps identify and mitigate potential security threats and vulnerabilities. It helps maintain a traceable sequence of actions that lead to event such as database changes, access attempts, and transactions.
- It improves the reliability of the system by ensuring all the changes made to the database are tracked. This aids in system recovery in case of errors or system failures, as it can provide information on the last state of the system.
- The IaC (Infrastructure as Code) approach described in the provided link automates the process of enabling audit logs, reducing human error and ensuring consistency across multiple instances of DocumentDB.
Ensure Redshift uses SSL
Ensure Redshift uses SSL
- Using SSL with Amazon Redshift ensures that data in motion is encrypted during transmission, providing an important layer of security for data that may contain sensitive information.
- Implementing this policy helps to avoid man-in-the-middle attacks, in which unauthorized individuals can intercept and potentially manipulate data as it travels between the Redshift cluster and your applications.
- The policy also confirms the identity of the Redshift cluster to your applications, protecting your data infrastructure from spoofing attacks and unauthorized access attempts.
- Non-compliance with this security policy could lead to violating several regulatory compliance requirements such as GDPR and HIPAA, potentially resulting to legal ramifications and reputation damage.
Ensure EBS default encryption is enabled
Ensure EBS default encryption is enabled
- Enabling EBS default encryption ensures that all new EBS volumes and snapshot data are automatically encrypted, reducing the risk of data leakage or unauthorized access.
- This policy helps in compliance with regulatory standards and frameworks that require encryption of data at rest such as HIPAA, GDPR, and PCI DSS, such mitigating potential legal and financial implications.
- It significantly simplifies the management and enforcement of data encryption, as administrators do not have to encrypt each and every volume or snapshot manually.
- By enabling encryption by default, this policy enhances data protection in multi-tenant storage environments, reducing the potential exposure of sensitive data in the event of shared resource scenarios.
Ensure IAM policies does not allow credentials exposure
Ensure IAM policies does not allow credentials exposure
- This policy prevents unauthorized access and potential misuse of AWS resources by ensuring that IAM policies do not expose sensitive credentials. Exposure of such sensitive credentials can lead to breach of critical data and compromise the integrity of the system.
- Adhering to this policy reduces the risk of credential theft, as it minimizes the chances of password and secret keys being targeted by attackers. This protects the system from unauthorized activities such as data alteration, data deletion or disrupting the services.
- This policy ensures the principle of least privilege is maintained in the IAM policies by not exposing any unnecessary credentials, hence, minimizing the potential attack surface to malicious entities.
- Non-compliance to this policy can result in the failure of regulatory requirements, as many standards and laws mandate strict control over access to sensitive information. Implementing this policy aids in compliance with such regulations, minimizing the risk of hefty fines and potential reputational damage.
Ensure IAM policies does not allow data exfiltration
Ensure IAM policies does not allow data exfiltration
- Preventing data exfiltration through IAM policies ensures that sensitive data stored in the AWS environment cannot be extracted by unauthorized entities, mitigating the risk of data breaches and ensuring compliance with data security regulations.
- The policy helps in restricting IAM roles and permissions that can potentially lead to unwanted data loss or exposure. This includes limiting outbound data transfers or preventing users from downloading data, effectively keeping the data within the confines of the infrastructure.
- Implementation of this policy via Terraform enhances infrastructure security using Infrastructure as Code (IaC) practices, making it auditable, repeatable, and easily configurable, which can streamline security and compliance checks.
- The policy applies to aws_iam_group_policy, aws_iam_policy, aws_iam_role_policy, aws_iam_user_policy, aws_ssoadmin_permission_set_inline_policy. By checking these entities for data exfiltration permissions, the policy ensures fine-grained access control and reduces the attack surface through which internal or external threats could exploit to gain unauthorized access.
Ensure IAM policies does not allow permissions management without constraints
Ensure IAM policies does not allow permissions management without constraints
- Ensuring IAM policies do not allow permission management without constraints is important for limiting the scope of control that individual entities have, preventing potentially malicious actions or costly mistakes from impacting the entire system.
- This policy reduces security risks by ensuring that all permissions granted are explicitly regulated, limiting the opportunity for breach of access to unauthorized users due to incorrectly granted permissions or access escalation.
- It’s significant in maintaining system integrity in the context of least privilege and segregation of duties principles, as unrestricted permission management can potentially lead to privilege escalation, unauthorized data access, or compromise of AWS resources.
- Implementing this policy encourages robust policy management by enforcing a systematic approval process for access rights and changes, fostering a more secure and organized infrastructure that improves overall operational efficiencies.
Ensure IAM policies does not allow privilege escalation
Ensure IAM policies does not allow privilege escalation
- This policy reduces the risk of an unauthorized user gaining increased access rights by preventing IAM policies that allow for privilege escalation. This is a dangerous vector of attack where a user with limited privileges manipulates the system to gain higher permissions.
- The policy ensures that any system or application privileges are granted in a controlled and audited manner, preventing misuse or accidental privilege escalation that could lead users to access, alter or delete sensitive and strategic assets unknowingly.
- The implemented policy can limit the potential damage during a security breach, as an attacker is confined to the permissions of the compromised account, reducing their ability to create significant impact.
- Acting in accordance with this policy supports the application of least privilege security principle in AWS environment - which states that a user should be given the minimum levels of access necessary to perform their job functions, thereby, preventing unnecessary exposure of sensitive information.
Ensure IAM policies does not allow write access without constraints
Ensure IAM policies does not allow write access without constraints
- This policy helps prevent unauthorized modifications to infrastructure resources or configurations by ensuring that write access is only granted to select IAM entities and under specific conditions. As a result, this reduces the potential for security breaches or accidents that could compromise the integrity or availability of services.
- The policy restricts changes to IAM entities, thereby minimizing the risk of privilege escalation – a security flaw where a user gets elevated permissions not originally granted, which can be exploited maliciously to reveal sensitive information or disrupt systems.
- By ensuring IAM policies do not allow unrestricted write access, it provides an additional layer of protection to guard against violations of the principle of least privilege, where users are only given the minimum permissions necessary to carry out their tasks. Escalation of privileges can pose serious security risks and this policy effectively acts as a safeguard.
- This policy can help in the auditing and compliance process by making sure that IAM roles and permissions adhere to security best practices, which is critical for meeting regulatory and compliance standards within the organization or as established by regulatory bodies.
Ensure Session Manager data is encrypted in transit
Ensure Session Manager data is encrypted in transit
- Ensuring Session Manager data encryption in transit is vital as it enhances data security and integrity by preventing unauthorized access to sensitive information during transmission. This is critical because the data can potentially be intercepted when it is in transit.
- When data is transmitted unencrypted, it could be susceptible to ‘man-in-the-middle’ attacks where attackers can easily intercept and potentially manipulate the data. Implementing this policy mitigates such risks.
- This policy ensures that AWS Systems Manager (SSM) Document, a crucial entity in AWS infrastructure, adheres to best practices for secure communication, thus maintaining secure access and execution configuration in AWS systems.
- Implementing this policy through Infrastructure as Code (IaC) using Terraform ensures consistent application of security measures across different environments, making it more manageable as configurations become more complex over time. This also helps with compliance as security standards demand always-on encryption.
Ensure Session Manager logs are enabled and encrypted
Ensure Session Manager logs are enabled and encrypted
- Enabling Session Manager logs in aws_ssm_document ensures that all activities carried out during a session are tracked and recorded, enhancing the auditability and accountability of the system.
- The policy keeps the system compliant with general security standards, as continuous logging is a recommended practice to monitor system vulnerabilities and irregular activities.
- Encryption of the logs adds an additional layer of protection against unauthorized access to the log details, ensuring that sensitive information is not compromised.
- Implementing this policy through Infrastructure as Code (IaC) tool Terraform, encourages scalability and repeatability, reducing the risk of manual errors and increasing the efficiency of security operations.
Ensure that EMR clusters with Kerberos have Kerberos Realm set
Ensure that EMR clusters with Kerberos have Kerberos Realm set
- Ensuring that EMR clusters with Kerberos have Kerberos Realm set helps prevent unauthorized access into the EMR clusters. The Kerberos Realm is vital in security because it identifies and authenticates users in the network domain before providing them access.
- This policy ensures the correct configuration and implementation of security controls in AWS EMR clusters. Misconfigurations are a common cause of security vulnerabilities and can lead to potential breaches when not addressed properly.
- Enforcing this policy can help organizations adhere to best practices for AWS resource management and data protection. Adhering to such practices reduces the risk from both external threats and internal errors.
- This policy, when implemented through Terraform IaC, can lead to better compliance and auditability, as the configuration is managed as code and changes can be easily tracked and reverted if necessary. This improves overall governance and risk management processes.
Ensure that AWS Lambda function is configured for function-level concurrent execution limit
Ensure that AWS Lambda function is configured for function-level concurrent execution limit
- The policy helps in preventing overload or overutilization of resources by setting a limit on the number of concurrent executions for each AWS Lambda function, hence ensuring optimal performance and availability of services.
- By enforcing this policy, one can mitigate the risk of unintended spikes in demand slowing down or entirely halting mission-critical functions due to excessive Lambda function execution instances.
- Enforcing a function-level concurrent execution limit in AWS Lambda enables the fine-tuning of resources and better cost control, as it provides more transparency over function invocations happening in parallel.
- Should AWS Lambda roll out certain regional restrictions on the concurrent execution, setting a function-level execution limit will ensure your system’s compliance with AWS’s limitations, thus securing your infra against unforeseen AWS Lambda changes.
Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)
Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)
- Ensuring that AWS Lambda function is configured for a Dead Letter Queue(DLQ) significantly reduces the potential for message loss during Lambda execution failures, thereby improving the data integrity and reliability of the AWS application.
- This configuration directly affects the execution of serverless applications, providing a safe and managed location (the DLQ) where unprocessed events can be held for further investigation or reprocessing, thus assuring continuity of business operations.
- Setting up a DLQ for Lambda functions aids in troubleshooting by collecting all unprocessed events which failed due to issues in the code or configuration. Engineers can analyze these events to understand and rectify the problems.
- The absence of a DLQ configuration in AWS Lambda functions might lead to untraceable or unnoticed processing failures leaving data or transactions in an inconsistent state, posing consequential risks to the organisation’s security and operational efficiency.
Ensure that AWS Lambda function is configured inside a VPC
Ensure that AWS Lambda function is configured inside a VPC
- AWS Lambda functions within a VPC ensure a higher level of data safety and privacy, as the secure network environment of a VPC limits the exposure of the function, its data, and its execution to only other resources in the same VPC.
- Enabling AWS Lambda functions to run inside a VPC ensures all data transferred between the function and other AWS services remain within the AWS network, reducing the risk of data interception or unauthorized access.
- Running AWS Lambda functions inside a VPC provides better control and visibility over the function’s network access since all traffic going to and from the Lambda function will pass through the VPC’s network access control lists and security groups.
- Configuring AWS Lambda functions inside a VPC allows an organization to apply corporate security policies consistently across the entire IT environment. This improves network security and compliance with internal and external network security standards and regulations.
Ensure that enhanced monitoring is enabled for Amazon RDS instances
Ensure that enhanced monitoring is enabled for Amazon RDS instances
- Enabling enhanced monitoring on Amazon RDS instances provides detailed metrics about your RDS instances’ CPU, memory, file system, and disk I/O operations. These insights are crucial for capacity planning, performance troubleshooting, and identifying anomalies in instance behavior.
- Enhanced monitoring covers several system processes that run at an operating system level, allowing for a more comprehensive insight into the health of your database infrastructure. This granularity can assist in quicker and more accurate root cause analysis during a security event or service disruption.
- Failure to enable enhanced monitoring could lead to a significant delay in identifying and addressing performance issues or potential security threats, resulting in prolonged system downtime, compromised application performance, and potential data breaches or losses.
- Enhanced monitoring generates logs and metrics crucial for meeting certain compliance standards, particularly those related to data security and availability. Not enabling it could lead to violations of these standards and potential legal and financial repercussions.
Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK
Ensure DynamoDB Tables are encrypted using a KMS Customer Managed CMK
- This policy is important as it ensures that all data stored within DynamoDB tables is encrypted using a KMS Customer Managed CMK, adding an additional layer of security and protection against unauthorized access or data breaches.
- By using a Customer Managed CMK, the user has full control over the Key Management Service (KMS), adding a further level of flexibility and customization to the security configuration over the default AWS managed keys.
- If DynamoDB tables are not encrypted with a KMS Customer Managed CMK, sensitive data could be compromised if there was a security breach or unauthorized access, making the organization non-compliant with various data protection regulations.
- The execution of this security policy can help in reducing potential points of vulnerability, safeguarding the integrity and confidentiality of data stored within DynamoDB tables, which is crucial for organizations in maintaining trust with clients and stakeholders.
Ensure API Gateway caching is enabled
Ensure API Gateway caching is enabled
- Enabling API Gateway caching improves the performance of API calls by storing responses of recent requests to avoid unnecessary repeated execution, thus saving time and computational resources.
- With caching enabled, it helps in reducing the back-end load by preventing the need for repetitive data retrieval from databases, enhancing the overall system efficiency.
- Caching also helps in saving money on AWS as it minimizes the number of calls to the back-end system, reducing operational costs by decreasing the total number of requests processed.
- However, when caching is enabled, it’s crucial to manage security properly because sensitive data might accidentally be cached and made available to unauthorized parties if not carefully handled, potentially leading to data breaches.
Ensure AWS Config is enabled in all regions
Ensure AWS Config is enabled in all regions
- Ensuring AWS Config is enabled in all regions provides a unified view of all resource configurations across a wide geographical area, making it easier for administrators to manage infrastructures and troubleshoot issues.
- This policy allows for better auditability. Using AWS Config in all regions provides a detailed record of the configuration history of all AWS resources, making it easier to comply with governance policies, conduct audits, and verify compliance with external regulations.
- It increases security through continuous monitoring. AWS Config identifies and alerts administrators about instances where deployed resources do not align with desired configurations, enabling quicker security threat or misconfiguration detection and resolution.
- Having AWS Config enabled across all regions optimizes resource usage, reducing costs, as there is no need to enable or configure AWS Config for each region separately. This unified management enhances the efficient usage of IT staff time and resources.
Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance
Ensure that direct internet access is disabled for an Amazon SageMaker Notebook Instance
- Disabling direct internet access for an Amazon SageMaker Notebook Instance enhances security by minimizing the potential attack surface for malicious threats like malware or hackers that can penetrate through the public network.
- For the AWS SageMaker notebook instance, sensitive data, such as algorithms and models, could be present. Disabling direct internet access prevents unauthorized data exfiltration, ensuring the confidentiality and integrity of the information.
- The policy also ensures compliance with best practices for data protection and IT security. It reduces the risks of non-compliance with standards and regulations such as GDPR, HIPAA, and others that may lead to severe penalties.
- Utilizing infrastructure as code (IaC) tool like Terraform for implementing this security policy not only provides consistency and scalability but also automates the enforcement of this rule across multiple notebook instances, enhancing the overall posture of cloud security.
Ensure that VPC Endpoint Service is configured for Manual Acceptance
Ensure that VPC Endpoint Service is configured for Manual Acceptance
- Manual acceptance configuration for VPC Endpoint Service is necessary as it ensures the administrator has direct control and oversight on the connections created. This prevents unauthorized connections from being automatically accepted, thus enhancing the security of the network infrastructure.
- Configuring manual acceptance can also minimize risk of data breaches as it reduces the possibility of inadvertent data exposure by limiting potentially insecure connections that could provide unauthorized access to the data.
- Implementing this policy optimizes usage because acceptance of connections is done on a need-to-connect basis, preventing unnecessary connections and hence saving resources that can be utilized more productively elsewhere.
- Such configuration is beneficial for auditing purposes as well. With manual acceptance, there is an improved visibility and traceability of which connections have been accepted, aiding in monitoring and diagnostic activities.
Ensure that CloudFormation stacks are sending event notifications to an SNS topic
Ensure that CloudFormation stacks are sending event notifications to an SNS topic
- Ensuring CloudFormation stacks send event notifications to an SNS topic allows organizations to promptly monitor and respond to changes in their AWS environment. It aids in maintaining good security practices and incident response management.
- This policy is critical for troubleshooting and auditing purposes. Should an error or issue occur within the CloudFormation stacks, having event notifications sent to an SNS topic can provide timely alerts and vital contextual information.
- It improves transparency and operational efficiency as the infrastructure-as-code (IaC) changes via CloudFormation can directly be tracked and audited, minimizing unauthorized changes and reducing potential security risks.
- Without integrating SNS notification with CloudFormation stacks, organizations could overlook critical events or changes, compromising the health and security of the infrastructure. Strong adherence to this policy helps maintain system integrity and resilience.
Ensure that detailed monitoring is enabled for EC2 instances
Ensure that detailed monitoring is enabled for EC2 instances
- This policy is crucial for facilitating enhanced visibility into the operational health and performance of AWS EC2 instances, as it ensures that monitoring is detailed and not just superficial or minimal.
- By enabling detailed monitoring for EC2 instances, this policy allows for quicker availability of data with a higher level of detail, helping investigation, detection, and resolution of issues more promptly, thus reducing the potential downtime of instances.
- Detailed monitoring comes with an additional cost, so depending on the environment’s criticality, it’s significant to evaluate whether extra insight justifies the expense. This policy ensures this balance is maintained by necessitating detailed monitoring for EC2 instances.
- Not adhering to this policy might result in weaker capacity planning and resource optimization capabilities. For instance, if there’s a potential hardware failure, not having detailed monitoring in place can delay the identification of these issues, and subsequently the ability to divert traffic or resources efficiently.
Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager
Ensure that Elastic Load Balancer(s) uses SSL certificates provided by AWS Certificate Manager
- Ensuring that Elastic Load Balancer uses SSL certificates provided by AWS Certificate Manager enhances data security by encrypting the data during transmission. This makes it difficult for potential attackers to intercept sensitive information.
- AWS Certificate Manager provides a centralized way to manage and deploy SSL certificates, thus this policy simplifies certificate administration tasks such as procurement, deployment, renewal, and deletion and thereby reduces human error and the subsequent risk of security breaches.
- Since AWS Certificate Manager automatically handles renewals, the policy would prevent any overlooked expirations of certificate that could lead to lapse in encryption and hence compromise data security.
- Implementing this policy with Infrastructure as Code (IaC) using Terraform facilitates automated compliance checks and policy enforcement - making it easier to maintain, replicate, and scale secure infrastructure setups.
Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled
Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled
- It allows for continuous monitoring of database activities, thereby helping to identify any unusual activity or security incident, making the system more reliable and secure.
- The policy helps with compliance as many regulations demand organizations maintain logs of all database activities for audits and forensic reviews.
- By enabling the Amazon RDS logs, it allows for in-depth data analysis and exploration to improve the database’s performance, solve complex application problems, and investigate database errors.
- The logs can act as an invaluable debug tool that can help trace any error or incident back to its source, which is critical in event of a technical issue or a security breach.
Ensure VPC subnets do not assign public IP by default
Ensure VPC subnets do not assign public IP by default
- Implementing this policy helps in reducing overall attack surface, as limiting the assignment of public IP addresses to VPC subnets by default reduces the number of potential targets that malicious actors can exploit.
- It ensures an additional layer of security by controlling and monitoring the entities in the network that communicate with public networks, thereby limiting potential unauthorized access and data breaches.
- Enforcing this policy results in network traffic to flow through designated points, creating an opportunity for centralized inspection, logging, auditing, and possible intrusion detection, which further strengthens the security posture.
- This policy could also lead to cost savings as unnecessary assignment of public IPs could lead to unwanted egress data transfer charges. It promotes a financially efficient use of resources while maintaining optimal security.
Ensure that ALB drops HTTP headers
Ensure that ALB drops HTTP headers
- The policy enhances security by preventing potential information leaks. HTTP headers may contain sensitive data such as user-agent details, server information or cookies. If these headers are not dropped, they can be exploited by malicious actors for activities like session hijacking or data theft.
- Implementing this policy minimizes the surface area for attacks. By dropping unnecessary HTTP headers, the possibility of Header-based attacks, such as HTTP Response Splitting or Header Injection, are greatly reduced.
- This policy promotes best practices for load balancing in AWS. Load balancers should focus on distributing network traffic efficiently but also securely. Dropping HTTP headers ensures that load balancers are adhering to sound safety measures while performing their key function.
- Non-compliance to this policy may lead to non-conformity with specific regulatory standards which mandate certain data protection measures. For instance, the GDPR and the CCPA require adequate data protection measures to be implemented, which include securing communication and transmission of data.
Ensure that RDS instances has backup policy
Ensure that RDS instances has backup policy
- Enabling a backup policy for AWS RDS instances is crucial to prevent data loss in case of any catastrophic system failures, human error, or accidental deletion of data. The policy ensures that regular automated backups of the database are created and stored.
- Having backup policy ensures High Availability (HA) and Disaster Recovery (DR) of RDS instances. This is especially important for mission-critical workloads that require continuous database operations and minimal data loss.
- The policy supports compliance requirements, as many regulations demand that data be backed up, replicated, and recoverable in a specific period of time. Failure to meet these conditions may lead to penalties and damaged reputation.
- It allows a more seamless recovery process in case of a database corruption or crash, minimizing downtime, and reducing the efforts taken for manual backup and recovery procedures, thus maintaining business continuity.
Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on
Ensure that Amazon ElastiCache Redis clusters have automatic backup turned on
- This policy helps in maintaining data integrity and ensures the resiliency of Amazon ElastiCache Redis clusters by enabling automatic backups. This combats the risk of data loss due to any unforeseen issues or system failures.
- Implementing this policy allows for efficient disaster recovery. In the event of a failure or issue, services can be quickly restored using the automatically created backups, thus minimizing downtime and any subsequent loss of revenue.
- The procedure of enabling automatic backup also assists in auditing and compliance. Many regulations require that data, including that in cache clusters, be recoverable in the event of loss. With automatic backups turned on, businesses can demonstrate compliance easily.
- Enforcing this policy aids in the mitigation of human error. Manual backup processes are prone to mistakes or oversights. Automation of backups removes this risk, improving data management reliability.
Ensure that EC2 is EBS optimized
Ensure that EC2 is EBS optimized
- Ensuring that EC2 is EBS optimized helps improve the performance of your applications on EC2 instances. It enhances overall system performance by providing dedicated throughput to Amazon EBS, and provisioned IOPS volumes.
- This policy is essential for efficiency as it guarantees consistent network performance for data transfer between EC2 and EBS. This is particularly beneficial for data-intensive applications that require high throughput.
- Not having EC2 instances EBS optimized can lead to bottlenecks affecting application’s performance due to shared resources. Implementing this policy mitigates this risk by establishing dedicated connections between EC2 and EBS.
- Complying with this policy reduces contention between EBS I/O and other network traffic, which is essential in maintaining a robust and reliable IT infrastructure. It further ensures that EBS traffic does not interfere with other types of transfers.
Ensure that ECR repositories are encrypted using KMS
Ensure that ECR repositories are encrypted using KMS
- The policy ensures data protection by encrypting the content in the ECR repositories. Amazon ECR uses AWS Key Management Service (AWS KMS) to encrypt and decrypt images at rest. This feature prevents unauthorized access to the sensitive data even if it’s compromised.
- Encrypting ECR repositories with KMS enhances compliance with stringent regulations related to data protection and privacy. It meets the requirements of various compliance programs such as GDPR, HIPAA, which require encryption of sensitive data.
- The policy decreases the risk of data breaches and potential reputational damage that comes with it. It improves the overall security posture of the system and promotes the use of best practices in managing sensitive data.
- By enforcing encryption standards, the policy guarantees the integrity and confidentiality of the data. Encrypted data is useless without the correct encryption key, thus even if unauthorized users gain access, they will not be able to decipher the data.
Ensure that Elasticsearch is configured inside a VPC
Ensure that Elasticsearch is configured inside a VPC
- Ensuring Elasticsearch is configured inside a Virtual Private Cloud (VPC) improves security by providing a private, isolated section of the AWS Cloud where resources are launched in a defined virtual network. This limits exposure to potential malicious activities by minimizing the attack surface.
- Placement of Elasticsearch within a VPC ensures that network traffic between your users and the search instances remain within the Amazon network, thereby reducing the possibility of data leakage or exposure during transmission.
- Utilizing VPCs also enables enforcement of security policies through control over inbound and outbound network traffic. It provides administrators the power to define fine-grained access controls on their Elasticsearch service.
- A violation of this policy could lead to unauthorized access to your Elasticsearch data, resulting in potential data theft, corruption, or deletion. It could also lead to excessive data charges due to transfer of data to and from the service across VPC boundaries.
Ensure that ELB is cross-zone-load-balancing enabled
Ensure that ELB is cross-zone-load-balancing enabled
- Enabling Cross-Zone Load Balancing on Elastic Load Balancers (ELB) ensures equal distribution of traffic across all registered instances in all enabled Availability Zones, improving the efficiency and reliability of your application.
- When ELB is not cross-zone-load-balancing enabled, all the traffic will be sent to only one Availability Zone leading to resource exhaustion in that zone hence causing application downtime.
- This policy helps to maintain high availability and fault tolerance of the applications even if one of the Availability Zones goes down, by efficiently routing traffic to instances in the remaining running zones.
- With the Infrastructure as Code tool, Terraform, the policy ensures that ELB configurations are consistent and repeatable across multiple environments providing a standard and secure infrastructure setup.
Ensure that RDS clusters have deletion protection enabled
Ensure that RDS clusters have deletion protection enabled
- Enabling deletion protection on RDS clusters prevents accidental deletion of critical data, ensuring the continuity of business operations and reducing potential downtime due to data loss.
- This policy ensures that organizational standards for data protection and disaster recovery are adhered to, which can be particularly important for compliance with regulations like GDPR and HIPAA.
- By using Infrastructure as Code (IaC) with Terraform to enforce this policy, organizations can automate and standardize protection settings across all RDS clusters, reducing the likelihood of human error.
- Disabling deletion protection can expose the system to potential risks such as data tampering and cyber attacks; therefore, adhering to the policy aids in maintaining the integrity and security of the system.
Ensure that RDS global clusters are encrypted
Ensure that RDS global clusters are encrypted
- This policy is important to protect sensitive data stored in the RDS global clusters and to prevent unauthorized access. Encryption aids in maintaining data confidentiality and integrity by converting the original data into an unrecognizable format until it is decrypted.
- By encrypting RDS global clusters, the policy ensures compliance with the data privacy regulations like GDPR, HIPAA, which mandate the use of encryption for sensitive data. Failure to comply can lead to heavy fines and legal penalties.
- Complying with this policy provides an additional layer of defense in the event of a security breach. Even if an attacker gains access to the database, the encrypted data remains unusable unless the attacker also has the corresponding decryption key.
- The policy potentially improves customer trust and the organization’s reputation, as it demonstrates a commitment to maintaining robust security practices. A business operating with encrypted RDS global clusters is less likely to suffer devastating breaches of sensitive data.
Ensured that Redshift cluster allowing version upgrade by default
Ensured that Redshift cluster allowing version upgrade by default
- This policy ensures that Redshift clusters are always running on the latest and most secure version, reducing the risk of vulnerabilities and breaches in outdated versions.
- Regular version upgrades facilitated by this policy provide users with the latest features, bug fixes, and performance improvements, enhancing the overall utility and efficiency of Redshift clusters.
- Disruptions in service are minimized as Redshift clusters handle version upgrades automatically and seamlessly without significant downtime, ensuring uninterrupted data services.
- The policy aids in compliance with various information security governance frameworks that require systems to be running on the latest software versions, reducing the risk of non-compliance penalties or sanctions.
Ensure that Redshift cluster is encrypted by KMS
Ensure that Redshift cluster is encrypted by KMS
- This policy prevents unauthorized access to data stored in the Redshift cluster by requiring encryption. This supports compliance with data protection regulations and reduces the risk of data breaches.
- It ensures data integrity as any unauthorized modification of data will corrupt the encryption, making it easy to detect any form of data tampering.
- Using AWS Key Management Service (KMS) for encryption provides centralized control over the cryptographic keys used to protect data, allowing for enhanced management and auditability.
- It helps prevent data loss in case of incidents like hardware failures or accidental deletions, as the data would remain encrypted and inaccessible without the proper decryption keys.
Ensure that S3 bucket has lock configuration enabled by default
Ensure that S3 bucket has lock configuration enabled by default
- Enabling lock configuration on the S3 bucket increases data protection by preventing accidental or intentional deletions or overwriting of objects stored in the bucket.
- The lock configuration feature allows administrators to access versioning, making it possible to recover previous versions of an object, heightening the data resiliency strategy and minimizing potential data loss.
- This security measure is important for ensuring compliance with data retention policies and regulations, such as the General Data Protection Regulation (GDPR), as it provides an extra layer of data protection and integrity.
- If object locking is not enabled, the critical data in the S3 bucket could potentially be compromised, leading to significant business disruptions or regulatory non-compliance penalties.
Ensure that S3 bucket has cross-region replication enabled
Ensure that S3 bucket has cross-region replication enabled
- This policy ensures data redundancy and high availability. If the primary data location fails or is compromised, the replicated data in another region serves as a backup, minimizing potential data loss and downtime.
- It is essential for compliance with regulations concerning disaster recovery planning, which require businesses to have a plan for resuming operations after disruptive events. Enabling cross-region replication for S3 buckets helps fulfill these compliance requirements.
- The policy promotes geographical expansion and flexibility. With replication across regions, you can serve or process data closer to where it is needed, improving data transfer speeds and reducing latency.
- It protects from region-specific issues. If one AWS region encounters problems or suffers a major outage, the data replicated to other regions continues to be available, thereby mitigating regional risks.
Ensure that S3 buckets are encrypted with KMS by default
Ensure that S3 buckets are encrypted with KMS by default
- This policy promotes the security of sensitive data by ensuring that all data stored in AWS S3 buckets are encrypted using AWS Key Management Service (KMS). This safeguards stored information from unauthorized access or potential data breaches.
- The implementation of this policy significantly reduces the risk of data theft or exposure. If the S3 bucket was to be compromised, the encrypted data would be useless without the correct KMS keys, providing an additional layer of security on top of regular access controls.
- An unencrypted S3 bucket is susceptible to data leakage, which can result in severe financial penalties, irreparable damage to the organization’s reputation, and non-compliance with data protection regulations.
- Complying with this policy encourages adherence to best practices in cloud security and helps organizations meet regulatory compliance requirements like GDPR, HIPAA, or CCPA, where data encryption is often mandatory.
Ensure that RDS database cluster snapshot is encrypted
Ensure that RDS database cluster snapshot is encrypted
- This policy ensures that backups of the RDS database cluster, encapsulated in snapshots, are encrypted, protecting sensitive data from unauthorized access or potential cyber threats.
- By encrypting RDS database cluster snapshots, even if the backups are somehow leaked or stolen, the data within remains concealed and inaccessible without the correct encryption key, preserving the integrity and confidentiality of the content.
- Compliance with this policy makes your infrastructure follow best practices for security in cloud environments, which can appeal to various regulatory standards such as GDPR, HIPAA, or PCI-DSS, enhancing the organization’s reputation and trustworthiness.
- Using Infrastructure as Code (IaC) tool like Terraform to ensure encryption of RDS cluster snapshots provides consistency and scalability as security policies can be applied across multiple instances and automated, reducing the margin for human error.
Ensure that CodeBuild projects are encrypted using CMK
Ensure that CodeBuild projects are encrypted using CMK
- Encryption of CodeBuild projects using a Customer Master Key (CMK) helps prevent unauthorized access to project information. It makes the stored data unreadable by anyone without the keys, making it more secure.
- It mitigates the risk of sensitive data breach by hackers or malicious users. If there’s a case of unauthorized access, they will not be able to read the project data without the decryption key.
- Enforcement of this policy ensures compliance with data protection regulations as CMK provides a stronger level of encryption than the AWS managed keys, hence giving a better level of protection to data sensitivity and privacy.
- The impact of not abiding by this policy could lead to the potential loss of intellectual property, client trust and possible legal implications as improper encryption or data handling may violate certain data protection laws.
Ensure no default VPC is planned to be provisioned
Ensure no default VPC is planned to be provisioned
- The policy helps ensure that a secure and customized networking environment is maintained, as default VPCs may have settings that do not align with the specific security requirements of the organization.
- It promotes the principle of least privilege by avoiding unnecessary exposure of resources to the internet, as default VPCs come with a main route table that directs all traffic to an internet gateway.
- The policy encourages proper VPC planning and design by provisioning only what is needed, thereby minimizing the attack surface and reducing the risk of misconfigurations in resources.
- This policy helps in reducing potential costs as unnecessary VPCs could lead to the overutilization of resources, resulting in unforeseen expenses.
Ensure that Secrets Manager secret is encrypted using KMS CMK
Ensure that Secrets Manager secret is encrypted using KMS CMK
- Ensuring Secrets Manager secret is encrypted using KMS CMK protects sensitive data. It adds an extra layer of security by encrypting the secret, making it unreadable to unauthorized users.
- This policy aids in regulatory compliance as certain regulations and standards require encryption of sensitive data at rest. Without adhering to this policy, organizations could face fines or penalties.
- Utilizing AWS Key Management Service gives organizations full control over their encryption keys, enabling them to manage who can access and decrypt their Secrets Manager secrets.
- The policy reduces the risk fallout from potential data breaches. Even if an attacker gains access to the system or data backup, they would not be able to derive meaningful data without the encryption keys.
Ensure that Load Balancer has deletion protection enabled
Ensure that Load Balancer has deletion protection enabled
- Enabling deletion protection on Load Balancer prevents accidental removal of the resource which thereby eliminates unexpected disruptions and potential outages in application services that could impact business continuity.
- This policy helps in maintaining high availability of your applications by ensuring that the Load Balancer which distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, isn’t deleted unintentionally.
- The implementation of this policy via Infrastructure as Code tool Terraform ensures consistent configuration across all AWS Application Load Balancers (aws_alb) and Load Balancers (aws_lb) in the organisation, reducing the chance of manual errors or overlooked configurations.
- For entities like aws_alb and aws_lb which play a pivotal role in the overall system performance and health, a violation of this policy could lead to serious availability issues, making timely detection and rectification of non-compliance crucial.
Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled
Ensure that Load Balancer (Network/Gateway) has cross-zone load balancing enabled
- The policy ensures improved application availability by ensuring requests are served by backend instances, even if they are not in the same availability zone as the load balancer. This increases reliability and prevents service disruptions due to single zone outages.
- Enabling cross-zone load balancing optimizes resource utilization by automatically distributing incoming traffic across all registered instances in all enabled availability zones, increasing the efficiency of your network infrastructure.
- Implementing this policy mitigates the risk of overloading one zone and underutilizing others, helping to prevent performance inconsistencies that could lead to poor customer experience or timeouts.
- In a scenario where new instances are added or unhealthy instances are removed, this policy ensures that the load balancer continually reevaluates the availability of registered instances across zones and redistributes traffic for seamless operation, paving the way for efficient scaling.
Autoscaling groups should supply tags to launch configurations
Autoscaling groups should supply tags to launch configurations
Ensure Redshift is not deployed outside of a VPC
Ensure Redshift is not deployed outside of a VPC
- This policy ensures that Amazon Redshift, a fully managed data warehouse service, is not deployed outside of a Virtual Private Cloud (VPC). A VPC enables you to control your network settings for your Amazon Web Services (AWS) resources, providing an extra layer of data privacy and security.
- Deploying Redshift outside a VPC could expose it to unsecured networks and increase the likelihood of unauthorized access and potential data breaches. This could lead to compromised customer data and significant financial and reputational losses for the company.
- Ensuring Redshift is always deployed in a VPC helps meet compliance requirements, especially in sectors where regulations mandate the use and enforcement of robust data protection controls.
- The resource implementation link above provides a script which checks for compliance with the policy, ensuring that all Redshift deployments are within a controlled and secure environment. This aids in automating security checks and maintaining consistently high security standards across different parts of the infrastructure.
Ensure that Workspace user volumes are encrypted
Ensure that Workspace user volumes are encrypted
- Encrypting user volumes prevents unauthorized access to data stored on these volumes. This is particularly important for sensitive data such as personally identifiable information (PII) or financial data.
- If user volumes are not encrypted, they could be targeted during a cyber attack, potentially leading to data breaches.
- An encrypted user volume helps improve regulatory compliance, since many regulatory standards require sensitive data to be encrypted both at rest and in transit.
- Utilizing this policy within the Cloudformation IaC model allows an automated, rinse-and-repeat process for encryption, reducing manual errors and the overhead associated with encrypting each user volume individually.
Ensure that Workspace root volumes are encrypted
Ensure that Workspace root volumes are encrypted
- Encrypting Workspace root volumes is crucial to protect sensitive data stored on those volumes. If the volumes are unencrypted, anyone with access can read and manipulate the data, leading to security risks like data breaches and non-compliance issues.
- Encrypted root volumes increase the security of data at rest by converting it into encrypted form. This is significant in scenarios where physical security controls fail, and an unsanctioned user manages to gain physical access to a disk.
- This policy ensures compliance with regulatory standards like HIPAA, GDPR or PCI-DSS which mandate that stored data must be encrypted, thus preventing potential fines for non-compliance.
- Utilising AWS::WorkSpaces::Workspace and aws_workspaces_workspace in CloudFormation templates with this policy enforces uniformity in security controls across resources, reducing configuration oversight and streamlining compliance auditing processes.
Ensure that RDS instances have Multi-AZ enabled
Ensure that RDS instances have Multi-AZ enabled
- Enabling Multi-AZ in RDS instances ensures high availability and failover support for DB instances, making this policy crucial for maintaining uninterrupted services, even if one datacenter experiences an issue.
- This policy helps in automatic data replication in a standby instance in a different Availability Zone (AZ), enabling swift disaster recovery and minimizing the risk of data loss in event of a single AZ outage.
- Compliance with this policy can improve the overall performance of your database by permitting read traffic from your applications to be served from multiple replicated databases in different AZs.
- The policy, if not applied, could lead to massive business disruptions and potential revenue loss in situations of unplanned downtime or data loss due to natural disasters, system failures, or other unforeseen issues.
Ensure that CloudWatch Log Group is encrypted by KMS
Ensure that CloudWatch Log Group is encrypted by KMS
- This policy is important as it ensures encryption of AWS CloudWatch Log Groups with a Key Management Service (KMS), enhancing the security of log data by preventing unauthorized access.
- Compliance with this policy mitigates the risk of sensitive information being exposed in logs. If logs are not encrypted, they could potentially be accessed or intercepted by malicious parties.
- Encryption with AWS KMS provides an additional layer of security by allowing users to create and manage encryption keys and control their use across a wide range of AWS services and applications, providing a secure and compliant solution for managing log data.
- Non-compliance with this policy could lead to regulatory violations for organizations that operate under data protection standards, such as GDPR, HIPAA, or PCI-DSS, which require encryption of sensitive data at rest.
Ensure that Athena Workgroup is encrypted
Ensure that Athena Workgroup is encrypted
- Encrypting Athena Workgroups is crucial to protect sensitive data and ensure that only authorized personnel have access to it. Without encryption, data could potentially be accessed or manipulated by unauthorized users or malicious attackers, leading to data breaches and non-compliance with data protection regulations.
- The policy helps maintain regulatory compliance. Many industries and governments require that data be encrypted at rest and in transit to meet privacy and security regulations. Non-compliance can lead to heavy fines, legal complications, and reputational damage.
- By enforcing this policy, the infrastructure codified through Terraform would automatically ensure security best practices are meticulously followed. This eliminates human error, inconsistent configurations and automate security by embedding it in the IaC lifecycle, saving time and reducing potential vulnerabilities.
- The implementation through the resource link specifically addresses Athena Workgroup configuration within AWS infrastructure. Having these features encrypted further levels up the security posture of AWS services and could prevent potential attack vectors exploiting unencrypted data storage in Athena Workgroups.
Ensure that Timestream database is encrypted with KMS CMK
Ensure that Timestream database is encrypted with KMS CMK
- Encrypting Timestream database with KMS CMK enhances data security as it provides a strong encryption layer that can protect the data from unauthorized access or breaches, ensuring the integrity and confidentiality of the data.
- Implementing this policy provides control over the cryptographic keys to manage the data which adds an extra layer of access control to the sensitive Timestream database.
- Timestream being a time series database; most often it is used to store valuable data such as application metrics, IoT sensor data, etc. Thus, encryption with KMS CMK becomes extremely significant in preventing potential data leaks or exploitation of critical information.
- Compliance with various regulatory standards like GDPR, HIPAA, etc. that require data to be encrypted at rest can be achieved with this policy, preventing non-compliance penalties or potential legal repercussions.
Ensure RDS database has IAM authentication enabled
Ensure RDS database has IAM authentication enabled
- IAM authentication for RDS databases aids in centralization of user access control, eliminating the need to manage credentials on a per-database basis, thus enhancing security and reducing operational burden.
- By ensuring IAM authentication on RDS databases, AWS identities can securely access databases without the need to store user credentials in applications, which decreases the risk of credentials being exposed or compromised.
- Incorporating RDS IAM authentication as part of the infrastructure security policy makes it possible to leverage features like automated key rotation and policy-based permission management, which further bolster the database’s security posture.
- By enforcing this policy, you can track and monitor database access through AWS CloudTrail. This can provide valuable auditing and analytics data for regulatory compliance requirements and to detect any abnormal behavior or potential security breaches.
Ensure RDS cluster has IAM authentication enabled
Ensure RDS cluster has IAM authentication enabled
- Enabling IAM authentication for RDS clusters enhances security by allowing you to manage database access permissions centrally, which helps prevent unauthorized database access, thereby reducing the potential attack surface.
- This policy aids in segregating duties and enforcing least privileges approach as each application or user can have unique credentials, thereby limiting any potential damage in case of credential compromise.
- Non-compliance with this policy can lead to potential exposure of sensitive data stored in the RDS cluster, as lack of authentication control can enable unauthorized viewing, alteration, or deletion of data.
- Compliance with this policy also aids in effective audit and compliance reporting as IAM provides detailed logs of who accessed what resources, when, and what actions were performed, which is crucial in pinpointing suspicious activity and in post-incident analysis.
Ensure ECR image scanning on push is enabled
Ensure ECR image scanning on push is enabled
- Enabling ECR image scanning on push helps identify software vulnerabilities. Amazon ECR uses the Common Vulnerabilities and Exposures (CVEs) database from the open-source Clair project and provides a detailed list of scan findings.
- This policy serves as an active protection, ensuring that new vulnerabilities are not introduced into the repository. When enabled, each image push triggers a vulnerability scan, preventing insecure Docker images from being deployed.
- AWS ECR provides detailed findings for the scanned images, including the name and description of the CVE, its severity and links to more information. This makes the repository more secure by making pertinent information readily available.
- It assists in continuous auditing and compliance monitoring by automating checks for security vulnerabilities and thus, reducing the chance for human error. This facilitates effective risk management and enhances security posture.
Ensure Transfer Server is not exposed publicly.
Ensure Transfer Server is not exposed publicly.
- Ensuring the Transfer Server is not exposed publicly prevents unauthorized access to sensitive data, as public servers are more vulnerable to malicious attacks.
- This policy improves the overall infrastructure security by confining data transfer within a private network, thereby mitigating data leakage risks linked to public exposure.
- Successful implementation of the policy via Cloudformation aids in regulatory compliance regarding data protection and security, as many regulations stipulate that transfer of sensitive data should not be publicly exposed.
- The policy helps in limiting the attack surface by reducing the number of entry points accessible to external threats, effectively strengthening the security posture of AWS::Transfer::Server, aws_transfer_server resources.
Ensure DynamoDB global table point in time recovery (backup) is enabled
Ensure DynamoDB global table point in time recovery (backup) is enabled
- Enabling DynamoDB global table point in time recovery ensures the continuous backup of all data in the global table. It allows customers to restore table data from a specified point in time within the last 35 days, providing better data loss recoverability when there are accidental writes or deletes.
- Enforcing this policy reduces the operational burden of creating backups manually which can be prone to errors or omissions. It assures that the backup process runs automatically and consistently, thanks to the Infrastructure as Code (IaC) tool, CloudFormation.
- Turning on the point in time recovery option prevents data loss due to unplanned events like instrument failures, data breaches, or system crashes, hence ensuring the availability and integrity of data stored in the global table.
- This policy also supports regulatory compliance requirements that mandate regular backup of essential data, helps in meeting disaster recovery objectives, and instills confidence in customers about the safety of their data.
Ensure Backup Vault is encrypted at rest using KMS CMK
Ensure Backup Vault is encrypted at rest using KMS CMK
- This policy is crucial for data protection as it ensures that all data at rest in the Backup Vault is encrypted using KMS CMK. This reduces the risk of unauthorized access in case the physical storage is compromised.
- Encrypting data at rest using KMS CMK significantly enhances security by combining the robust key management capabilities of AWS KMS with the encryption protection offered by Backup Vault.
- This policy majorly impacts regulatory compliance, as many data protection regulations mandate encryption of sensitive data at rest. Ensuring Backup Vault is encrypted may help meet requirements of regulations like GDPR or HIPAA.
- Encryption at rest using KMS CMK can also safeguard against data loss, as it can protect backups from accidental deletion or modification, ensuring the durability and reliability of your AWS Backup service.
Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it
Ensure Glacier Vault access policy is not public by only allowing specific services or principals to access it
- Ensuring Glacier Vault access policy is not public mitigates the risk of unauthorized access to sensitive data stored in the vault, which could lead to potential data breaches and regulatory non-compliance.
- A public policy might permit malicious users to modify the data, delete important files in the vault, or execute denial of service attacks to disrupt normal business operations.
- Having a non-public policy would only allow specific services or principals access to the vault, thus enforcing access control and minimizing exposure to insider threats; this setup helps enhance internal security and integrity of the system.
- The enforcement of this policy aligns with the principle of least privilege and need-to-know basis, two standard cybersecurity practices, by limiting the access to only those services or individuals who specifically require it.
Ensure SQS queue policy is not public by only allowing specific services or principals to access it
Ensure SQS queue policy is not public by only allowing specific services or principals to access it
- This policy is crucial as it helps in enhancing data security by ensuring that only specified services or individuals have the rights to access the Simple Queue Service (SQS) queue, preventing unauthorized access and potential data breaches.
- By restricting access, this policy can prevent potential misuse or manipulation of data held within the SQS queue, which can have severe detrimental impacts on the overall functioning and reliability of the system.
- Implementing this policy can provide better control and visibility over who accesses the data in the SQS queue, assisting in accountability and auditing, and subsequently making the incident response and forensic investigation easier in case of any security violations.
- As this policy is implemented using Infrastructure as Code (IaC) tool Terraform, it ensures that the configuration is easily reproducible, versioned, and can be quickly rolled back if needed, providing flexibility and ease of change management in infrastructure security.
Ensure SNS topic policy is not public by only allowing specific services or principals to access it
Ensure SNS topic policy is not public by only allowing specific services or principals to access it
- This policy ensures that only specific, authorized services or principals have access to the SNS topic, thereby minimizing the likelihood of unauthorized access and information breach, maintaining data confidentiality.
- By enforcing granular access control, the policy helps to prevent misuse of the SNS topic for the distribution of offensive, harmful, or misleading content by unknown or unauthorized entities, ensuring the credibility and integrity of the messages.
- The policy prevents potential Denial of Service (DoS) attacks where mass requests from public could overwhelm the SNS topic, ensuring service availability for genuine users.
- Utilizing this policy augments regulatory compliance by promoting best-practice security controls, potentially aiding in GDPR, HIPAA, PCI-DSS alignment, and being audit-ready.
Ensure QLDB ledger permissions mode is set to STANDARD
Ensure QLDB ledger permissions mode is set to STANDARD
- The policy ensures that the Quantum Ledger Database (QLDB) ledger is in STANDARD permissions mode, which strictly limits the actions that a ledger owner can perform, mitigating potential damage from unintentional or malicious actions.
- The adherence to this policy prevents the ledger owner from deleting the ledger, thereby safeguarding all the transaction data in the ledger from being lost or tampered with.
- It discourages the potential security risk that having unrestricted permissions mode poses, where a user could potentially execute any operation, including those that can be harmful or disruptive to the QLDB ledger.
- This policy when put in place also helps in maintaining the integrity of the audit trail by restricting changes to the ledger’s structure or data history. It prevents data loss or corruption by removing the potential to delete historical data.
Ensure EMR Cluster security configuration encryption is using SSE-KMS
Ensure EMR Cluster security configuration encryption is using SSE-KMS
- Ensuring EMR Cluster security configuration encryption uses SSE-KMS boosts the security of the data in your EMR clusters by encrypting it using keys managed by AWS Key Management Service. This reduces the risk of unauthorized access to your sensitive data.
- If the EMR Cluster security is not encrypted with SSE-KMS, it would be relatively easier for hackers to decrypt the data, leading to potential security breaches, information theft, and violation of data privacy laws.
- By adopting this policy, the compliance with industry standards and regulations such as GDPR, PCI DSS, and HIPAA is significantly improved as they require data encryption at rest. Not following the policy might lead to hefty fines and penalties.
- The use of Infrastructure as Code (IaC) tool such as Terraform in applying the policy across all EMR Clusters ensures uniformity, reduces the possibility of human error, and speeds up the process of setting up security for big data infrastructure.
Ensure QLDB ledger has deletion protection enabled
Ensure QLDB ledger has deletion protection enabled
- Enabling deletion protection on QLDB ledgers prevents accidental modification or deletion of the ledger, preserving the integrity and availability of the data stored within.
- If deletion protection is not enabled, critical ledgers can be altered or deleted, even if by mistake, resulting in loss of important data and potential financial or operational impacts.
- Deletion protection is a vital part of a robust infrastructure security policy for AWS, reinforcing access controls by preventing unintended actions that could compromise stored data.
- This policy adheres to the principle of least privilege, by further restricting the actions that can be made against a ledger, ensuring only absolutely necessary modifications are authorized.
Check encryption settings for Lambda environment variable
Check encryption settings for Lambda environment variable
- This policy verifies that AWS Lambda function environment variables are encrypted, preventing unauthorized access to sensitive data which could lead to data breaches or compromised systems.
- By default, environment variables are not encrypted. Ensuring encryption enhances the baseline level of data security environment variables.
- Implementing this security policy enhances regulatory compliance, as many industry standards and regulations require the encryption of sensitive data at rest.
- Checking encryption settings through Infrastructure as Code (IaC) using tools like Cloudformation enables automated, repeatable, and consistent application of this policy across multiple resources and services - improving operational efficiency.
Verify CloudFront Distribution Viewer Certificate is using TLS v1.2
Verify CloudFront Distribution Viewer Certificate is using TLS v1.2
- This security policy is crucial to ensure that the transmitted data between the client and CloudFront is secured and encrypted. Utilizing TLS v1.2 significantly reduces the risk of data breaches and unauthorized access since it offers a higher security level compared to its previous versions.
- Implementing this policy contributes towards maintaining compliance standards like PCI-DSS, HIPAA, etc., which require use of strong encryption protocols like TLS v1.2, fostering the trust of clients and customers in your cloud processes.
- Failing to implement this policy effectively exposes the organization to outdated or less secure line encryption protocols, leading to potential vulnerabilities. This could significantly impact the platform’s security and the organization’s overall cyber risk level.
- Ensuring CloudFront Distribution Viewer Certificate uses TLS v1.2 optimizes the security of your AWS cloud infrastructure. It helps in preventing potent threats such as man-in-the-middle attacks, eavesdropping, and data tampering, thus enhancing the overall reliability and security posture of the systems built on top of this infrastructure.
Ensure WAF has associated rules
Ensure WAF has associated rules
- Ensuring WAF (Web Application Firewall) has associated rules is fundamental for filtering and monitoring HTTP traffic to and from a web application, which contributes greatly to mitigating threats such as application-layer attacks, SQL injection and cross-site scripting.
- Without associated rules, a WAF will not be able to distinguish between malicious and safe traffic, and therefore cannot perform its primary responsibilities of protection and security, leaving the application exposed to potential attacks.
- As this policy is implemented using Terraform, it ensures Infrastructure as Code (IaC) best practices, enabling efficient and automated management of the WAF rules across the cloud environment, leading to more robust and consistent application security.
- The policy specifically applies to aws_waf_web_acl, aws_wafregional_web_acl, and aws_wafv2_web_acl entities, indicating that it is critical for securing web-based resources and services hosted on AWS, improving overall security posture on the cloud platform.
Ensure Logging is enabled for WAF Web Access Control Lists
Ensure Logging is enabled for WAF Web Access Control Lists
- Enabling logging for WAF Web Access Control Lists allows for comprehensive monitoring and analysis of traffic routed through the WAF, thus providing visibility into potential security threats and aiding in rapid detection and response.
- This policy ensures compliance with security best practices and regulatory standards which often demand detailed logging of accesses and activities for audit purposes, aiding organizations in avoiding penalties and preserving trust with customers and partners.
- Detailed logs from WAF Web Access Control Lists can feed into security information and event management (SIEM) systems to enable automated response to threats, thereby strengthening the security posture of AWS resources and enhancing the resilience of applications.
- When logging is enabled for WAF Web Access Control Lists, it can help identify patterns, trends and anomalies within the traffic data over time, which can be invaluable for troubleshooting and optimizing web applications’ performance, leading to an improved user experience.
Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK)
Ensure Kinesis Video Stream is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures that Kinesis Video Stream data is robustly encrypted for higher security, quantifying potential risks of data breaches or cyber attacks that target and exploit improperly guarded information.
- Leveraging a customer managed Key (CMK) provides further control and flexibility, allowing users to define how the encryption keys are generated, used and rotated, enhancing the overall ownership and management on data security.
- The policy helps in compliance with regulatory standards and legal obligations pertaining to data privacy and protection, like GDPR and HIPAA, that necessitate stringent data safeguarding measures.
- Implementing this policy through Infrastructure as Code (IaC) with tools like Terraform makes it easier and more efficient to apply across wide-ranging AWS services, enabling faster deployment, easier auditing, and consistent application of security measures.
Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK)
Ensure fx ontap file system is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures that the fx ontap file system is encrypted, which provides an additional layer of data protection. It thus helps prevent unauthorized access to sensitive data stored in the file system, thereby reducing the risk of data breaches or leaks.
- The policy mandates the use of a customer managed Key (CMK) managed by the Key Management Service (KMS), giving the user more control over the cryptographic keys. This could provide stronger security, reduce risk of unintentional key exposure, and facilitate better key management and lifecycle control.
- Using Terraform as an infrastructure-as-code tool, this policy not only automates the enforcement of data encryption, ensuring consistent application over all instances, but also allows for version controlling. This would mean easier auditing, improved traceability, and simpler rollback in case of issues.
- The policy specifically targets ‘aws_fsx_ontap_file_system’ resource type. Thus, besides ensuring secure storage of data, it also helps in fulfilling specific compliance requirements related to encryption for AWS FSx for NetApp ONTAP file systems, should such be stipulated in regulations or business contracts.
Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK)
Ensure FSX Windows filesystem is encrypted by KMS using a customer managed Key (CMK)
- Encrypting FSX Windows filesystem using a customer-managed Key (CMK) ensures that organization has more control over data security as it can manage its own keys, including its rotation, deletion, and generation.
- This policy enhances the level of data protection and compliance with regulatory standards, as the encryption of data at rest through KMS using a CMK decreases the likelihood that unauthorized parties can access sensitive information.
- Infrastructure as Code (IaC) using Terraform allows the policy to be programmatically enforced and audited, significantly enhancing the speed, consistency and traceability of security operations.
- Encrypted FSX filesystems protect the integrity and confidentiality of data, ensuring that it is safe even if the physical storage is compromised, reducing the overall risk of data breaches.
Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK)
Ensure Image Builder component is encrypted by KMS using a customer managed Key (CMK)
- Encrypting Image Builder components using a customer managed Key (CMK) provides an additional layer of data protection by ensuring only authorized users can access and manipulate the images. This helps prevent unintended exposure of potentially sensitive information found within the components.
- Without encryption, Image Builder components are at risk of being accessed by malicious parties, potentially resulting in major data breaches. Applying a CMK encryption helps mitigate this risk, enhancing the overall security posturing of the AWS infrastructure.
- The application of a CMK gives customers complete control over the access and management of their encryption keys, which includes deciding who has access, as well as the ability to retire or rotate keys when they choose to.
- This policy is important to ensure compliance with data privacy standards and regulations. By enforcing encryption for Image Builder components, enterprises will be more likely to meet regulatory requirements for data security, such as GDPR or HIPAA, thereby avoiding potential financial penalties and damage to reputation.
Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK)
Ensure S3 Object Copy is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures that data transferred between S3 objects is encrypted and unreadable to any unauthorized entity, thereby significantly strengthening data privacy and protection during S3 object copy operations.
- By mandating a customer-managed Key Management Service (KMS) key for encryption, the policy provides organizations full control over key generation, rotation, and deletion lifecycle, enabling them to manage their cryptographic keys according to their specific security requirements.
- The policy helps organizations to comply with various regulatory requirements and standards as many regulations mandate that stored data, especially sensitive ones, should always be encrypted for the purpose of data protection.
- It aids in the prevention of data leaks or unauthorized data access in case of a security incident such as misconfigured S3 buckets or compromised AWS user credentials by ensuring that data remains encrypted even when copied.
Ensure DocumentDB is encrypted by KMS using a customer managed Key (CMK)
Ensure DocumentDB is encrypted by KMS using a customer managed Key (CMK)
- This policy helps safeguard sensitive data stored in DocumentDB by using KMS encryption, which enhances data security by converting readable data into unreadable text. Without this, sensitive intelligence would be vulnerable to unauthorized accesses or breaches.
- Utilizing customer managed keys (CMK) allows for greater control over the cryptographic key lifecycle, such as establishing key rotation policies or key usage permissions. This policy hence grants organizations an additional layer of access control.
- Implementing this policy reduces the risk of non-compliance with various data protection laws, regulations, and standards, which often mandate robust encryption of sensitive or personal data. Non-compliance could lead to heavy fines, penalties, and reputational damage.
- Ensuring DocumentDB encryption with CMK via Infrastructure as Code tool like Terraform allows policy enforcement and auditing to be automated. This can significantly minimize human error during implementation and enhance the efficiency and reliability of security measures in place.
Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK)
Ensure EBS Snapshot Copy is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures the security of your AWS Elastic Block Store (EBS) snapshots by enforcing encryption with a Customer Managed Key (CMK). This reduces the risk of unauthorized access to your data stored in these snapshots.
- Not encrypting your EBS snapshots with a CMK leaves them vulnerable to data breaches, which can result to heavy financial losses and damage to your business’ reputation. The policy mitigates this risk by mandating encryption.
- The use of a CMK provides you with full control over the key management and lifecycle including creation, rotation, and deletion. This can help your business meet your organization-specific, compliance, and regulatory requirements related to data protection.
- Using Terraform as Infrastructure as Code (IaC) allows you to automate the compliance with this security policy. This can increase efficiency, consistency and allow for ease in scaling without requiring individual manual configuration for each EBS snapshot.
Ensure resource is encrypted by KMS using a customer managed Key (CMK)
Ensure resource is encrypted by KMS using a customer managed Key (CMK)
- Implementing this rule ensures that valuable or sensitive data stored in the ‘aws_fsx_openzfs_file_system’ resource is always encrypted using Key Management Service (KMS) with a customer managed key. This prevents unauthorized users from accessing the information.
- This policy promotes data compliances, as encryption standards are a requirement set by regulations such as GDPR and HIPAA that mandate data to be encrypted both at rest and in transit. Violations of these regulations could lead to hefty penalties.
- Using a customer managed key (CMK) for encryption provides the user with more granular control over the cryptographic keys, which includes key rotation, managing permissions, and auditing how keys are used.
- The policy ensures a greater security measure against data breaches. Since the customer-managed key is used, even if the main AWS service is compromised, the encrypted data stored in the ‘aws_fsx_openzfs_file_system’ would remain secure, reducing the potential impact of hacker’s attacks.
Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK)
Ensure Kinesis Stream is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures that data flowing through the Kinesis Stream is securely encrypted using a Customer Managed Key (CMK), protecting sensitive information from unauthorized access.
- The CMK encryption method enhances the security level as it gives the user more control over the encryption keys unlike the default AWS managed keys, thus preventing potential access by unwanted or unauthorized entities.
- Implementing this policy through Infrastructure as Code (IaC) using Terraform eliminates manual errors, streamlines security deployment across multiple Kinesis streams, and ensures consistency in enforcing security practices.
- Non-compliance with this policy can lead to potential data breaches, compliance issues, and significant reputational and financial loss if sensitive data is exposed.
Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK)
Ensure S3 bucket Object is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures an extra layer of security on data stored in S3 buckets since it requires encryption using Key Management Service (KMS) with a Customer Master Key (CMK). This encryption makes it very hard for unauthorized persons to read the data.
- Enforcing this policy would help an organization meet compliance standards related to data protection, such as GDPR or HIPAA, that often mandate strong encryption methods like KMS for stored data.
- Since this policy specifies the use of a Customer Managed Key (CMK), it gives the user better control over their encryption keys, allowing them to establish and maintain the lifecycle, rotation, and use of the key.
- A breach of the S3 bucket content would be less impactful when this policy is enforced, as encrypted files will be near impossible to decrypt without access to the associated CMK, thereby keeping sensitive data secure.
Ensure Sagemaker domain is encrypted by KMS using a customer managed Key (CMK)
Ensure Sagemaker domain is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures the encryption of the data within the Sagemaker domain, providing additional security measures by preventing unauthorized users from reading or manipulating the data. Encryption effectively renders data useless to those who do not possess the correct decryption key.
- The use of a Customer Managed Key (CMK) provides greater control and flexibility over your AWS KMS keys. This allows you to establish and enforce your own key policies, usage permissions, and its lifecycle, thereby giving you full control over your data security.
- Without this policy, Sagemaker domains could be left vulnerable to data breaches or unauthorized access. This could result in sensitive information being exposed, and can lead to loss of data integrity and breach of compliance requirements.
- Utilizing the Infrastructure as Code (IaC) tool Terraform in the implementation of this policy can lead to more efficient and effective security management processes. This method eliminates risks associated with manual configuration and promotes consistency, repeatability, and scalability of infrastructure across different cloud environments.
Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK)
Ensure EBS Volume is encrypted by KMS using a customer managed Key (CMK)
- This policy helps protect sensitive data stored on Elastic Block Store (EBS) volumes, as encryption with a customer managed key (CMK) significantly reduces the chances of being compromised or unauthorized access.
- It allows users to have full control over their cryptographic keys by creating, owning, and managing their own CMKs. This is essential for organizations that are required to manage their own cryptographic materials in compliance with specific rules or regulations.
- Any data that is written to the EBS volume, including backups, snapshots, and replicas, is automatically encrypted under this policy. This significantly simplifies data protection procedures and minimizes the possibility of unencrypted data exposure.
- The policy ensures compliance with regulatory standards like HIPAA, GDPR, and PCI DSS which mandate encryption of sensitive data at rest. Non-compliance could lead to legal consequences and reputational damage.
Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK)
Ensure lustre file systems is encrypted by KMS using a customer managed Key (CMK)
- The policy ensures data encryption at rest, as it requires Lustre file systems on AWS to be encrypted by Key Management Service (KMS) using a Customer Managed Key (CMK). Hence, it provides an additional layer of defence against unauthorized access to sensitive data.
- It allows organizations to have full control over the keys used for the encryption of their file systems, giving them the ability to manage their own security protocols without relying solely on AWS built-in features. This heightens the overall security of the organisation’s infrastructure.
- The policy facilitates regulatory compliance because many industries and legal frameworks require data encryption at rest. Using a CMK for encryption aids in meeting such requirements by providing traceability and control over the encryption keys.
- In case of a security incident, it provides clarity for forensic analysis because the organization owning the CMK reports to the monitoring system. This reduces the complexity of identifying the cause of breaches and makes response and mitigation actions quicker.
Ensure ElastiCache replication group is encrypted by KMS using a customer managed Key (CMK)
Ensure ElastiCache replication group is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures that sensitive data stored in ElastiCache replication groups is encrypted at rest, providing an extra layer of data protection and safeguarding against unauthorized access.
- The use of a Customer Managed Key (CMK) from AWS Key Management Service (KMS) provides greater key management flexibility and control, allowing AWS customers to create, manage, and rotate their own encryption keys.
- Compliance with the policy reduces risks associated with data breaches, ensuring the organization remains in compliance with data privacy laws and regulations that stipulate certain types of data must be encrypted.
- The adherence to this policy can reduce downtime and data loss during potential cyber-attacks by maintaining data integrity, even if data is intercepted, it would be unreadable without the encryption key.
Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
Ensure WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
- This policy ensures the prevention of Log4j message lookup attacks that leverage the critical vulnerability CVE-2021-44228, also known as log4jshell, which can give unauthorized remote code execution access to targeted systems, thus avoiding potential major security breaches.
- Employing this infra security policy aids in protecting any web application associated with the AWS::WAFv2::WebACL resources from possible intrusion attempts, thereby strengthening the overall security posture of the infrastructure.
- When implemented via Infrastructure as Code through Cloudformation, the security policy enhances automation, repeatability, and alleviates the need for manual intervention thereby reducing the risk of human error in ensuring compliance with the policy.
- The policy regulates the AWS WAF to monitor HTTP and HTTPS requests that are forwarded to an Amazon CloudFront distribution, Amazon API Gateway REST API, Application Load Balancer, or AWS AppSync GraphQL API, thus relieving the burden on said resources from having to handle potential malicious attempts.
Ensure AppSync has Logging enabled
Ensure AppSync has Logging enabled
- Enabling logging in AppSync provides a clear and audit-friendly record of all activities and operations carried out on your AppSync API, improving detection and resolution of performance issues or system misuse.
- By implementing this policy through Cloudformation, it helps in automating the process of ensuring the logging is enabled without manual intervention, which can save time and reduce human error.
- It is crucial for compliance with various IT standards and regulations which require maintaining and monitoring logs for a certain period. This becomes easier with logging enabled for AWS::AppSync::GraphQLApi and aws_appsync_graphql_api resources.
- Insufficient logging can lead to a higher security risk due to the inability to track malicious activities or unauthorized access. Therefore, ensuring AppSync has logging enabled enhances the security measures of these entities, protecting them from potential threats and vulnerabilities.
Ensure AppSync has Field-Level logs enabled
Ensure AppSync has Field-Level logs enabled
- Enabling field-level logs on AppSync provides granular visibility into GraphQL requests and responses. This is critical for detecting unusual patterns, potential breaches, and helping in the troubleshooting of application issues.
- Without enabling field-level logs, vulnerabilities may go unnoticed until they cause significant damage or disruption. Logs can provide early indicators of a potential security threat, allowing for timely and effective preventative measures.
- The documentation of all API calls under this policy helps in maintaining a robust audit trail. This can be utilized for compliance and regulatory purposes, along with helping in incident response and forensic investigations.
- Implementing this policy using Infrastructure as Code (IaC) methodologies in CloudFormation allows for consistent, predictable, and repeatable configuration. This increases the reliability and security of infrastructure deployments.
Ensure Glue component has a security configuration associated
Ensure Glue component has a security configuration associated
- Ensuring Glue components such as crawlers, dev endpoints and jobs have a security configuration associated helps secure data access and protect from unauthorized disruptions. Without proper security configurations, important data could be exposed, manipulated or breached.
- Security configurations in Glue includes settings like encryption for data stored in AWS Glue, and encryption for data in transit. These factors are highly important to ensure data is encrypted at all times, reducing the risk of data breaches and maintaining data integrity.
- Adopting this security rule enables monitoring the effectiveness and compliance of security controls. Through its implementation in Cloudformation and by referencing the Python script in the resource link, administrators can automate checking the state of security configurations and enforce security policies more easily and efficiently.
- In the case of non-compliance, this policy will support rapid identification and remediation of security issues. This proactive handling of infra security management boosts trust of stakeholders and ensures continuous business operations with minimized downtime caused by potential breaches.
Ensure no aws_elasticache_security_group resources exist
Ensure no aws_elasticache_security_group resources exist
- The policy ensures that aws_elasticache_security_group resources do not exist in your AWS environment, helping maintain security and data integrity by reducing potential entry points for cyber-attacks.
- By enforcing this policy, you can better comply with best practices for AWS infrastructure and reduce the chances of configuration errors that can lead to security vulnerabilities.
- The policy helps reduce complexity in your AWS environment by avoiding the need for separate security groups for Elasticache resources and promotes the use of more modern and secure options like VPC security groups.
- Automation of this policy with Terraform can streamline resource management, enabling consistent and efficient enforcement of security rules across every deployment, making the cloud environment much safer and resilient to potential threats.
Ensure MQ Broker Audit logging is enabled
Ensure MQ Broker Audit logging is enabled
- Enabling MQ Broker Audit Logging enhances the security of AmazonMQ Broker by recording all the operations performed, providing valuable insights for any security violation investigations.
- Failure to enable audit logging may lead to difficulties in identifying malicious activities or breaches, as there would be no recorded trace of operations performed on the AWS::AmazonMQ::Broker.
- The MQ Broker Audit Logging, when enabled, allows administrators to monitor and audit all actions and operations related to the AmazonMQ Broker, promoting proactive problem detection and aiding in maintaining the health and security of the infrastructure.
- The automated checking mechanism provided in the linked Python script for Cloudformation allows quick verification and ensures if audit logging is enabled on the AmazonMQ Broker. This assures ongoing compliance with best practices for infrastructure security.
Ensure no aws_db_security_group resources exist
Ensure no aws_db_security_group resources exist
- The policy ensures that no aws_db_security_group resources exist, which is important because these resources are known to be less secure as they do not fully support all features of security groups for Amazon Virtual Private Cloud (Amazon VPC).
- The usage of security groups for Amazon VPCs at the database level helps in controlling inbound and outbound traffic better, thus adhering to the policy can lead to improved network security through more thorough control over access.
- Following this policy helps organizations adhere to best practices for AWS database security by adopting newer, more secure, and feature-rich options for database security rather than relying on outdated and less secure alternatives.
- Noncompliance to the policy could lead to potential breaches of the cloud’s security due to the inherent vulnerabilities of the aws_db_security_group resources, thereby adversely impacting the integrity and confidentiality of the data stored in the database.
Ensure Image Builder Distribution Configuration encrypts AMI's using KMS - a customer managed Key (CMK)
Ensure Image Builder Distribution Configuration encrypts AMI's using KMS - a customer managed Key (CMK)
- This policy boosts infra security by enforcing the encryption of Amazon Machine Images (AMIs) using the Key Management Service (KMS), which offers an added layer of protection as the encryption keys are entirely managed by the customer.
- The implementation of this rule helps in preventing unauthorized access to the information stored within AMIs. By using customer-managed keys for KMS, it ensures finer control over who can access the data encoded in an AMI.
- The policy’s basing on IaC (Infrastructure as Code) via Terraform makes it more efficient and less prone to human error as it automates processes and implements best safety practices systematically.
- Enforcing this policy reduces the chances of data breaches or data loss which can have significant financial, regulatory, and reputational implications for enterprise organizations utilizing AWS.
Ensure that Image Recipe EBS Disk are encrypted with CMK
Ensure that Image Recipe EBS Disk are encrypted with CMK
- Ensuring that Image Recipe EBS Disk is encrypted with the Cloud Management Key (CMK) is critical in providing an additional layer of security to safeguard sensitive data. Without it, unauthorized individuals could potentially access and misuse this information.
- This policy will ensure compliance with regulation and industry standards like GDPR, PCI DSS, HIPAA which often require data to be encrypted in transit and at rest. A breach can result in heavy penalties, both financial and reputational.
- Utilizing Terraform for Infrastructure as Code (IaC) encourages automation and consistency in security measures. This could significantly reduce the risk of human error leading to unencrypted data being accidentally exposed.
- If the EBS disk isn’t encrypted with a CMK, it might become a weak link in an organization’s security infrastructure, making the system susceptible to data breaches and other cyber threats. This policy helps mitigate such risks.
Ensure MemoryDB is encrypted at rest using KMS CMKs
Ensure MemoryDB is encrypted at rest using KMS CMKs
- Encrypting MemoryDB at rest using KMS CMKs helps protect sensitive data stored within the database from unauthorized access and potential data breaches, thus enhancing the security posture of the infrastructure.
- It ensures compliance with regulatory standards and industry best practices for data privacy and security. Many regulations require data at rest to be encrypted including GDPR, PCI-DSS, and HIPAA.
- Utilizing Key Management Service (KMS) Customer Master Keys (CMKs) reinforces the security by providing full control over the cryptographic keys and their usage, achieving fine-grained encryption key management.
- The process maintains the performance of the MemoryDB cluster by encrypting data with minimal overhead and without disturbing application functionality, thus ensuring data security without compromising on performance.
Ensure MemoryDB data is encrypted in transit
Ensure MemoryDB data is encrypted in transit
- Ensuring that MemoryDB data is encrypted in transit provides an additional layer of security and mitigates risks associated with data interception, preventing unauthorized exposure and manipulation of sensitive information.
- This policy reduces the potential attack surface for malicious parties to exploit vulnerabilities, as it requires data to be encrypted before transmission and decrypted upon receipt, thus securing the overall data transmission process.
- The policy adheres to best practices for cloud compliance and security standards. Companies adhering to this policy demonstrate commitment to data privacy and security, instilling confidence in stakeholders and customers.
- Non-compliance to this policy can potentially lead to regulatory penalties or breaches in data protection laws, which in turn can result in financial loss, reputational damage, and legal issues.
Ensure AMIs are encrypted using KMS CMKs
Ensure AMIs are encrypted using KMS CMKs
- This policy ensures the security of data stored on Amazon Machine Images (AMIs) by encrypting it with Key Management Service Customer Master Keys (KMS CMKs), making unauthorized access difficult even if the system is breached.
- With the ‘Ensure AMIs are encrypted using KMS CMKs’ policy, a higher level of control is offered over who can use your AMIs because only entities with decrypt permissions can use the encrypted AMIs.
- Through the application of this policy in the Terraform infrastructure, a security standard is maintained in the cloud environment, providing auditable assurance to meet compliance requirements around data protection.
- In case of unauthorized access, the policy protects stored data by rendering it unreadable, thereby significantly reducing the potential damage of a data breach.
Ensure to Limit AMI launch Permissions
Ensure to Limit AMI launch Permissions
- Ensuring the limitation of Amazon Machine Image (AMI) launch permissions contributes to the reduction of potential attack venues, as fewer entities are granted access to spin up instances from the AMI, minimizing unauthorized or malicious usage.
- This policy helps to enforce the Principle of Least Privilege (PoLP), by ensuring only necessary permissions are given to essential entities in the infrastructure as required, thereby reducing overall system vulnerabilities.
- By implementing this policy via Terraform as Infrastructure as Code (IaC), security measures are integrally built into the infrastructure’s development process, making adherence to the policy easier and reducing the possibility of human error.
- Failure to limit AMI launch permissions can lead to potential data breaches, unauthorized changes to system configurations, and potential cost escalations due to unauthorized instances running, thereby compromising not only the system’s security but also its financial standing.
Ensure API Gateway Domain uses a modern security Policy
Ensure API Gateway Domain uses a modern security Policy
- Using a modern security policy for API Gateway Domain ensures that only secure, up-to-date protocols and ciphers are accepted, reducing the risk of data being compromised or intercepted in communication.
- The policy encourages the use of advanced security layers like Transport Layer Security (TLS) for encrypting data sent over networks, which enhances the data protection capability of AWS API Gateway.
- Non-compliance with this policy can lead to potential vulnerabilities in your infrastructure, making it susceptible to attacks such as man-in-the-middle (MITM) attacks, which can result in unauthorized data access and potential data loss.
- This policy is especially important for organizations dealing with sensitive information, as a failure to implement a modern security policy could not only lead to a business-critical data breach, but could also result in non-compliance with data protection regulations, which may carry significant penalties.
Ensure MQ Broker minor version updates are enabled
Ensure MQ Broker minor version updates are enabled
- Enabling MQ Broker minor version updates helps in automatically incorporating the latest enhancements, bug fixes, and security patches thus reducing the risk of vulnerabilities that could impact the AWS infrastructure.
- This policy ensures consistent system performance and stability as incompatible or outdated MQ Broker versions can lead to operational issues or in worst cases, complete system crashes.
- By adhering to this policy, the need for manual intervention is eliminated making the update process more efficient and less prone to errors or inconsistencies that can occur during manual updating.
- When this policy is followed, it guarantees the AWS MQ Broker stays in line with evolving industry standards for performance and security, hence, lifting the overall organization’s security and compliance posture.
Ensure MQ Broker version is current
Ensure MQ Broker version is current
- Ensuring the MQ Broker version is current keeps the system protected against known vulnerabilities that may exist in outdated versions, bolstering overall infrastructure security.
- Maintaining an up-to-date MQ Broker version allows the system to benefit from the latest features and improvements, enhancing the overall performance and reliability of the service.
- A current MQ Broker version reduces the potential for compatibility issues between different components of the infrastructure by adhering to the latest standards and specifications.
- Using the MQ Broker latest version promotes the use of best practices in infrastructure management and lifecycle, reducing potential for technical debt and the time required for future updates and migrations.
Ensure MQ broker encrypted by KMS using a customer managed Key (CMK)
Ensure MQ broker encrypted by KMS using a customer managed Key (CMK)
- Encrypting the MQ broker with a customer managed key aids in maintaining secure transmission of messages by ensuring that only authorized parties with the specific key can access and decrypt it, thereby reducing the risks associated with data compromise.
- Using a customer managed key allows for an additional layer of security control as it gives the customer the authority to manage the key including its lifecycle, rotation policy, and access permissions, thus offering flexibility based on individual business requirements.
- Compliance standards and regulations often demand the use of encryption techniques and key management. Implementing this policy can therefore help in meeting compliance requirements pertaining to the secure transmission and storage of data.
- Not employing this policy could result in unauthorized access to the MQ broker and potential data breaches. This could then have consequent impacts on the organization’s reputation and financial position due to losses or penalties from data breaches.
Batch job does not define a privileged container
Batch job does not define a privileged container
- Running a Batch job in a privileged container means the container has more access to resources which could lead to security vulnerabilities. If a malicious actor gains access to the container, they too would have these privileges.
- A batch job that does not define a privileged container operates with minimal necessary permissions, decreasing the opportunity for unauthorized actions. This is a fundamental aspect of the principle of least privilege, a crucial component in infrastructure security.
- Leaving a Batch job to run in privileged mode can also potentially expose sensitive data within the application or allow uncontrolled network access, leading to data breaches or service disruptions.
- The Terraform script, BatchJobIsNotPrivileged.py, ensures this policy is enforced, helping automate security configurations, reduce human error, and maintain consistent security postures across the infrastructure.
Ensure RDS uses a modern CaCert
Ensure RDS uses a modern CaCert
- Ensuring RDS (Relational Database Service) uses a modern Certificate Authority Certificate (CaCert) is crucial to protect the integrity and confidentiality of data in transit between the RDS and client applications, enhancing data protection.
- This policy reduces the risk of cyber threats such as man-in-the-middle attacks, whereby attackers can impersonate the RDS to intercept sensitive data, thus boosting data and system security.
- Outdated CaCerts may have known vulnerabilities or weak encryption methods. Ensuring the use of a modern CaCert in RDS allows your infrastructure to benefit from the latest security updates and stronger encryption.
- Non-compliance with this infrastructure security policy can potentially lead to data breaches, system downtime and erosion of customer trust due to compromised security, underscoring the importance of consistent monitoring and frequent updates.
Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)
Ensure DMS replication instance is encrypted by KMS using a customer managed Key (CMK)
- This policy guarantees the safety of the data in transit during the replication process in AWS, as it requires the use of a customer-managed Key Management Service (KMS) for encryption.
- The enforced use of a customer-managed key adds an extra layer of responsibility and control to the client, enhancing the data protection scheme. This enables clients to manage who can access their data by controlling the use and rotation of encryption keys.
- Replication instances not encrypted by KMS using a customer-managed key could result in unauthorized access to sensitive business information, potentially leading to data breaches or leaks, hence this policy helps to mitigate such security risks.
- By embedding this policy within Terraform’s infrastructure-as-code practices, the requirement for secure key management can be integrated directly into software development workflows, enhancing security while reducing manual setup and maintenance efforts.
Ensure ELB Policy uses only secure protocols
Ensure ELB Policy uses only secure protocols
- This policy ensures that Elastic Load Balancing (ELB) only uses secure protocols, fortifying the defense of data transmitted between the client and the load balancer, reducing the risk of data breach.
- With secure protocols, it guards against attacks like surveillance, data modification, and spoofing by lowering the chance of unencrypted or weakly encrypted data being intercepted or tampered.
- Using insecure protocols can lead to non-compliance with data protection regulations like GDPR or HIPAA, resulting in severe legal and financial consequences. This policy helps in maintaining compliance with such regulations.
- Implementing this policy via Infrastructure as Code (IaC) approach using Terraform allows for scalable, repeatable, and efficient security configuration across various AWS load balancer policies, enhancing the overall security posture.
Ensure AppSync API Cache is encrypted at rest
Ensure AppSync API Cache is encrypted at rest
- Encrypting AppSync API Cache at rest ensures that sensitive data is not easily accessible by unauthorized individuals or malicious entities, thereby preserving the integrity and confidentiality of the data.
- The policy aids in achieving regulatory compliance as many standards and regulations require data protection both in transit and at rest, reducing legal and compliance risks for the organization.
- Enabling the AppSync API Cache encryption at rest can protect the data against physical threats such as theft or loss of hard disks, as the data remains unreadable without decryption keys.
- If an infrastructure as code (IaC) solution like Terraform does not enforce this policy, a potential vulnerability could be introduced, inviting risks of data exposure and compromising the security posture of the AWS environment.
Ensure AppSync API Cache is encrypted in transit
Ensure AppSync API Cache is encrypted in transit
- Ensuring AppSync API Cache is encrypted in transit helps protect sensitive data from being intercepted, read, or altered as it moves across networks. This prevents unauthorized access to the API data cache.
- It is particularly important because failing to encrypt sensitive information in transit can potentially lead to data breaches, resulting in reputational damage, fines, or other penalties.
- This policy leverages Infrastructure as Code (IaC) using Terraform, offering the ability to automate the implementation of security controls and reduce manual error.
- By enforcing this policy on the ‘aws_appsync_api_cache’ resource, it ensures all AppSync APIs used within the AWS infrastructure adhere to secure and consistent standards, thereby enhancing the overall security posture of the application and system.
Ensure CloudFront distribution is enabled
Ensure CloudFront distribution is enabled
- Enabling CloudFront distribution is important as it improves the delivery and accessibility of data to users globally. By utilizing edge locations that are closer to end users, it decreases latency and improves speed, enhancing user experience.
- Ensuring CloudFront distribution is enabled increases security for data delivery. CloudFront comes with AWS Shield Standard which provides automated protections against common DDoS attacks, enhancing the reliability and security of your services.
- This control provides for cost optimization by reducing the need to handle peaks in traffic demand on the origin resources. It reduces the workload and bandwidth of origin servers, thus resulting in cost savings.
- Integrity of data delivery is maintained with CloudFront as it provides native support for serving HTTPS requests, ensuring end-to-end encryption of data and preventing tampering or eavesdropping during transit.
Ensure Create before destroy for API deployments
Ensure Create before destroy for API deployments
- This policy ensures continuity of service, as even during the implementation of changes or updates, a new API gateway deployment is created before the old one is discarded, which prevents any disruption to the services enabled by the API gateway.
- Following the ‘Create before Destroy’ policy safeguards against potential failures during the creation of a new deployment. If the new deployment fails, the old one can continue to serve until the issue with the new deployment is resolved, maintaining the service’s availability.
- By adhering to this policy, it significantly minimizes downtime during deployments, enhancing overall user experience and ensuring high availability of applications that rely on the API gateway.
- The policy reduces risks associated with deployment updates such as loss of data or service. Even if a failure occurs during a new deployment implementation, all transactions are routed through the previous deployment, ensuring the preservation of data integrity and service continuity.
Ensure that CloudSearch is using latest TLS
Ensure that CloudSearch is using latest TLS
- Ensuring that CloudSearch uses the latest TLS helps enhance data security by providing secure communication channels. Updated TLS versions provide superior encryption algorithms, minimizing the risk of data interception or tampering during transmission.
- Outdated TLS versions may have known security vulnerabilities that can be exploited by malicious parties. Using the latest TLS for CloudSearch mitigates this risk, ensuring that exposed data and system integrity are kept intact.
- Using up-to-date TLS for CloudSearch helps maintain and improve the system’s compliance with data protection and cybersecurity standards or regulations. Non-compliance might lead to legal repercussions and harm an organization’s reputation.
- The policy directly impacts the development and operational process because it requires monitoring and applying regular updates. Although it may initially seem labor-intensive, it ultimately increases system reliability and preserves user trust by providing consistent and secure service.
Ensure CodePipeline Artifact store is using a KMS CMK
Ensure CodePipeline Artifact store is using a KMS CMK
- Ensuring CodePipeline Artifact store uses a KMS CMK (Key Management Service Customer Master Key) allows for enhanced security of the artifacts, reducing the risk of unauthorized access to the pipeline’s essential details.
- KMS CMK offers added control over key management on AWS, such as offering the ability to customize permissions, perform audit trails, and apply compliance controls. This minimizes the possibility of data breaches.
- If not encrypted with a KMS CMK, sensitive information within the artifacts could be compromised, resulting in potential data leaks, violation of compliance standards, and financial and reputational damage.
- Integrating this policy with the Infrastructure as Code (IaC) model like Terraform ensures continuous security compliance through the automation of infrastructure, making it easier to manage and reducing the potential for human error.
Ensure that CloudSearch is using https
Ensure that CloudSearch is using https
- This policy ensures that all data transferred between AWS CloudSearch and the users is encrypted during transit using the HTTPS protocol. This is crucial in preventing unwanted exposures and potential data breaches.
- Implementing this policy aids in establishing secure, trusted connections, particularly for sensitive information, which is a critical requirement in various compliance standards such as GDPR, HIPAA, and PCI DSS.
- It prevents man-in-the-middle attacks, which can occur when http is used instead of https. Https offers security measures to verify that the user is communicating with the intended AWS CloudSearch server and not with an attacker impersonating it.
- This policy also shows the commitment of the organization to prioritize security, thereby instilling a sense of trust in the users utilizing the service or in stakeholders observing the security posture of the business.
Ensure CodeArtifact Domain is encrypted by KMS using a customer managed Key (CMK)
Ensure CodeArtifact Domain is encrypted by KMS using a customer managed Key (CMK)
- Enforcing this policy helps protect sensitive data stored in the CodeArtifact Domain by encrypting it with a customer managed key (CMK). This reduces the risk of data breaches and unauthorized access.
- Using a CMK for encryption increases control and auditability. It allows the customer to manage the lifecycle of the key, including its creation, rotation, and deletion, and to monitor its use, improving compliance with security policies.
- It prevents the potential misuse of the default AWS managed keys, as these keys may be less secure. With a CMK, the customer has sole control over who can use the key to decrypt the data, minimizing the attack surface.
- Non-compliance with this policy could lead to possible regulatory fines or damage to the company’s reputation due to insufficient data protection measures. Implementing this security measure can also support compliance with data protection regulations and standards such as GDPR or HIPAA.
Ensure DMS replication instance gets all minor upgrade automatically
Ensure DMS replication instance gets all minor upgrade automatically
- This policy ensures that the aws_dms_replication_instance receives all minor updates automatically, which is important to maintain system stability and enhance the performance of the replication instance.
- Minor updates often include performance updates, minor improvements and bug fixes which are beneficial to improve the efficiency and productivity of the replication systems without impacting other major functionalities.
- Automatic minor upgrades help to reduce the administrative burden in the case of multiple replication instances. It prevents the need for manual monitoring and mitigates the risk of an outdated system due to missed manual upgrades.
- Consistent and automatic updating lessens the likelihood of vulnerabilities caused by outdated software. As hackers predominantly target obsolete software and systems, having the latest security patches in these minor updates helps to mitigate potential security breaches.
Ensure ECS Cluster enables logging of ECS Exec
Ensure ECS Cluster enables logging of ECS Exec
- Enables auditing and traceability of the ECS cluster by logging activities performed with ECS Exec feature. Such logs can help in debugging issues or investigating security breaches.
- Logging of ECS Exec activities can provide detailed insights into the operational aspects, which helps to optimize performance and maintain a robust, efficient technology infrastructure.
- Without logging enabled, an organization may not be compliant with certain regulatory standards, such as GDPR or HIPAA, that require logging of access and operational activities to ensure data integrity and security.
- Logging allows for early identification and rectification of potential security risks and vulnerabilities, thus improving the overall security posture of the AWS ECS cluster. Log data can also provide insights valuable for incident response and forensic investigations.
Ensure ECS Cluster logging uses CMK
Ensure ECS Cluster logging uses CMK
- Ensuring ECS (Elastic Container Service) Cluster logging uses CMK (Customer Master Keys) is important as it allows for encryption of all log data, providing an additional layer of security to sensitive information.
- The policy aids in meeting various compliance requirements that mandate encryption of certain data at rest, including HIPAA and GDPR, thus avoiding potential legal and financial penalties for non-compliance.
- Encrypting logs with the customer’s CMK rather than AWS managed keys gives the customer full control over who can access and decrypt the log data, enhancing data sovereignty and protection from unauthorized access.
- If ECS Cluster logging is not using CMK, there is a risk of potential exposure of sensitive information in the logs, which can lead to security breaches and loss of data integrity.
Ensure API Gateway method setting caching is enabled
Ensure API Gateway method setting caching is enabled
- Enabling caching in API Gateway method settings can improve the performance of your APIs by storing responses from your endpoints and providing those stored responses to requests which have the same parameters, reducing the amount of processing and the time taken for responses.
- This security policy directly impacts cost-effectiveness, as caching responses drastically reduces the number of calls to your endpoint, protecting you from potential data retrieval charges or computational costs associated with processing the requests.
- Implementing this policy with Infrastructure as Code (IaC) solution like Terraform ensures consistent application of this setting across all the APIs in the infrastructure, reducing the room for human error and oversight.
- The policy also helps in easing the load on your server’s compute resources and optimizes the bandwidth usage, aiding in traffic management and enhancing the user experience with quicker response times.
Ensure DB instance gets all minor upgrades automatically
Ensure DB instance gets all minor upgrades automatically
- Enabling automatic minor upgrades for the DB instance ensures the application remains secure with the latest patches against any discovered vulnerabilities, enhancing the security of the infrastructure.
- Automatic upgrades reduce the manual intervention required which could cause human errors, thus increasing the reliability of the service and maintaining a high level of operational efficiency.
- With the policy applied, the AWS RDS database keeps updated with the latest feature enhancements, improvements, and bug fixes as soon as they are released, resulting in increased stability, performance, and functionality of the application.
- Using infrastructure as code (IaC) via Terraform to mechanize this process can significantly boost the scalability of the system as minor upgrades can be handled automatically across multiple DB instances or clusters without the need for individual configuration changes.
Ensure KMS key is enabled
Ensure KMS key is enabled
- Enabling the KMS (Key Management Service) key ensures that encryption and decryption operations that rely on the key can be performed without interruption, which is important for maintaining accessibility and continuity of services in any AWS environment.
- KMS keys are used in AWS to encrypt and decrypt data at rest, making them critical for the secure storage of sensitive information. Ensuring KMS key is enabled prevents accidental exposure of sensitive data, ensuring compliance with privacy regulations and best practices.
- Disabled KMS key would restrict the applications and users from accessing encrypted data, threatening the operational integrity of the cloud infrastructure. If a key required to decrypt data is disabled, it could cause disruptions leading to potential service downtime.
- Correctly managing the state of the KMS keys, like making sure they are enabled, is an important component of Terraform’s resource provisioning, as it contributes to the overall security posture of the infrastructure by preventing unauthorized or unintended data access.
Verify Elasticsearch domain is using an up to date TLS policy
Verify Elasticsearch domain is using an up to date TLS policy
- Ensuring that Elasticsearch domain uses an up-to-date TLS policy is crucial as it ensures data security during transmission. It helps in preventing any form of unauthorized access or tampering, ensuring the integrity and confidentiality of data.
- A weak or outdated TLS policy could expose systems to vulnerabilities, including Man-in-the-Middle (MitM) attacks, data leakages, and various forms of cyber threats. It also poses a compliance risk as regulations like GDPR, CCPA, PCI DSS, mandate data protection measures at all levels.
- The use of Infrastructure as Code (IaC) via Terraform not only automates the process but also makes it more error-free. It makes it easier to implement the policy across all instances of aws_elasticsearch_domain and aws_opensearch_domain and ensures that the environment remains secure.
- The mentioned Python script ElasticsearchTLSPolicy.py provides an implementation plan that makes it easy to verify and enforce up-to-date TLS policy in Elasticsearch domain. It aids in enforcing compliance and reducing the possibility of a security breach, thus maintaining the overall security posture.
Ensure no NACL allow ingress from 0.0.0.0:0 to port 21
Ensure no NACL allow ingress from 0.0.0.0:0 to port 21
- The policy helps protect the organization’s resources from unauthorized access by blocking all inbound traffic to port 21. This is the default port for FTP, a protocol commonly targeted by attackers due to its clear-text transmission of data and credentials.
- Compliance with this policy significantly reduces the risk of security breaches by limiting the exposure of sensitive data on the network, maintaining the integrity of the organization’s cloud-based assets.
- Preventing NACLs from allowing ingress from all (0.0.0.0/0) to port 21 helps safeguard against large-scale network attacks such as DDoS (Distributed Denial of Service), which can cause disruption of services and potential financial losses.
- Adherence to this policy reinforces best practices for managing network traffic in an AWS environment using Terraform, promoting the use of secure and specific network rules over broad, unrestricted settings that could lead to vulnerabilities.
Ensure no NACL allow ingress from 0.0.0.0:0 to port 20
Ensure no NACL allow ingress from 0.0.0.0:0 to port 20
- This policy is crucial as it prevents unauthorized access to data and resources on port 20, a commonly used port for FTP data transfers. Access from 0.0.0.0:0 implies the entire internet, which can result in potential security threats.
- Implementing this security rule will mitigate risks such as data theft, server manipulations, or injection of malicious scripts, as unrestricted ingress traffic on port 20 can make the network susceptible to these risks.
- The policy directly relates to the implementation of best practice infrastructure security controls by restricting traffic which does not confirm to established source and destination IP protocols, leading to enhanced network security.
- Non-compliance to this policy rule could compromise the terraform managed AWS network ACL’s, posing serious vulnerabilities and non-compliance issues with various security standards and regulations.
Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389
Ensure no NACL allow ingress from 0.0.0.0:0 to port 3389
- This policy helps to mitigate the risk of unauthorized access to resources via Remote Desktop Protocol (RDP), which uses port 3389, by blocking unfiltered traffic from any IP address (0.0.0.0:0 signifies all IP addresses).
- A Network Access Control List (NACL) with open ingress traffic to port 3389 can leave systems vulnerable to brute force attacks, malware infections, and data breaches.
- Enforcing this policy safeguards AWS infrastructure by allowing only pre-approved IP addresses to connect to resources, inherently implementing the principle of least privilege access.
- The policy plays a vital role in meeting compliance with various cybersecurity frameworks and regulations that require strict controls on access to IT resources, helping to maintain the entity’s reputation and avoid legal penalties.
Ensure no NACL allow ingress from 0.0.0.0:0 to port 22
Ensure no NACL allow ingress from 0.0.0.0:0 to port 22
- This policy prevents unauthorized access from all IP addresses (0.0.0.0:0) to port 22, reducing the risk of server breaches since port 22 is typically used for Secure Shell (SSH) remote administration which potential attackers often target.
- By disallowing unrestricted ingress from all IP addresses to port 22, it significantly narrows the attack surface for potential cybersecurity threats, such as brute force or DDoS attacks, by only letting specific, needed IP addresses to access the port.
- The policy enforces network traffic discipline and orderliness by delineating and controlling what can do what on the system, crucial to maintaining system stability, organization, and predictability.
- Implementing this policy using Infrastructure as Code (IaC) tool Terraform ensures reproducibility and version control of security configurations, resulting in mature cloud infrastructure and assisting in scaling security efforts across an organization.
Ensure Create before destroy for ACM certificates
Ensure Create before destroy for ACM certificates
- Ensuring ‘Create before destroy’ for ACM (AWS Certificate Manager) certificates is important as it helps minimize service downtime during updates. If a certificate is destroyed before a new one is created, any services relying on that certificate may become unavailable or insecure.
- Following this policy proactively safeguards against potential disruptions and helps maintain the continuity and integrity of services that depend on ACM certificates.
- This more orderly management of certificates introduces an additional layer of security, as it prevents any possible instances where services might accidentally run on invalid or expired certificates during the transition phase.
- As for Terraform’s infrastructure as code approach, having this policy in place promotes enhanced version control and a robust disaster recovery strategy, making reverting to a previous state simpler and more predictable.
Verify logging preference for ACM certificates
Verify logging preference for ACM certificates
- The policy necessitates verification of logging preference for ACM certificates, enhancing the security control over the SSL/TLS certificates. Keeping a log of the certificates helps to track its usage and guard against unauthorized access or alterations to the certificates.
- Since the infrastructure is managed using Infrastructure as Code (IaC) tool Terraform, the policy ensures consistent logging settings across all aws_acm_certificate resources, which promotes a uniform security standard and mitigates potential configuration errors.
- Observing this policy helps in maintaining a comprehensive record of all certificate-related actions, facilitating the detection of suspicious activities or breaches. In the event of a cyber attack, these logs can provide critical clues for forensic analysis and incident response.
- Failure to comply with the policy could lead to the ACM certificate’s misuse or compromise without detection due to lack of monitoring. This could expose the system to risks such as Man-in-the-Middle (MITM) attacks, which may lead to data theft, system interruption, or other critical security incidents.
Ensure that copied AMIs are encrypted
Ensure that copied AMIs are encrypted
- The policy ensures the security of copied Amazon Machine Images (AMIs) by encrypting them, mitigating the risk of unauthorized access and data breaches.
- Encryption of copied AMIs can prevent any potential data leakage. This is particularly critical if the AMIs contain sensitive information or configuration details for your infrastructure.
- Since Terraform is used to automate infrastructure provisioning, ensuring encryption of AMIs within the Terraform code itself reduces the manual overhead and potential for human error.
- Non-compliance to this policy can lead to non-compliance with regulatory standards like GDPR or HIPAA that mandate data encryption, potentially leading to penalties and reputational damage.
Ensure AMI copying uses a CMK
Ensure AMI copying uses a CMK
- Ensuring AMI copying uses a Customer Master Key (CMK) is important for enhancing data security during the copying process. The use of a CMK allows for encryption, thereby minimizing the risk of unauthorized data access during the copying process.
- This policy also provides control over key management. With a CMK, you can implement key rotation policies, choose when to enable or disable keys, and directly manage access to AWS resources, fostering better security practices for AWS infrastructure.
- Following this policy reduces the chance of AMI copying being exploited for data breaches. If an unencrypted copy were intercepted during transmission, sensitive information could be at risk.
- The implementation of this policy using Terraform allows for standardized, professional code development and deployment. Terraform’s idempotent behavior enforces the desired state management and prevents potential drifts from the planned configuration, ensuring that this rule is consistently applied.
Ensure Create before destroy for API Gateway
Ensure Create before destroy for API Gateway
- Ensuring ‘Create before Destroy’ for API Gateway ensures that a new instance of an API Gateway is created and fully operational before the old instance is destroyed, preventing downtime during updates or changes.
- It provides uninterrupted service to the end-users as it seamlessly switches over to the new gateway instance once it is ready, hence maintaining continuity of business operations.
- This policy follows the Infrastructure as Code (IaC) best practices, reducing the risk of manual errors or complications during the update and deletion process in Terraform.
- This lifecycle rule will help in managing dependencies better. When other resources rely on the API gateway, it ensures no dependencies are broken during the update process as there’s no point where the API Gateway does not exist.
Ensure that GuardDuty detector is enabled
Ensure that GuardDuty detector is enabled
- Enabling GuardDuty detector significantly improves the visibility of your AWS environment by continuously monitoring for malicious or unauthorized activity. It helps in proactively identifying threats before they can cause harm, thus enhancing the overall security of your infrastructure.
- Maintaining the GuardDuty detector as an enabled configuration within your Terraform script ensures that the security setting is automatically applied during the provisioning and updating of your AWS resources. This prevents manual errors or oversights that can occur when configuring settings individually.
- The script adds an additional layer of security to your current AWS environment by automatically analyzing and processing potential threat data such as VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. This can help catch vulnerabilities or attacks not detected by other security measures.
- By enforcing this policy, you ensure that newly deployed or existing resources are always under the coverage of GuardDuty, minimizing the risk of undetected threats or vulnerabilities. This is critical in avoiding security breaches and maintaining compliance with various cybersecurity norms and standards.
Ensure DAX cluster endpoint is using TLS
Ensure DAX cluster endpoint is using TLS
- Ensuring DAX cluster endpoint uses TLS is crucial to safeguard the data transmitted between the client and the server from cyber threats such as eavesdropping, man-in-the-middle attacks, or data tampering.
- This policy demonstrates adherence to best practices in infrastructure security, enhancing the organization’s reputation with stakeholders, customers, and regulatory bodies for diligently protecting sensitive information.
- If the DAX cluster endpoint does not use TLS, it would be non-compliant with data protection regulations such as GDPR or HIPAA, which can lead to legal penalties and financial losses for the entity.
- Without using TLS, the operational integrity of the entity’s aws_dax_cluster resources may be at risk as it becomes vulnerable to cyber threats disrupting service availability and thus business operations.
Ensure Kinesis Firehose delivery stream is encrypted
Ensure Kinesis Firehose delivery stream is encrypted
- This policy ensures that data being streamed through the Kinesis Firehose delivery stream is encrypted, enhancing the confidentiality and integrity of the data being transmitted.
- Enabling encryption on Kinesis Firehose Delivery Stream provides an additional layer of security and prevents unauthorized access to sensitive information, thereby complying with data protection regulations and standards.
- Non-compliance with this policy could result in potential data breaches, legal consequences, brand reputation damage, and losing customer trust if sensitive data is left unprotected in the stream.
- The policy is implemented using Infrastructure as Code (IaC) tool, Terraform which allows automated and consistent deployment of such security controls across the infrastructure. This greatly reduces the chances of manual error and oversight in security implementation.
Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK
Ensure that Kinesis Firehose Delivery Streams are encrypted with CMK
- This policy ensures that data being transmitted via Kinesis Firehose Delivery Streams is encrypted, making it less likely to be readable or usable by unauthorized entities, hence increasing data confidentiality.
- Utilization of Customer Master Keys (CMK) for encryption elevates protection further as CMKs are specific to each user and therefore not easily deciphered by third parties.
- If not implemented properly, unencrypted or poorly encrypted data in the Kinesis Delivery Streams could lead to breaches of sensitive or critical information, potentially causing substantial reputation and monetary damage.
- Implementing and enforcing this policy with Infrastructure as Code (IaC) using Terraform ensures consistency and uniformity in security across all Kinesis Firehose Delivery Streams, reducing the risk of human errors or oversights.
Ensure MWAA environment has scheduler logs enabled
Ensure MWAA environment has scheduler logs enabled
- Enabling scheduler logs in the MWAA environment helps in identifying and diagnosing problems or issues that may arise within the AWS Managed Workflows for Apache Airflow setup, enhancing the investigation and resolution process for any reported incidents.
- This infra security policy is significant in ensuring system transparency, where the scheduler logs provide crucial insights into the internal operations of the middleware, aiding in system optimization and assisting with performance tuning.
- The implementation of this policy through Terraform facilitates security automation, reducing the risk of human error, and thus can significantly improve overall cloud infrastructure security.
- Scheduler logs also help in compliance monitoring and reporting, as well as ensuring accountability, by keeping a record of all activities making it easier to trace malicious activities, resources misuse or detect any potential security threats.
Ensure MWAA environment has worker logs enabled
Ensure MWAA environment has worker logs enabled
- This policy ensures that MWAA (Managed Workflows for Apache Airflow) environments are properly recording worker logs, helping to track and understand all job flow tasks, monitor behavior, and facilitate debugging workflows, contributing to overall system transparency and accountability.
- Enabling worker logs in the MWAA environment supports incident detection and response processes, as it can provide vital information in case of unexpected behaviors or security incidents, allowing for faster identification and resolution.
- Non-compliance with this policy may lead to a lack of visibility into the MWAA environment operations, making it difficult to audit or review actions taken, therefore increasing the risk of unnoticed malicious activity or operational issues.
- The policy plays a significant role in ensuring compliance with various security standards and regulations that require detailed logging and monitoring for data management systems, helping the organization avoid potential legal and regulatory liabilities.
Ensure MWAA environment has webserver logs enabled
Ensure MWAA environment has webserver logs enabled
- Enabling MWAA environment webserver logs helps in monitoring and diagnosing the operational issues with AWS Managed Workflows for Apache Airflow (MWAA). This provides insights on the webserver’s operational activity which supports error detection and debugging.
- The policy aids in auditing the activity on your MWAA webserver. The logs provide information such as request time, client IP, request ID, and status code, which can be useful in investigating unauthorized access or suspicious activity.
- Logs also help in identifying performance bottlenecks and anomalies, allowing teams to optimize the performance and reliability of the MWAA environment.
- Non-compliance to the policy can lead to low observability, prevent efficient troubleshooting, and can potentially impact the security by providing less visibility into potential security threats or breaches.
Ensure replicated backups are encrypted at rest using KMS CMKs
Ensure replicated backups are encrypted at rest using KMS CMKs
- This infra security policy is important as it ensures that database backup data is encrypted at rest, utilizing Key Management Service (KMS) Customer Master Keys (CMKs), which adds an additional layer of security for sensitive information.
- By enforcing this policy, organizations can meet compliance requirements such as HIPAA or GDPR that mandate encryption of sensitive data at rest, protecting them from potential legal ramifications.
- The policy mitigates the risk of unauthorized access or data breaches, as even if the physical storage medium (like a backup disk or storage system) is compromised, the data cannot be read without the encryption keys.
- It protects the integrity and confidentiality of the replicated backup data in aws_db_instance_automated_backups_replication, ensuring that any effort to tamper with or alter the data would be immediately noticeable due to the encryption.
Ensure RDS Cluster activity streams are encrypted using KMS CMKs
Ensure RDS Cluster activity streams are encrypted using KMS CMKs
- This policy ensures that RDS Cluster activity streams, which contain potentially sensitive information about database operations and changes, are protected with encryption. This significantly lowers the risk of unauthorized access and data breaches.
- The policy mandates the use of KMS CMKs (Key Management Service Customer Master Keys) for encryption, offering a high level of security. KMS manages the cryptographic keys for users, decreasing their burden of key management while enhancing security.
- If the policy is not adhered to, the RDS Cluster activity stream data could be compromised if intercepted, leading to potential data loss, violation of privacy regulations, and consequential penalties.
- It also sets a standard for infrastructure as code (IaC) approach using Terraform scripts, promoting automation, consistency, and efficiency in security practices across the organization’s infrastructure.
Ensure all data stored in the Elasticsearch is encrypted with a CMK
Ensure all data stored in the Elasticsearch is encrypted with a CMK
- Ensuring all data stored in Elasticsearch is encrypted with a CMK (Customer Master Key) provides an added layer of security by making the data unreadable to unauthorized users, reducing the risk of data breaches.
- Through the use of a CMK, keys management becomes more streamlined. AWS services automatically track and protect the key for its entire lifecycle, preventing potential misplacement that could lead to data access issues.
- Encrypting data with a CMK increases compliance with regulations and industry standards that require encryption of sensitive data at all stages – in transit and at rest, thereby enhancing trust among clients and stakeholders.
- In scenarios, such as unauthorized access or compromised data, encryption with CMK allows immediate key deletion or rotation – making all data encrypted with that key inaccessible instantly, offering prompt mitigation strategies against data breaches.
Ensure that Elasticsearch is not using the default Security Group
Ensure that Elasticsearch is not using the default Security Group
- Ensuring Elasticsearch is not using the default Security Group enhances the security of the application due to the sheer number of additional security features that can be implemented in a custom Security Group compared to the standard one.
- A unique Security Group for Elasticsearch allows the administrator to control and limit network access to the application, preventing unauthorized access.
- Risk of misconfiguration is minimized when using a custom Security Group, as defaults often contain overly permissive rules which can expose the application to unnecessary risks.
- A poorly configured default Security Group could simplify an attacker’s attempt to infiltrate the network, compromising any data stored within Elasticsearch. To mitigate this, creating specific Security Groups for applications can provide tailored security measures.
Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions
Ensure that the Execution Role ARN and the Task Role ARN are different in ECS Task definitions
- This policy helps maintain the principle of least privilege by ensuring that the execution role, which the Amazon ECS service uses to make AWS API calls on your behalf, and the task role, which determines what other AWS service resources the task can interact with, are not conflated. This minimization of permissions effectively reduces the scope and impact of potential security breaches.
- It enhances the security by limiting the blast radius in case of a compromise. If a malicious user gains access to one role, they still do not gain the privileges of the other role. For instance, being able to execute the tasks doesn’t give them access to the AWS resources and vice versa.
- Keeping the Execution Role ARN and the Task Role ARN separate in ECS Task definitions allows for better auditing and control of resources. The activities of each role can be logged and tracked independently, resulting in cleaner logs and easier detection of any anomalies.
- It enables granular control over infrastructure resources. A careful separation of permissions associated with each role offers the ability to place exact controls on the scope of activities that can be performed by both roles. It helps in managing infrastructure as code (IaC) resources like aws_ecs_task_definition more effectively in Terraform.
Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/)
Ensure that RDS PostgreSQL instances use a non vulnerable version with the log_fdw extension (https://aws.amazon.com/security/security-bulletins/AWS-2022-004/)
- This policy ensures the use of a secure and non-vulnerable version of RDS PostgreSQL instances by requiring the log_fdw extension. This specific extension enables the reading and writing of log files directly from the PostgreSQL database, adding another level of protection against potential attacks.
- Failure to comply with this policy can create security vulnerabilities due to the potential for exploitation of outdated or vulnerable versions. It could allow malicious users to infiltrate the database and gain unauthorized access to sensitive information, compromising data integrity.
- The policy reinforces the practice of proactive security updates and patches in cloud resources. It emphasizes the importance of using the latest, more secure versions of database applications, minimizing risk exposure by protecting against known security holes in previous versions.
- Using Infrastructure as Code (IaC) tool like Terraform in implementing this policy ensures consistency and repeatability. It helps automate the process of applying the policy across various AWS DB instances or RDS clusters, reducing the chance of human error and providing a more reliable security measure.
Ensure CloudTrail logging is enabled
Ensure CloudTrail logging is enabled
- Enabling CloudTrail logging is crucial for auditing and monitoring activities in your AWS environment. It records and retains event log files of all API activity, which is essential in detecting suspicious activity or identifying operational issues.
- This policy helps in ensuring compliance with numerous cybersecurity standards and audits. CloudTrail logging can be utilised as evidence for demonstrating compliance with internal policies or external regulations by providing a history of actions, changes, and events.
- Implementing this policy means that even in the case of a security incident, having enabled CloudTrail logging offers the ability to conduct thorough forensic analysis. It allows the security team to trace back the actions of an attacker or determine the cause of an incident.
- Without enforcing this policy, organisations are exposed to an increased risk of undetected security breaches. Unidentified malicious activities or unauthorized changes in infrastructure could lead to data leaks, service disruptions, or additional costs due to the misuse of resources.
Ensure CloudTrail defines an SNS Topic
Ensure CloudTrail defines an SNS Topic
- This policy is important because it ensures that CloudTrail, a web service that records AWS API calls, defines an SNS Topic. This can help in streamlining notifications and ensuring that important alerts related to AWS operations are not missed.
- The policy allows real-time alerts and notifications to be set up through CloudTrail and directly sent to the relevant stakeholder’s devices or emails, improving incident response time and reducing potential downtime.
- Implementing this policy can help in maintaining compliance with various regulatory standards that require the tracking and notifying of certain activities conducted on the cloud infrastructure.
- The Terraform infrastructure as code (IaC) used for implementing this policy makes it repeatable and version controlled, which reduces the risk of human error, contributes to easier auditing, and facilitates the scaling of operations.
Ensure DLM cross region events are encrypted
Ensure DLM cross region events are encrypted
- Ensuring DLM cross region events are encrypted is important for protecting sensitive data during transfer from unauthorized access or data breaches, thereby enhancing data security and privacy.
- This policy can help an organization adhere to stringent compliance regulations such as the GDPR and PCI DSS which mandate that customer data be encrypted during transfer.
- Without this policy, there is a risk of data being intercepted or tampered with during transit, leading to loss of data integrity and potential reputational damage to the organization.
- Implementing this policy via Infrastructure as Code (IaC) using Terraform, allows for scalable, repeatable, and error-free deployment, thereby improving efficiency and reducing potential human error in the security set up.
Ensure DLM cross region events are encrypted with Customer Managed Key
Ensure DLM cross region events are encrypted with Customer Managed Key
- This policy ensures the security of data during transit when DLM cross-region events are transferred between different geographic areas. The use of a Customer Managed Key (CMK) provides a high level of data encryption which considerably reduces the chances of unauthorized data access.
- Enforcing this policy makes AWS DLM Lifecycle policies more secure since the CMKs are under the direct control of the customer. The customization and control provided by CMKs offer a higher level of security as compared to AWS managed keys.
- The policy guards against data breaches and compliance violations that could result from the interception of data during cross region transfer. This can have serious consequences such as reputational damage, financial losses, and legal penalties if sensitive data is compromised.
- By implementing this policy through Infrastructure as Code (IaC) with Terraform, organizations can ensure consistent application of security measures. It helps in maintaining standardized security configurations and simplifies the process of auditing for compliance with security policies.
Ensure DLM cross region schedules are encrypted
Ensure DLM cross region schedules are encrypted
- Ensuring DLM cross-region schedules are encrypted protects sensitive data by making it unreadable to unauthorized users, enhancing the overall security of the system.
- The encryption in transit helps reduce the risk of data leaks, providing a secure environment even when the data is transferred across different regions.
- This policy, when implemented using Terraform, allows security teams to automate the process, reducing the chances of human error and ensuring consistent application of the security rule.
- Non-compliance with this rule could expose an organization to possible regulatory fines or penalties, especially if it deals with sensitive user data.
Ensure DLM cross region schedules are encrypted using a Customer Managed Key
Ensure DLM cross region schedules are encrypted using a Customer Managed Key
- This policy ensures that Data Lifecycle Manager (DLM) cross-region schedules are encrypted with a Customer Managed Key (CMK), which provides additional protection for your data by giving you full control over key management, use, and deletion.
- By encrypting DLM cross region schedules using a Customer Managed Key, it enhances data security by reducing the risk of unauthorized access and inadvertent data exposure that could occur with default or automatically assigned encryption keys.
- The policy contributes to compliance with data protection laws and regulations by employing end-to-end encryption for sensitive data during cross-region transfers, ensuring that data remains confidential and integrity is maintained.
- Incorrect implementation of this policy may lead to compromised data security and potential data breaches, as the encryption key is not within your direct control, which can also increase the difficulty in auditing, tracking, and managing key usage.
Ensure CodeCommit branch changes have at least 2 approvals
Ensure CodeCommit branch changes have at least 2 approvals
- This policy helps ensure that no changes are made to a CodeCommit branch without a thorough review, reducing the risk of introducing vulnerabilities or errors in the codebase. The requirement of at least two approvals before code changes can be merged ensures that more than one pair of eyes have scrutinized the changes, leading to better code quality and security.
- The implementation of this policy guards against a single individual having full control over code changes, fostering a collaborative environment and encouraging teamwork. This approach reduces the chances of rogue or insider threats because a single developer cannot insert malicious code or make significant changes without the knowledge and approval of others.
- Enforcing this policy can also help in maintaining code standards and best practices, as each change will be reviewed by at least two people before it’s accepted. This can lead to better code quality, easier maintenance, and improved system stability.
- By integrating this policy with Terraform’s Infrastructure as Code (IaC) approach, consistency and management of this rule across the infrastructure become efficient and scalable. It helps in automating this best practice across different projects and teams, ensuring a uniform level of code review procedures for all CodeCommit branches.
Ensure that Lambda function URLs AuthType is not None
Ensure that Lambda function URLs AuthType is not None
- Ensuring that Lambda function URLs AuthType is not None secures access to your Lambda functions. Without authentication, unauthorized users may be able to invoke them, leading to potential data leak or misuse of the service.
- Checking that the AuthType property is not set to None in a Lambda function URL ensures compliance with best-practice security configurations, reducing the risk of misconfigurations that could expose your AWS resources.
- Misconfigurations in AWS Lambda functions can lead to unnecessary cost increases due to malicious activities leveraging unsecured access. By enforcing AuthType, the policy helps mitigate this financial risk.
- Implementing this policy in Cloudformation Infrastructure as Code (IaC) allows for easy and consistent creation and management of secure resources across a large-scale deployment, saving time and effort for the security and development teams.
Ensure CloudFront response header policy enforces Strict Transport Security
Ensure CloudFront response header policy enforces Strict Transport Security
- Enforcing Strict Transport Security in CloudFront response header policy prevents man-in-the-middle attacks by ensuring browsers and user’s client always connect to the server using a secure HTTPS connection, even if the application mistakenly redirects to insecure HTTP connections.
- This policy has an impact on data security as it protects sensitive data transmission from being intercepted or tampered with during transit between the client and the server, supporting data privacy, integrity, and confidentiality.
- It reduces the risk of violating regulatory standards and compliance guidelines relating to data security, potentially avoiding legal repercussions, breach of trust, and financial penalties for the organization.
- By applying this policy via Infrastructure as Code (IaC) approach with Terraform, it reinforces DevSecOps principles by integrating security checks into development pipelines, ensuring the policy’s enforcement is automatic, consistent, and less prone to human error.
Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
Ensure no security groups allow ingress from 0.0.0.0:0 to port 80
- This policy helps prevent unauthorized access to services running on port 80, which is commonly used for HTTP traffic, by only allowing identified, trusted sources to connect, instead of allowing any IP address (0.0.0.0/0) to connect. This reduces the attack surface and the risk of a security breach.
- Allowing ingress from 0.0.0.0:0 to port 80 may expose web servers or applications to potential threats such as DDoS attacks, exploits, or brute force attacks. By limiting access, sensitive data transmitted over HTTP can be better protected.
- By enforcing this policy, businesses can adhere to the principle of least privilege, a key cybersecurity principle, that advises limiting access rights for users to the bare minimum permissions they need to perform their work.
- Implementing this rule can also help organizations achieve compliance with cybersecurity standards and regulations which mandate proper cybersecurity hygiene and risk management practices, such as zero-trust network models or secure configuration and management of the network environment.
Ensure HTTP HTTPS Target group defines Healthcheck
Ensure HTTP HTTPS Target group defines Healthcheck
- This policy ensures that load balancer target groups in Naver Cloud Platform (ncloud_lb_target_group) define health checks. Health checks confirm whether the instances under the target group are functioning correctly and are ready to receive incoming traffic.
- Misconfigurations in health checks for load balancer instances could lead to unnecessary traffic routing to unresponsive or slow servers. This policy helps prevent such issues, thus aiding in optimal resource distribution and minimizing response times.
- Implementation of this policy via Infrastructure as Code (IaC) tool like Terraform facilitates efficient, automated, and error-free execution, thus simplifying the management of health checks for a large number of instances.
- Neglecting this policy may lead to undetected failures in the servers, resulting in poor application performance or even complete service unavailability. Therefore, the importance of enabling health checks cannot be overstated for maintaining high availability and flawless user experience.
Ensure Kendra index Server side encryption uses CMK
Ensure Kendra index Server side encryption uses CMK
- Ensuring Kendra index uses Server Side Encryption with CMK (Customer Master Key) provides an additional layer of security by encrypting data at rest, protecting sensitive information from unauthorized access or potential security breaches.
- The policy improves accountability as CMKs provide detailed Key usage logs, helping administrators track who accessed the data, when, and for what purpose, essential for audit trails or investigating suspicious activities.
- By requiring the use of a CMK, the policy adds an ability to manage and control the encryption keys independently, including the power of key rotation, providing fine-grained control over data encryption and decryption.
- Non-compliance with this policy could lead to compliance issues in organizations that need to adhere to strict data protection regulations such as HIPAA, GDPR, which require encrypted data at rest, resulting in potential hefty fines and reputational damage.
Ensure AppFlow flow uses CMK
Ensure AppFlow flow uses CMK
- This policy ensures the use of Customer Master Key (CMK) in the AppFlow flow, enhancing data security by encrypting the data with a key that is under the customer’s direct control.
- By complying with this policy, organizations demonstrate adherence to industry best practices of managing sensitive information, thereby increasing trust with clients, stakeholders, and regulators.
- Non-compliance can lead to potential risks of unauthorized data access as default keys may be less secure or could be compromised, putting sensitive business information at risk.
- Using Terraform Infrastructure as Code (IaC) to implement this policy allows for automated and repeatable deployments, increasing efficiency and reducing the margin for human error.
Ensure AppFlow connector profile uses CMK
Ensure AppFlow connector profile uses CMK
- Ensuring the AppFlow connector profile uses a Customer Managed Key (CMK) boosts your data privacy as the data encryption process remains under control of the customer, not AWS.
- With the customer controlling the key lifecycle and management operations, full autonomy of the encryption procedure is ensured, which protects sensitive data in transit from suspicious activities or unauthenticated access.
- Utilizing CMKs supports auditing and compliance requirements, because you can control, log, and continuously monitor who is using the keys and when, and trace back any unauthorized activity.
- If the AppFlow connector profile does not use CMK, it will use AWS managed keys by default, which has limitations like enforced rotation policy by AWS, no custom key store, and no import of key material, diminishing control and flexibility, thus the CMK policy is critical for effective security management.
Ensure Keyspaces Table uses CMK
Ensure Keyspaces Table uses CMK
- The policy ensures that all data at rest within Amazon Keyspaces table is encrypted at the application level using Amazon Web Services’ dedicated Key Management Service (AWS KMS), providing an additional layer of security.
- Enforcing Keyspaces tables to use CMKs provides enhanced security and compliance posture since it introduces control over who can use the key to access or modify data, thus offering better access control mechanisms.
- If the policy is not followed, sensitive information stored in the Keyspaces tables could potentially be read or stolen by unauthorized individuals, leading to a possible data breach.
- This policy constraint also brings potential financial implications as AWS charges for CMK usage. Thus, efficiently managing and using CMKs can significantly impact cloud operating costs.
Ensure DB Snapshot copy uses CMK
Ensure DB Snapshot copy uses CMK
- Ensuring DB Snapshot copy uses Customer Master Key (CMK) enhances data security by encrypting the data at rest. It generates and controls the cryptographic key used to encrypt the snapshot data, reducing the threat of unauthorized access or loss of information.
- Utilizing CMK for DB Snapshot copies allows for better control and management of the encryption keys. This is crucial for maintaining high security standards, regulatory compliance, and managing access to sensitive data within the AWS environment.
- Assigning a CMK to DB Snapshot copies can aid in tracking and auditing. Every use of the CMK can be logged in CloudTrail, thus improving transparency and oversight over data access and modifications.
- This policy impacts the confidentiality and integrity of data. By enforcing CMK use for DB Snapshot copies, it can prevent unauthorized access and data tampering, thereby protecting critical information, maintaining trust with stakeholders and customers, and avoiding potential legal liabilities.
Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK)
Ensure that Comprehend Entity Recognizer's model is encrypted by KMS using a customer managed Key (CMK)
- Ensuring that Comprehend Entity Recognizer’s model is encrypted by KMS using a customer managed Key (CMK) aids in enhancing data privacy and security. This policy prevents unauthorized access and exploitation of the Entity Recognizer data that could negatively harm both the operation and reputation of the organization.
- Implementing this policy allows for better control and management of encryption keys. With a customer-managed key, there is the ability to rotate, disable, and establish fine-grained access permissions; this level of key management is more secure than allowing AWS to handle encryption key management.
- Utilizing a customer-managed key (CMK) brings better compliance with industry standards and regulations. Several security standards necessitate the use of encryption at rest and managing your own keys can serve as an important piece of evidence in achieving regulatory compliance.
- Non-compliance to this policy might lead to vulnerabilities in the Infra security model, risking exposure of sensitive data processed by the Comprehend Entity Recognizer. Such vulnerabilities could result in severe impact including financial loss, damage to the entity’s reputation, and even possible legal repercussions.
Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK)
Ensure that Comprehend Entity Recognizer's volume is encrypted by KMS using a customer managed Key (CMK)
- Encrypting the Comprehend Entity Recognizer’s volume with a customer managed Key (CMK) enhances data security by ensuring that the data is unreadable without the decryption key, minimizing the risk of unauthorized access.
- This security policy empowers the customer to manage their own encryption keys. They can enforce key rotation policies, track the use of keys and even disable them at their own discretion, thus offering enhanced control over data security.
- In case of a security breach or unauthorized access attempt, the data stored in the Comprehend Entity Recognizer’s volume remains safe and inaccessible to malicious actors given it is encrypted with a customer managed encryption key.
- Non-compliance with this policy could lead to sensitive data being stored in an unencrypted form on the Recognizer’s volume, making it vulnerable to theft and misuse. This could potentially result in significant financial and reputational damages.
Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK
Ensure Connect Instance Kinesis Video Stream Storage Config uses CMK
- This policy ensures that the storage used for streaming video through Kinesis on AWS Connect instances is properly encrypted using a Customer Master Key (CMK), adding an extra layer of security to protect sensitive data from unauthorized access.
- By enforcing CMK usage, the policy allows for greater control over the cryptographic keys, as AWS clients can choose to have AWS manage keys on their behalf, or manage keys on their own both in AWS Key Management Service and on-premises.
- Implementing the policy in Terraform ensures consistent and automated deployment, reducing human error and streamlining operations within a secure environment, thereby facilitating compliance with security best practices and standards.
- Non-compliance with this policy could potentially expose sensitive video data to cyberthreats, leading to data breaches and non-compliance with regulatory requirements, which may result in significant financial and reputational damage for the organization.
Ensure Connect Instance S3 Storage Config uses CMK
Ensure Connect Instance S3 Storage Config uses CMK
- This policy ensures the use of a Customer Master Key (CMK) for the S3 storage configuration of a Connect Instance, which enhances the data protection by adding an extra layer of security requiring the use of a CMK.
- The use of a CMK provides control over who can use the encryption keys, adding an additional safeguard to prevent unauthorized access to the data stored on the S3 storage of the Connect Instance.
- Not following this policy leaves the data in the Connect Instance S3 Storage vulnerable to breaches and unauthorized access, potentially causing data loss, compromising the integrity of the data, and breaching of regulatory compliances.
- An advantage of this policy is the ability for the owner to define who can use and manage keys, allowing for a highly customized access control list. This not only improves security but also fulfills compliance requirements that demand strict control over access to sensitive data.
Ensure DynamoDB table replica KMS encryption uses CMK
Ensure DynamoDB table replica KMS encryption uses CMK
- This policy ensures that each table replica in DynamoDB uses Customer Managed Key (CMK) for encryption, thus providing the user with full control and ability to manage their own cryptographic keys.
- Implementing this policy can prevent unauthorized access to the data in table replicas because the data is automatically encrypted at rest. This encryption applies to the backups of that table and its streams, greatly enhancing data security.
- By using a CMK, service offers increased safety measures such as key rotation and detailed audit trails via AWS CloudTrail, allowing for the tracking and verification of key usage to satisfy organizational governance and compliance requirements.
- Violation of this policy would mean that Amazon Managed Key (AMK), instead of Customer Managed Key, is used for encryption. This might make the data in the table replicas more susceptible to threats as user has less control and insight over the encryption process.
Ensure AWS Lambda function is configured to validate code-signing
Ensure AWS Lambda function is configured to validate code-signing
- Ensuring AWS Lambda function is configured to validate code-signing helps to establish trust on the code that is running on the Lambda function, as it verifies that the code has not been tampered with since it was signed.
- This policy reduces the risk of executing malicious code or unauthorized changes on the Lambda function, thus, it greatly enhances the security stance of the infrastructure.
- Without this policy in place, the lack of code-signing validation could potentially lead to security breaches, data loss, or service interruption, which can subsequently cause reputational damage and financial losses.
- By applying this policy using Infrastructure as Code (IaC) tool such as Terraform, security can be integrated early in the development cycle and enforced consistently across multiple AWS Lambda functions, reducing human errors and implementation inconsistencies.
Ensure access is controlled through SSO and not AWS IAM defined users
Ensure access is controlled through SSO and not AWS IAM defined users
- This policy ensures a centralized and simplified approach to identity management. Using Single Sign-On (SSO) eliminates the complexity of managing multiple AWS IAM users and their individual permissions, instead managing all access through a single authentication platform.
- Ensuring access through SSO and not AWS IAM users strengthens security. Individual IAM users are a potential weak link as they each require their own set of credentials, which increases the risk of accidental or malicious exposure, while SSO uses a single set of credentials reducing this risk.
- The policy fosters regulatory compliance and auditability. Monitoring access through SSO makes it easier to trace actions back to individual users and provide definitive proof of who did what, which is essential when dealing with sensitive information.
- Implementation of this policy through Infrastructure as Code (IaC) using Terraform ensures consistent application of the policy. Any new resources created will automatically adhere to the security policy, limiting chances of human error or intentional bypassing of the set rules.
Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
Disallow IAM roles, users, and groups from using the AWS AdministratorAccess policy
- This security policy is important as it restricts the use of the AWS AdministratorAccess policy to IAM roles, users, and groups. This limits the access and control over AWS resources, thus minimizing the risk of unauthorized or destructive actions by reducing the attack surface.
- By enforcing this policy, you can implement the principle of least privilege. This practice states that a user should have the minimal levels of access – or permissions – to perform his/her job functions. This prevents potential misuse of excessive permissions.
- The policy reduces the risk of a single point of compromise by not letting any specific IAM user, group, or role have complete admin access. If one account is compromised, the impact is limited because the attacker does not automatically gain full control of the entire AWS environment.
- This policy impacts organizational security by holding individual users accountable for their actions with clearly defined permissions and roles. This allows for better monitoring and auditability of activities, thereby improving the ability to detect abnormal or suspicious behavior promptly.
Disallow policies from using the AWS AdministratorAccess policy
Disallow policies from using the AWS AdministratorAccess policy
- The policy ensures restricted access to AWS services as granting AdministratorAccess can lead to an over-privilege scenario, where a user, group, or role receives more access than necessary, posing a significant security risk.
- It helps maintain the principle of least privilege (PoLP), which is crucial because minimizing the potential impact of credential compromise can help protect information and systems from unauthorized use, data loss, or malicious activities.
- This policy mitigates risk as attaching the AWS AdministratorAccess policy effectively provides full permissions to all AWS services and resources, potentially enabling accidental alterations or deletions in the infrastructure, ultimately affecting service integrity and reliability.
- Furthermore, it reinforces accountability and auditing requirements, as access rights and activities can be traced back to individual users or services. Without this limitation, tracking unauthorized or malicious activities becomes complicated, hindering incident response and forensic investigations.
Ensure Data Trace is not enabled in API Gateway Method Settings
Ensure Data Trace is not enabled in API Gateway Method Settings
- The policy ensures that sensitive data isn’t inadvertently exposed. Enabling Data Trace in the API Gateway Method Settings could allow full visibility of request and response data while debugging your APIs, which might expose sensitive information.
- The policy helps to maintain compliance with data protection regulations. In an environment where API Gateway data trace is enabled, sensitive information may be logged and visible, which could be a violation of laws such as GDPR or HIPAA.
- It reduces the risk of a potential security breach. If a malicious actor accessed the API Gateway logs, they might be able to exploit any sensitive data found within the logged data.
- The policy indirectly contributes to controlling costs. Since AWS charges for logging, reducing unnecessary logs by disabling data tracing can contribute to cost optimization of your cloud infrastructure.
Ensure no security groups allow ingress from 0.0.0.0:0 to port -1
Ensure no security groups allow ingress from 0.0.0.0:0 to port -1
- This policy plays a crucial role in preventing unauthorized or unrestricted access to the VPC resources. By ensuring no security groups allow ingress from all IP addresses (0.0.0.0/0) to port -1, attack surface can be significantly reduced.
- Permitting ingress from 0.0.0.0:0 to port -1 implies that any machine, regardless of its IP address, can access and use the resources inside the security group. Preventing this strict rule ensures data integrity and confidentiality by limiting the potential exposure to the malicious entity.
- Following this policy is essential for compliance with best practices and various regulatory standards, such as ISO 27001, PCI-DSS, HIPAA etc., which demand stringent network access controls to guard sensitive data.
- The policy also indirectly aids in improved system performance and availability as it can prevent DDOS attacks or heavy network traffic from untrusted sources that strain the system resources by consuming bandwidth.
Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK)
Ensure MemoryDB snapshot is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures that snapshots taken from a MemoryDB in AWS are encrypted using a customer managed key, adding an extra layer of security to protect sensitive data from unauthorized access.
- It maintains data integrity by requiring encryption which further prevents potentially sensitive information from being manipulated, ensuring that the data remains accurate and consistent.
- Non-compliance with this policy can lead to violations of data privacy laws or industry-specific regulations, which can result in significant penalties for the organization, hence enforcing it is crucial.
- The rule helps in the event of an audit as it demonstrates the organization’s commitment towards maintaining high security standards, by practicing encryption and key management for sensitive data stored in MemoryDB snapshots.
Ensure Neptune snapshot is securely encrypted
Ensure Neptune snapshot is securely encrypted
- This policy is important because it ensures that the Neptune snapshot data is encrypted, adding an extra level of security to protect sensitive information from unauthorized access and potential cyber threats.
- The policy’s implementation in Terraform suggests that Infrastructure as Code (IaC) method is being used, which can help maintain consistency and replicability in enforcing encryption across multiple environments, improving overall infrastructure security.
- As it targets the ‘aws_neptune_cluster_snapshot’ resource, the policy directly impacts the security measures around storing and restoring data in AWS Neptune, a fully managed graph database service. This has implications for applications that rely on this service for querying graph data.
- A breach in this resource’s data security could result in significant financial and operational damage, including loss of customer trust, regulatory fines or sanctions, thus the importance of this security policy.
Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK)
Ensure Neptune snapshot is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures enhanced security around Neptune data snapshots by enforcing them to be encrypted with a customer managed Key (CMK). This takes data protection to a higher level than using default AWS managed keys.
- As the management of the CMK lies with the customer, they can apply fine-grained control over access to the encrypted data. This means the customer can decide who can use the key to decrypt and access the sensitive data.
- It also impacts the disaster recovery strategy. In case of a disaster or accidental data loss, the encrypted backups ensure that the data can be safely restored without compromising security.
- Compliance may be another critical aspect enhanced by this policy. Some regulations require sensitive data to be encrypted. Using a CMK ensures the snapshots are encrypted and can help the organization meet such compliance requirements.
Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK)
Ensure RedShift snapshot copy is encrypted by KMS using a customer managed Key (CMK)
- Encryption via a customer managed key (CMK) ensures that sensitive data backups in RedShift snapshot copies are secure and protected from unauthorized access.
- Utilizing KMS with a CMK allows for higher end-user control, including the ability to customize policies and manage cryptographic operations to suit specific security needs.
- Using encrypted snapshot copies prevents potential data breaches and maintains data integrity by shielding them from inadvertent exposures or losses.
- This policy rule enforces best practice for data protection in line with regulatory compliances, safeguards business reputation, and may prevent potential legal and financial repercussions linked to data breach incidents.
Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK)
Ensure that Redshift Serverless namespace is encrypted by KMS using a customer managed key (CMK)
- The policy ensures that the data stored in Redshift Serverless environment is encrypted and safe from unauthorized access. Without encryption, the data could be at risk of compromise, resulting in substantial financial losses, brand damage, and legal liabilities.
- Encryption using a customer-managed key (CMK) provides an additional layer of control and security. The CMK allows key owners to limit who can use and manage the keys, reducing the chance of insider threat abuse and enhancing data privacy.
- The policy also helps in compliance with specific industry regulations and standards, such as GDPR or HIPAA that mandate encryption of sensitive data, thus avoiding potential regulatory penalties and non-compliance costs.
- Without this policy, there might be inconsistencies in data protection across the infrastructure, leading to potential data breaches. In contrast, it enforces encryption on all Redshift Serverless namespaces uniformly, ensuring a consistent encryption standard across the organization.
Ensure no IAM policies documents allow ALL or any AWS principal permissions to the resource
Ensure no IAM policies documents allow ALL or any AWS principal permissions to the resource
- Ensuring no Identity and Access Management (IAM) policies allow ALL AWS principal permissions to the resource helps prevent unauthorized access to your AWS services and resources, decreasing the risk of potential data breaches or data loss.
- Using this policy can prevent potential misconfigurations that may inherently introduce vulnerabilities, which can be exploited by malicious actors to gain unauthorized control over infrastructure, resulting in security incidents.
- Restricting permissive IAM policies enhances the application of the principle of least privilege (POLP), where users only have the absolute minimum permissions necessary to perform their tasks. This reduces the avenues through which an intruder can gain access to sensitive data or resources.
- Limiting IAM principal permissions can contribute to maintaining regulatory compliance, as required by standards like GDPR or HIPAA, by ensuring there are no ‘open’ permissions that can expose sensitive data to unauthorized entities.
Ensure State Machine has X-Ray tracing enabled
Ensure State Machine has X-Ray tracing enabled
- Enabling X-Ray tracing on State Machine ensures detailed visibility and insights into the behavior of the state machine executions, enabling problem detection and troubleshooting.
- The rule helps detect any performance bottlenecks and latency issues, thereby maintaining the efficiency and reliability of the AWS Step Functions.
- This policy guarantees adequate monitoring, ensuring security vulnerabilities and potential anomalistic behaviors in the State Machine execution are detected in good time.
- Complying with the rule allows for easier audit trails and history of events, demonstrating adherence to security best practices and regulations. This can be crucial for organizations that need to prove regulatory compliance.
Ensure State Machine has execution history logging enabled
Ensure State Machine has execution history logging enabled
- Enabling execution history logging for the State Machine in an AWS SFN (AWS Step Functions) state machine provides a detailed audit trail. This allows teams to track and analyze each transition or state the application was in, making it easier to debug and understand the application behavior.
- This policy helps organizations maintain compliance with various regulations and standards that require detailed logging of access and operations on critical resources. Without it, an organization could be at risk of falling out of compliance.
- The AWS SFN State Machine would be highly susceptible to unidentified security breaches or malfunctions without execution history logging. Logging would help to recognize any unauthorized activities, changes or errors that occur within the system and rectify them in a timely manner.
- By using Terraform as Infrastructure as Code (IaC), the policy ensures consistent and repeatable configurations across different environments. This reduces the likelihood of human error when configuring logging settings and supports the principle of infrastructure immutability.
Ensure IAM policies does not allow permissions management / resource exposure without constraints
Ensure IAM policies does not allow permissions management / resource exposure without constraints
- This policy prevents unrestricted permission management in IAM, which could lead to compromised security if permissions are incorrectly configured or maliciously altered, exposing sensitive resources and data to unauthorized access.
- By ensuring restrictions on IAM policies, the policy enforces the least privilege principle - that is, that each user or role should have precisely the permissions they need to perform their tasks, no more, no less, helping significantly reduce the attack surface.
- Implementation in Terraform means that this policy can be easily integrated into the infrastructure as code (IaC), providing automated checks and balances to enforce policy compliance and allowing to identify potential permission issues in development, before deployment.
- Applying this policy to resources such as aws_iam_group_policy, aws_iam_policy, aws_iam_role_policy, aws_iam_user_policy, and aws_ssoadmin_permission_set_inline_policy ensures that it covers a wide range of scenarios and entities within an AWS environment, improving overall infrastructure security.
Ensure MSK nodes are private
Ensure MSK nodes are private
- Ensuring MSK nodes are private enhances data security by reducing exposure to the public internet, thereby minimizing the risk of unauthorized data access or hacking attempts.
- Private MSK nodes ensure that all network traffics occur within the secure perimeters of AWS VPC, providing enterprises the ability to monitor, control, and track this internal data traffic without concerns of external threats.
- Non-compliance with the policy can lead to potential data breaches, impacting an organization’s reputation, incurring financial losses, and possibly resulting in regulatory infringements for certain sectors.
- The policy guarantees better compliance with various data protection regulations by ensuring all data handling and storage on MSK nodes remain undisclosed, making it an essential part of an organization’s broader data governance strategy.
Ensure DocumentDB Global Cluster is encrypted at rest (default is unencrypted)
Ensure DocumentDB Global Cluster is encrypted at rest (default is unencrypted)
- This policy prevents unauthorized data access by encrypting data at rest in your DocumentDB Global Cluster. Without encryption, sensitive data might be exposed if infrastructure is compromised.
- Encryption at rest makes it challenging for attackers to access raw data even if they gain physical access to storage. Hence this policy reduces the data vulnerability to theft or exposure.
- Unencrypted data violates various industry regulations and compliance requirements. Enforcing this policy ensures compliance with these standards, such as GDPR and HIPAA, thus protecting the organization from possible legal implications.
- Implementing this policy using the Terraform script shared in the provided resource link adds an additional layer of security to your AWS DocumentDB Global Cluster infrastructure setup, ensuring standard and uniform security protocol enforcement on your infrastructure as code deployments.
Ensure that AWS database instances have deletion protection enabled
Ensure that AWS database instances have deletion protection enabled
- Enabling deletion protection for AWS database instances ensures that the databases cannot be accidentally deleted, providing an additional layer of security for business-critical data.
- This policy protects databases from potential disruptions caused by accidental or malicious deletion, which can lead to significant data loss and associated downtime for the business operations.
- In an Infrastructure as Code (IaC) context using Terraform, the enforcement of this policy ensures that deletion protection is consistently applied across all database instances, reducing the risk of human error during configuration.
- The implementation using Checkov terraform enables continuous compliance checks, automating the process of monitoring and mitigating risks associated with deletion of AWS database instance, boosting overall database reliability and data integrity.
Ensure CloudTrail Event Data Store uses CMK
Ensure CloudTrail Event Data Store uses CMK
- Ensuring CloudTrail Event Data Store uses a Customer Master Key (CMK) enhances data privacy and protection, providing an extra layer of security by enabling you to control who can access and decrypt your data.
- By making sure that the CloudTrail Event Data Store uses a CMK, you can ensure compliance with certain information security standards, such as PCI DSS and HIPAA that require encryption of sensitive data at rest.
- The policy provides a means to conduct key management operations (like key rotation, deletion, and policy modification) which further strengthen the security stance of the infrastructure, while giving visibility and control over the cryptographic operations performed by the AWS CloudTrail Event Data Store.
- The rule helps to migrate the risk related to key compromise, where if a data encryption key is exposed, a malicious entity would still need the CMK to decrypt the data, and this key management is thoroughly managed and logged via AWS KMS to provide an additional layer of security.
Ensure DataSync Location Object Storage doesn't expose secrets
Ensure DataSync Location Object Storage doesn't expose secrets
- This policy is important because it prevents sensitive information, or ‘secrets,’ from being accidentally exposed by the DataSync Location Object Storage configuration. Secrets could include passwords, tokens, or encryption keys that should not be publicly available.
- If secrets are exposed, it could lead to a significant security breach wherein malicious actors gain unauthorized access to critical systems or data, potentially costing the business financially and damaging its reputation.
- The policy’s implementation in Terraform code, as specified in the resource implementation link, provides a proactive and automated way of checking and ensuring any newly provisioned AWS DataSync object storage follows this security best practice.
- Compliance with this policy not only helps in maintaining the security of data being transferred through DataSync but also acts in line with regulations and standards related to data protection and privacy, such as GDPR and HIPAA.
Ensure DMS endpoint uses Customer Managed Key (CMK)
Ensure DMS endpoint uses Customer Managed Key (CMK)
- Ensuring DMS endpoints utilize Customer Managed Keys (CMKs) helps provide an additional layer of data protection. Rather than relying on default AWS managed keys, custom CMKs enable the user to have full control over their keys.
- This policy allows organizations to meet compliance requirements for data security and privacy. Many industry standards and regulations mandate the use of encryption in transit and at rest, which can be achieved with the help of customer-managed keys.
- By applying this rule, it minimizes the risk of data breaches as the encryption keys are managed by the organization itself. It has the capability to choose when to rotate, delete, or revoke access to the encryption keys.
- The implementation of this policy contributes to the principle of least privilege. It restricts AWS DMS endpoints from having unnecessary permissions since every decryption is tightly controlled by the key policy and the grants connected with the CMK.
Ensure EventBridge Scheduler Schedule uses Customer Managed Key (CMK)
Ensure EventBridge Scheduler Schedule uses Customer Managed Key (CMK)
- This policy ensures that scheduled tasks or events in AWS EventBridge are encrypted with a Customer Managed Key (CMK), offering a stronger control over key management and thus improving the security of data compared to using AWS-managed keys.
- Encrypting scheduled events with a CMK, which is controlled by the user rather than AWS, gives the user an additional layer of administrative control, allowing them to have a greater visibility and auditability over who can use the key, increasing data safety.
- The policy helps to meet compliance requirements by allowing companies to manage their own encryption keys in AWS, which is often a requirement for certifications like ISO 27001, HIPAA, and PCI DSS.
- Non-compliance to this policy may lead to exposure of sensitive event data to unauthorized individuals, increasing potential for security breaches, data manipulation, and overall harm to the information integrity.
Ensure DMS S3 uses Customer Managed Key (CMK)
Ensure DMS S3 uses Customer Managed Key (CMK)
- This policy ensures data at rest is protected by reinforcing encryption with CMK (Customer Managed Key) on DMS (Data Migration Service) S3 endpoints, adding an extra layer of security to your data stored in AWS.
- CMK provides granular control over access, usage, and rotation of the encryption keys, thereby limiting exposure to potential unauthorized data access while improving regulatory compliance.
- It bolsters security posture by reducing the risk of data breaches, as only approved users can decrypt the data that has been encrypted with a CMK thereby preventing unauthorized access.
- Failure to implement this policy could result in regulatory compliance issues, potential data loss or exposure, and potential financial and reputational damage if there is a data breach due to poor key management.
Ensure S3 lifecycle configuration sets period for aborting failed uploads
Ensure S3 lifecycle configuration sets period for aborting failed uploads
- This policy ensures that failed uploads to S3 buckets are automatically aborted after a specified time period, mitigating the risk of accumulating incomplete or corrupted data which could negatively impact system performance and increase storage cost.
- The policy helps uphold necessary compliance standards related to data management and integrity. Compliance to such standards is often a pre-requisite for businesses operating in regulated sectors or dealing with sensitive data.
- By automating the process of aborting failed uploads, this policy indirectly supports resource optimization. It prevents wastage of computational power and bandwidth that might otherwise be used to retry or manage failed uploads.
- Implementing this policy through Infrastructure as Code (IaC) using Terraform ensures that this important security setting is consistently applied across all S3 buckets. It reduces the risk of human error often associated with manual configurations, thereby enhancing overall operational reliability.
Ensure that AWS Lambda function is not publicly accessible
Ensure that AWS Lambda function is not publicly accessible
- Ensuring AWS Lambda functions are not publicly accessible helps prevent unauthorized access to resources and data, strengthening the overall security of the cloud infrastructure.
- Blocking public access to Lambda functions minimizes the risk of potential DDoS attacks and other security threats that could degrade or disrupt the operation of the function and related services.
- Limiting Lambda function access to only known and trusted sources allows for better control and monitoring of requests, potentially improving debugging and accountability for actions performed in AWS.
- Compliance with this policy helps organizations adhere to best practices for data privacy and protection, potentially aiding in regulatory compliance for industries like healthcare or finance that have strict data handling requirements.
Ensure DB Snapshots are not Public
Ensure DB Snapshots are not Public
- Ensuring DB snapshots are not public is essential for preventing unauthorized access to your sensitive data. When snapshot settings are set to public, anyone can view and potentially manipulate your snapshot content.
- Leaving DB snapshots public can result in data breaches and loss of critical information. Attackers can target public snapshots to discover weak areas in your security infrastructure, exploit it, access data, or disrupt services.
- Following this policy ensures compliance with data protection laws and industry regulations that require certain types of data to be stored privately. Non-compliance might result in legal penalties or damage to the organization’s reputation.
- The policy enables the use of the Infrastructure as Code (IaC) security best practice. Using IaC tool like Terraform to automate the security settings of AWS DB snapshots reduces human error and guarantees that the snapshots are not accidentally left public.
Ensure SSM documents are not Public
Ensure SSM documents are not Public
- This policy ensures that Systems Manager (SSM) documents, which often contain sensitive data such as system configurations and operational scripts, are not public and can only be accessed by authorized users or services, thereby enhancing the security of AWS resources.
- By ensuring SSM documents are private, it prevents unauthorized access or potential malicious activities such as changes to configurations, script injections, or data exfiltration that could occur if the documents were public.
- Enforcing this policy mitigates the risk of exposure of sensitive information that could lead to security breaches, compliance violations, and potential financial and reputational damage to entities.
- Using Infrastructure as Code (IaC) automation with Terraform, the policy makes it easier to manage, enforce, and maintain secure configurations across multiple resources, thereby ensuring consistency and reducing the possibility of human error.
Ensure Secrets Manager secrets should be rotated within 90 days
Ensure Secrets Manager secrets should be rotated within 90 days
- Regular rotation of secrets within 90 days in AWS Secrets Manager increases overall security, reducing the risk of a cybercriminal gaining unauthorized access to sensitive data if a secret or password is compromised.
- Enforcing this policy ensures that potential breaches can be contained within a limited timeframe, minimizing the damage caused by potentially leaked secrets.
- By managing this automation through Terraform, organizations can ensure consistent implementation across all systems and services, reducing the risk of human error and ensuring compliance with security best practices.
- Non-compliance with this policy can lead to outdated secrets being easily cracked or guessed, increasing vulnerability to attacks and possibly causing damage to brand reputation, regulatory fines, and loss of customer trust.
Ensure CloudFront distribution has a default root object configured
Ensure CloudFront distribution has a default root object configured
- Ensuring a default root object is configured for a CloudFront distribution prevents users from being able to view a list of the files in the bucket when they access the bucket’s root URL. This contributes to maintaining the privacy and security of stored data.
- This policy directly impacts the website’s user experience as any user accessing the website without specifying a file path will be directed to the default root object. Hence, it helps to prevent users from encountering an unnecessary error page.
- Not having a default root object in CloudFront distribution can indirectly lead to higher costs as unnecessary resources may be used when the index page has to fetch object lists frequently.
- This policy has a profound impact on the incident mitigation process, if a cyber security incident occurs. Having a default root object configured can limit the attack surface and potentially reduce the impact of a security breach.
Ensure SageMaker notebook instances should be launched into a custom VPC
Ensure SageMaker notebook instances should be launched into a custom VPC
- Ensuring SageMaker notebook instances are launched into a custom VPC increases security as it allows more control over network traffic: access can be restricted to resources within the VPC, protocols, ports, and IP address ranges can be customized, reducing the likelihood of unauthorized or harmful traffic.
- Using custom VPCs with SageMaker notebook instances provides improved privacy that may be required for compliance standards. Network traffic isolation ensures sensitive data within the instances are not exposed to the internet, reducing data leakage or privacy risks.
- Operating SageMaker Notebook instances in a custom VPC establishes clear boundaries for resources both for management and security purposes. It simplifies tracking, allocating, and protecting the resources used which assists in accurate cost-tracking, issues diagnosis, and mitigation strategies.
- Launching SageMaker notebook instances into a custom VPC enhances disaster recovery plans. In scenarios like service interruption or failure, resources within a VPC can be replicated in another Availability Zone to ensure no loss of service, which would not be possible if instances are directly in the default VPC.
Ensure SageMaker Users should not have root access to SageMaker notebook instances
Ensure SageMaker Users should not have root access to SageMaker notebook instances
- This policy prevents SageMaker users from obtaining root access which can potentially make it easier to embed malicious code or undesired actions within SageMaker notebooks, decreasing risk of internal attacks or sabotage.
- Constricting root access is crucial for maintaining the integrity of the Notebook instance. With root access, users could potentially modify critical system files or configurations, disrupting or damaging the SageMaker Notebook instance.
- Unchecked root access is a major compliance violation for certain industries or infrastructures with tight regulation standards, so this policy helps entities comply with regulatory requirements and maintain good security governance.
- Limiting root access also helps in reducing the blast radius in case of any security incident, effectively minimizing overall impact on the entire AWS infrastructure.
Ensure API Gateway method setting caching is set to encrypted
Ensure API Gateway method setting caching is set to encrypted
- This policy ensures that data cached in the API Gateway method setting is encrypted, thereby heightening the security for any sensitive data that might be stored in the cache. Without this policy, cached data could be vulnerable to unauthorized access or data leaks.
- Applying this policy can make compliance with various regulatory standards and guidelines – such as GDPR, HIPAA, and PCI DSS – easier and more straightforward due to their stringent requirements about the protection and encryption of data.
- By adopting this policy and enforcing the encryption of cache data, any potential cyber attack aimed at retrieving data from cache can be substantially mitigated, hence reducing the potential damage that could be caused by such attacks.
- This policy integrates with Infrastructure as Code (IaC) through the use of Terraform. This allows for the automation of security checks and makes it possible to efficiently manage, version, audit, and replicate secure configurations across numerous infrastructure deployments.
Ensure API GatewayV2 routes specify an authorization type
Ensure API GatewayV2 routes specify an authorization type
Ensure CloudFront distributions should have origin failover configured
Ensure CloudFront distributions should have origin failover configured
- Ensuring CloudFront distributions have origin failover configured reduces the risk of service interruption. If the primary origin becomes unavailable, requests are automatically served from a designated secondary origin, maintaining service continuity.
- Implementing this policy cultivates system resilience. In an event where the primary origin underperforms or encounters errors, traffic is seamlessly redirected to a secondary origin, preventing potential downtime and loss of data.
- Setting up origin failover in CloudFront can save costs. Preventing service outages helps minimize financial loss associated with downtime and enhances customer trust and satisfaction.
- Not having origin failover configured exposes the AWS CloudFront distribution to single points of failure, which could lead to disruptions in service availability or even complete halt of services if the origin server encounters issues. With this rule enforced, such risks are mitigated.
Ensure that CodeBuild S3 logs are encrypted
Ensure that CodeBuild S3 logs are encrypted
- Ensuring that CodeBuild S3 logs are encrypted provides an additional layer of security, reducing the risk of sensitive data being accessed by unauthorized individuals.
- Encryption of logs enables organizations to meet compliance requirements related to data protection and privacy, such as GDPR and HIPAA.
- An unencrypted log could potentially expose information about system vulnerabilities, application errors, or user behaviors that could be exploited by malicious actors.
- Implementing the policy of encrypting logs aids in building a robust security infrastructure, enhancing the overall security posture of the organization by mitigating potential data breaches.
Ensure Elastic Beanstalk environments have enhanced health reporting enabled
Ensure Elastic Beanstalk environments have enhanced health reporting enabled
- Enhanced health reporting provides in-depth, real-time analytics on the operational status of application environments, assisting in identifying issues and troubleshooting more efficiently. Thus, not enabling it may lead to prolonged periods of system downtime due to slow problem detection.
- Continuous monitoring and reporting of the various parameters related to application health, including metrics from the hosts (like CPU utilization, memory usage) and the application itself (like latency, request count), may identify potential issues before they impact service availability, thereby helping maintain high application availability.
- Elastic Beanstalk enables automated conditions and events alerting with enhanced health reporting. If not enabled, administrators could miss critical alerts about system failures or performance degradation, leading to potential impact on business continuity.
- Monitoring with enhanced health reporting enabled helps in performance tuning and capacity planning by providing insights into resource usage patterns. Lack of such data could lead to inefficient resource allocation and increased costs.
Ensure RDS cluster configured to copy tags to snapshots
Ensure RDS cluster configured to copy tags to snapshots
Ensure CodeBuild project environments have a logging configuration
Ensure CodeBuild project environments have a logging configuration
- This policy ensures that all activities performed within the CodeBuild environment are logged and monitored, increasing the ability to track changes, modifications or unauthorized access attempts, which is crucial in incident response and forensic investigations.
- It helps in maintaining regulatory and compliance requirements, as some industry regulations and standards mandate the logging of all activities performed in the CodeBuild environment. Without such logging configurations, an organization might face penalties or fail audits.
- The policy makes it easier to troubleshoot and diagnose application issues or system failures. Logging configuration provides a detailed narrative of what the system has been doing, which can be invaluable in understanding and addressing problems.
- It guarantees that potential security breaches or discrepancies are timely noted, making it easier to quickly react and take necessary countermeasures. Without a proper logging configuration, threats might remain unnoticed for longer periods, dramatically increasing potential damage.
Ensure EC2 Auto Scaling groups use EC2 launch templates
Ensure EC2 Auto Scaling groups use EC2 launch templates
- The policy ensures a standardization of EC2 instance launch configurations using templates across auto scaling groups, which helps to maintain consistency and reduces the chances of manual errors when configuring individual instances.
- Auto Scaling groups’ dependence on EC2 launch templates allows the implementation of a more secure infrastructure by setting security groups, encryption, and other important parameters upfront for all instances.
- Using EC2 launch templates as part of auto-scaling can ensure every new instance is provisioned with the latest security patches and configurations, resulting in improved security of autoscaling groups.
- EC2 Auto Scaling with launch templates makes update management easier and more efficient because any changes made to the template will automatically apply to new instances launched in the Auto Scaling group, ensuring up-to-date configurations and reducing vulnerabilities.
Ensure CodeBuild project environments do not have privileged mode enabled
Ensure CodeBuild project environments do not have privileged mode enabled
- Enabling privileged mode in CodeBuild projects allows containers access to host resources, potentially enabling malicious activities such as privilege escalation or information exposure. Therefore, disabling this setting is important to restrict containers’ access to necessary resources only, thus improving the security posture.
- CodeBuild projects with privileged mode enabled could inadvertently allow someone to execute commands with root-level access, enabling unauthorized changes to the infrastructure or data. So by enforcing this policy, organizations can limit the blast radius of potential security incidents.
- By ensuring that CodeBuild project environments do not have privileged mode enabled, prevents exposure to potential vulnerabilities ranging from leakage of sensitive data to gaining unauthorized control over resources, which can lead to significant business and reputational damage.
- This policy aligns with the Principle of Least Privilege (PoLP), meaning a user, process, or program should have the minimum privileges required to perform its function. Implementing this policy helps organizations minimize potential attack vectors, establish fine-grained access controls, and hence, enhance infrastructure security posture.
Ensure Elasticsearch Domain Audit Logging is enabled
Ensure Elasticsearch Domain Audit Logging is enabled
- Enabling Elasticsearch Domain Audit Logging is crucial for tracking, analyzing and alerting on user activities and API usage. This ensures visibility and traceability, enabling admin to identify unexpected or unauthorized activities and react promptly.
- The policy indirectly helps with regulatory compliance since many regulations and standards require the logging of accesses and changes to data. By providing a comprehensive audit trail, Elasticsearch Domain Audit Logs help meet such requirements.
- The policy can play a significant role in cybersecurity analytics, as Elasticsearch domain logs can be used to identify patterns, anomalies or incidents, contributing to threat detection and prompting appropriate security response.
- If Elasticsearch Domain Audit Logging is not enabled, it could lead to a lack of visibility into domain usage and activities. This could in turn allow potential security threats or breaches to go undetected, compromising the integrity and security of the AWS infrastructure.
Ensure Elasticsearch domains are configured with at least three dedicated master nodes for HA
Ensure Elasticsearch domains are configured with at least three dedicated master nodes for HA
- This policy ensures high availability of Elasticsearch domains. By configuring at least three dedicated master nodes, this reduces the chances of system failures which, in turn, can cause downtime or loss of data. This high availability configuration not only increases the fault tolerance but also greatly improves overall system reliability.
- The infrastructure as code (IaC) tool, Terraform, is used for implementing this policy. Terraform provides an efficient and convenient way to manage and provision cloud-based services like AWS Elasticsearch. This infrastructure as code approach allows for easy scaling and reproducing of environments while reducing potential human errors compared to manual configurations.
- This policy directly relates to two entities: aws_elasticsearch_domain and aws_opensearch_domain. Ensuring these entities have at least three dedicated master nodes allows for failover and redundancy in the case of a master node failure. This promotes continuous operation even during unforeseen disasters or hardware/software failures, providing resilience in the Elasticsearch operation.
- Non-compliance with this rule could result in decreased reliability and increased vulnerability in the AWS Elasticsearch domains. This could potentially impact service availability, data integrity, and the overall performance of the applications relying on these domains. Considering that Elasticsearch is commonly used for critical operations such as log or event data analysis, following this rule is crucial from both operational and security viewpoints.
Ensure that CloudWatch alarm actions are enabled
Ensure that CloudWatch alarm actions are enabled
- Enabling CloudWatch alarm actions is critical for real-time monitoring and management of AWS services and applications, as it provides automated notifications about any operational issues or irregularities.
- Such policy ensures quick response to critical events by triggering automated actions, or sending alerts and notifications to the responsible stakeholders, helping maintain a steady operational flow and reducing downtime.
- The policy fosters proactive problem-solving by offering insights and trends into system activities, including error rates, CPU usage, latency, user patterns, and more, empowering the decision-making with data-driven material.
- Non-compliance with the policy may lead to unnoticed operational issues, thus leading to loss of critical data or increased costs due to inefficient resource utilization. This is why it’s crucial to enable CloudWatch alarm actions in the infrastructure as code (IaC) configurations like Terraform to prevent any such scenarios.
Ensure Redshift clusters do not use the default database name
Ensure Redshift clusters do not use the default database name
- Using the default database name in Redshift clusters can compromise the system’s security as attackers often target default configurations. It’s easier to locate the default databases and potentially execute unauthorized actions.
- This policy promotes effective error and anomaly identification. Unique names provide ease in identifying and addressing errors or anomalies that may occur due to the application’s implementation in terraform.
- Not using the default database name can boost the overall information security posture as it adheres to the principle of obscurity. It makes it more difficult for attackers to guess the parameters, and thus launch a successful attack.
- The policy encourages better management and identification of resources in case of multiple redshift clusters. Having unique names for each redshift instance aids in better tracking and managing, which is critical for large-scale infrastructures.
Ensure Redshift clusters use enhanced VPC routing
Ensure Redshift clusters use enhanced VPC routing
- Enhanced VPC routing for Redshift clusters ensures that all data traffic between the clusters and your Amazon S3 storage stays within your VPC, increasing the security of data flow and minimizing potential exposure to the public internet.
- This policy improves compliance with regulations that require all data traffic to stay within the user’s network, such as HIPAA for healthcare or PCI DSS for financial institutions, avoiding potential legal implications.
- Using enhanced VPC routing with Redshift queries data directly from Amazon S3 and can help improve the network efficiency, resulting in quicker and more reliable performance of your data operations.
- The policy, when enforced, helps reducing the security risks such as data leaks or unauthorized access due to misconfigured data routing policies, thereby protecting your sensitive data and maintaining the integrity of your AWS infrastructure.
Ensure ElastiCache for Redis cache clusters have auto minor version upgrades enabled
Ensure ElastiCache for Redis cache clusters have auto minor version upgrades enabled
- Enabling automatic minor version upgrades for ElastiCache Redis clusters ensures your clusters are automatically updated with the latest minor version changes deployed by AWS, which often include security patches, bug fixes, and performance improvements. This reduces the risk of vulnerabilities and optimizes application performance.
- This policy prevents downtimes that could occur while manually handling minor version upgrades, as AWS provides a managed, seamless upgrade process to help maintain the system’s availability and stability, contributing to operational efficiency.
- By enforcing this policy with Infrastructure as Code (IaC) using tools like Terraform, teams can embed security and compliance checks into the deployment process, ensuring consistent application of the policy across all existing and future ElastiCache Redis clusters.
- The absence of this policy can result in running outdated or potentially vulnerable versions of the service, inviting unneeded risks that could lead to data loss and breaches, thereby affecting the organization’s reputation, data integrity and potentially resulting in non-compliance with regulatory standards.
Ensure ElastiCache clusters do not use the default subnet group
Ensure ElastiCache clusters do not use the default subnet group
- Ensuring ElastiCache clusters do not use the default subnet group is crucial for improving network security. Using a customized subnet group allows for better access control as you can specify which resources can communicate with the ElastiCache cluster.
- This policy not only enhances the security posture but also reduces the risk of potential cyber attacks. By not using the default subnet, the ElastiCache clusters become less obvious targets for attackers, who often focus on default settings due to their predictability.
- The policy ensures that clusters are appropriately segregated within defined network boundaries, reducing the risk of cross-contamination. If one cluster becomes compromised, having it in a separate subnet can prevent the spread of the compromise to other clusters.
- Enforcing this policy with the help of Terraform as Infrastructure as Code (IaC) tool allows for easier policy enforcement, regular compliance checks, and simplified management of the ElastiCache clusters—thus aiding in maintaining a more robust and efficient cloud infrastructure.
Ensure that RDS Cluster log capture is enabled
Ensure that RDS Cluster log capture is enabled
- Enabling RDS Cluster log capture is crucial for monitoring and diagnosing the operation of both the RDS cluster and the apps running on them. Without the ability to capture logs, it would be challenging to identify and resolve issues that may arise.
- This policy enables effective auditing and compliance practices since it allows for detailed tracking and recording of all operations and transactions. This could be useful in case of any security incidents or breaches that require comprehensive audit trail.
- When log capture is enabled, security teams have better visibility into potentially suspicious activities on the RDS cluster. This could help identify patterns indicative of a security threat, such as repeated failed login attempts, thus facilitating early detection of security issues.
- Without this policy, organizations run the risk of missing critical data needed for debugging and security investigations. This could delay problem resolution or even lead to unnoticed security breaches, resulting in potential data loss, system downtime, and reputational damage.
Ensure that RDS Cluster audit logging is enabled for MySQL engine
Ensure that RDS Cluster audit logging is enabled for MySQL engine
- Enabling RDS Cluster audit logging for MySQL engine allows administrators to record and monitor activities carried out within the database. This improves accountability by ensuring that all actions taken on the database can be traced back to specific users.
- The audit logs can be used as evidence to meet compliance requirements. Regulations such as PCI DSS, HIPAA, and GDPR require businesses to maintain detailed logs of all data access and modifications.
- This policy can help in identifying unauthorized activities and detecting security breaches early. When enabled, the audit logging can track actions like alterations on the database, changes in database configurations, or any kind of data exfiltration attempts, thereby providing valuable insights during a security incident investigation.
- Applying this policy through IaC-Terraform ensures that the setting is consistently applied across all RDS Clusters, reducing the risk of human error and enhancing the overall security posture of the infrastructure.
Ensure that RDS Aurora Clusters have backtracking enabled
Ensure that RDS Aurora Clusters have backtracking enabled
- Enabling backtracking on RDS Aurora clusters ensures a high level of data protection and allows for easy recovery of data, safeguarding against both accidental deletions or modifications and intentional malicious activity.
- Having backtracking enabled allows system administrators to rewind the database to a specific point in time, down to the second, without the need for backup functionalities or restore scripts, saving time and resources in case of an incident.
- This security measure has a direct impact on the continuity and consistency of operations, especially in businesses where data integrity is supreme. It minimizes downtime due to data issues, thereby maintaining customer trust and satisfaction.
- Implementing such a policy via Infrastructure as Code (IaC) method using Terraform, maintains standardised and consistent security across all RDS Aurora clusters in an automated, error-free manner, ensuring that all new database deployments comply with this rule.
Ensure RDS Clusters are encrypted using KMS CMKs
Ensure RDS Clusters are encrypted using KMS CMKs
- Ensuring RDS Clusters are encrypted with KMS CMKs helps in safeguarding sensitive data. Any raw or processed data stored in these clusters is automatically encrypted, thus preventing unauthorized access or data breaches.
- Leveraging KMS CMKs for RDS encryption provides the flexibility to manage their own keys, including the ability to rotate, delete, and control the access to these keys. As a result, organizations have full control over their data encryption.
- Enabling this policy improves compliance with external regulations or internal policies that mandate data encryption. For instance, it helps organizations align with standards such as GDPR, PCI DSS, and HIPAA that require encryption of sensitive data at rest.
- Not implementing this policy can impact the organization’s vulnerability to cyber-attacks, and it may lead to potential data loss or theft. Encryption substantially reduces this risk by rendering the data unreadable to those who do not possess the keys.
Ensure that ALB is configured with defensive or strictest desync mitigation mode
Ensure that ALB is configured with defensive or strictest desync mitigation mode
- Ensuring ALB is configured with defensive or strictest desync mitigation mode is crucial to prevent desync attacks, where attackers use timing and size differences in HTTP/1.1 messages to introduce ambiguity and cause the load balancer and backend to process requests differently. This can lead to an array of undesirable outcomes including unauthorized access, data leakage, or denial of service.
- This strict policy is designed to cause the ALB to terminate connections that may be exhibiting behavior indicative of a desync attack. The termination of these potentially harmful connections can protect the backend resources and maintain the integrity and availability of the system.
- AWS services such as ALB, ELB, and LB can be targets of these desync attacks because they are responsible for handling and directing web traffic. By implementing this security rule, these services become resilient to potential attacks, thereby safeguarding the overall cloud infrastructure.
- Infrastructures defined in code, such as with Terraform, can benefit from this desync mitigation method as it helps to eliminate the risk of misconfigured settings subject to exploitation. This not only supports secure development practices but also aligns with the principle of proactive security, whereby potential threats are predicted and neutralized.
EFS access points should enforce a root directory
EFS access points should enforce a root directory
- The policy ensures that user interaction with the systems is contained within a specific root directory, which is critical in isolating processes and protecting data assets by preventing unauthorized file access at higher directory levels.
- Enforcing a root directory for EFS access points limits the potential surface area for security threats, thereby reducing the risk of accidental exposure or leakage of sensitive data outside the designated area.
- When implemented via Terraform, adherence to this policy encourages the use of infrastructure as code (IaC) practices, thereby improving the ease of auditing, consistency of deployments and overall management of the AWS EFS access points.
- Not enforcing a root directory can lead to various security vulnerabilities including access escalation and unauthorized data alteration, which can potentially compromise an entire system, making this policy indispensable for securing the AWS EFS access points.
EFS access points should enforce a user identity
EFS access points should enforce a user identity
- Enforcing a user identity on EFS access points is crucial for tracing and auditing the activities within the system, ensuring that each action performed is associated with an authorised user.
- The policy helps to maintain the integrity of data by allowing only identified and authenticated users to access and interact with the EFS, minimizing the risk of unauthorized access or malicious manipulation of data.
- Without this policy, there is a lack of accountability and traceability of actions performed on the EFS which could lead to undetected security breaches, data leakages or unauthorized modifications.
- Enforcing user identities on EFS access points also ensures adherence to various compliance and regulatory standards, which mandate proper user identity access controls for proof of security measure. In turn, this helps to avoid legal complications and potential reputational damage.
Ensure Transit Gateways do not automatically accept VPC attachment requests
Ensure Transit Gateways do not automatically accept VPC attachment requests
- This policy ensures that unverified or potentially harmful Virtual Private Cloud (VPC) attachments are not automatically accepted, maintaining the integrity and security of the Transit Gateway and associated resources.
- Not having this policy could open doors for unauthorized VPCs to gain access to the Transit Gateway, leading to unintended data exposure, potential breaching of the network, and compromise of sensitive information.
- The implementation of this policy through Infrastructure as Code (IaC) tool like Terraform, which allows automated infrastructure management, increases efficiency and reduces the likelihood of human error, further improving security control.
- The policy specifically targets the ‘aws_ec2_transit_gateway’ resource type in AWS, ensuring specific and granular control over security configurations of the respective AWS services, leading to improved infrastructure security posture.
Ensure ECS Fargate services run on the latest Fargate platform version
Ensure ECS Fargate services run on the latest Fargate platform version
- Ensuring ECS Fargate services run on the latest Fargate platform version is crucial as it guarantees that the services are running on the most secure, updated version, ensuring protection against new risks, vulnerabilities and providing bug fixes.
- The policy ensures improved performance and the application of new features offered by the latest version, thereby enhancing functionality and efficiency of the ECS Fargate services.
- The latest Fargate platform version often has better compliance with the latest regulations. Running services on the latest version helps fulfil necessary regulatory requirements and lowers the risk of non-compliance penalties.
- By not running the ECS Fargate services on the latest platform version, resources mentioned in the Terraform scripts like ‘aws_ecs_service’ might not function optimally, potentially leading to service disruption.
Ensure ECS services do not have public IP addresses assigned to them automatically
Ensure ECS services do not have public IP addresses assigned to them automatically
- This policy ensures that ECS services are not directly exposed to the public internet, thus reducing the attack surface for potential cyber threats. This is important as ECS services often run critical applications and should be protected.
- Automatically assigning public IP addresses to ECS services could unintentionally expose sensitive data or services to the public. This policy mitigates this risk by preventing automatic public IP assignment.
- With this policy, administrators have more control over the network configuration of ECS services. This allows more precise security configurations, helping ensure that only necessary services are accessible.
- By adhering to this policy, organizations can enhance compliance with security standards that advocate for minimized data exposure. It helps maintain system integrity and protect against unauthorized data breaches.
Ensure ECS containers should run as non-privileged
Ensure ECS containers should run as non-privileged
- Running ECS containers as non-privileged reduces the potential for security breaches by limiting the capabilities and access rights of the containerized applications, ensuring they can’t perform sensitive operations or gain unauthorized access to valuable data.
- This policy is crucial in enforcing the principle of least privilege, which states that a user or an application must only have access to the resources and data it needs to perform its function, thereby minimizing the damage that could result from an accidental or malicious action.
- By restricting ECS containers to run only as non-privileged, the impact of a container compromise or any other security incident is confined to that particular container, preventing the attacker from escalating privileges and affecting other containers, applications, or the host.
- Violation of this policy could lead to a significant security risk, potentially exposing the system to attacks or data breaches, and non-compliance could also result in failing to meet industry standards and regulatory requirements such as GDPR, HIPAA, or PCI-DSS, resulting in monetary fines and reputational damage.
Ensure ECS task definitions should not share the host's process namespace
Ensure ECS task definitions should not share the host's process namespace
Ensure ECS containers are limited to read-only access to root filesystems
Ensure ECS containers are limited to read-only access to root filesystems
- This policy ensures that Amazon ECS containers only have read-only access to the root file system, greatly reducing the risk of unauthorized alterations to important system files. This helps to protect the integrity and consistency of data and system files.
- Restricting ECS containers to read-only access to root file systems helps to limit the potential damage if a container is compromised. An attacker gaining access to a container would not be able to modify system files, thus reducing their ability to harm systems or access sensitive data.
- AWS ECS tasks are stateless by design. Any data that an application writes to the underlying host system is deleted when that container is terminated or fails. This rule ensures data persistence by protecting the root file system from alterations.
- Non-compliance with this policy could lead to potential security vulnerabilities such as unauthorized access or modifications, data breaches, and system instability. Hence, implementing the policy is a proactive measure to enhance the security posture of an organization’s infrastructure.
Ensure SSM parameters are using KMS CMK
Ensure SSM parameters are using KMS CMK
- Utilizing KMS Customer Master Key (CMK) for SSM parameters ensures robust encryption and increases data security by protecting sensitive system and application data.
- Failure to use KMS CMK can potentially expose sensitive information stored in SSM parameters to unauthorized users, leading to data breaches and violation of compliance regulations such as GDPR and HIPAA.
- Using KMS CMK with SSM parameters helps organizations meet encryption requirements for compliance audits and security best practices, thus safeguarding business reputation.
- The use of KMS CMK with SSM parameters aids in the management of cryptographic keys, allowing administrators to control who can use which keys under what conditions, thereby enhancing access control and security management.
Ensure CloudWatch log groups retains logs for at least 1 year
Ensure CloudWatch log groups retains logs for at least 1 year
- Ensuring CloudWatch log groups retain logs for at least 1 year allows organizations to maintain a comprehensive and accessible record of all their system and network events for an adequate period. This can facilitate problem detection and troubleshooting in cases of unexpected issues or attacks.
- This policy is particularly significant for compliance purposes. Many cybersecurity standards and regulations require that log data be kept for specific periods (e.g., GDPR, SOC 2, PCI DSS). Not retaining logs for at least a year could result in non-compliance penalties.
- Long-term retention of logs enables a more effective forensic analysis and post-incident investigations. If an intrusion or issue is detected much later after it occurred, having CloudWatch log data readily available from the past year would be invaluable in understanding the timeline and impact of the incident.
- Via Terraform, enforcing this policy ensures a standardized approach to log retention across all resources used within your AWS infrastructure. This eliminates inconsistencies in log retention practices and ensures every aws_cloudwatch_log_group resource used within your AWS environment adheres to the policy.
Ensure EKS clusters run on a supported Kubernetes version
Ensure EKS clusters run on a supported Kubernetes version
- Ensuring EKS clusters run on a supported Kubernetes version is critical because unsupported versions may not receive security updates, potentially leaving the cluster and its workloads vulnerable to attacks and exploits.
- Compliance with this policy also ensures that all features, configurations, and enhancements provided in the supported versions can be leveraged, which can improve the efficiency and performance of the EKS clusters.
- Outdated Kubernetes versions may have compatibility issues with other components of the infrastructure, hence keeping it updated ensures seamless integration and functionality of the entire setup, reducing operational outages or risks.
- Adhering to this infra security policy can help avoid the extra work, costs, and potential downtime associated with urgently needing to update the Kubernetes version when an unsupported version is suddenly deprecated or is found to have critical security issues.
Ensure Elastic Beanstalk managed platform updates are enabled
Ensure Elastic Beanstalk managed platform updates are enabled
- This policy ensures that Elastic Beanstalk managed platform updates are enabled, which means the environment automatically receives the latest patches, updates, and new features without manual intervention.
- Implementing this rule helps maintain the integrity and stability of the code running in the environment by always keeping it updated and patched against known coding vulnerabilities, thus reducing potential attack vectors.
- By using Infrastructure as Code (IaC) approach with Terraform, this policy automates the update process, significantly reducing the risk of human error during manual patching or feature update procedures.
- The particular policy targets ‘aws_elastic_beanstalk_environment’ resources, playing a key role in maintaining a reliable, secure, and high-performing environment for AWS Elastic Beanstalk applications.
Ensure Launch template should not have a metadata response hop limit greater than 1
Ensure Launch template should not have a metadata response hop limit greater than 1
- This policy helps safeguard sensitive customer data by preventing unauthorized access. The metadata contains sensitive information like role credentials and user data. If the hop limit is greater than 1, it opens up the possibility of the data being intercepted or modified during transmission.
- The policy also improves the overall system performance and reduces network traffic. By limiting hops, data takes a more direct route to its destination, reducing latency and the possibility of data congestion or loss.
- It strengthens the launch configuration and template in AWS. By restricting the metadata response hop limit, it ensures that only intended or authorized AWS resources can access this information, improving the security of your infrastructure in the cloud.
- Limiting the metadata hop limit also reduces the attack surface for potential hackers. Without limitations, metadata could be accessed or tampered with during transfer between services or instances, leading to possible security breaches or data leaks.
Ensure WAF rule has any actions
Ensure WAF rule has any actions
- Ensuring that the Web Application Firewall (WAF) rule has any actions is crucial for effectively filtering and monitoring HTTP traffic to and from a web application. Failing to have any actions in the WAF rule implies that the firewall isn’t performing any function, thus leaving the application vulnerable to threats.
- Without actions specified in the WAF rules, the firewall will not be able to prevent SQL injection and cross-site scripting (XSS) attacks. These are common attacks which can compromise user data and deface websites if not adequately protected against.
- Through the implementation of actions in the WAF rules, the firewall can react appropriately to potential threats such as blocking, allowing, or flagging suspicious traffic. Without these actions, unauthorized access or malicious actions may go unnoticed leading to potential data breaches.
- The entities affected by this policy include aws_waf_rule_group, aws_waf_web_acl, aws_wafregional_rule_group, aws_wafregional_web_acl, aws_wafv2_rule_group, aws_wafv2_web_acl. If not adequately managed, these resources can become weak points in infrastructure security architecture. Therefore, a lapse in WAF rule settings for these resources can significantly increase risks to the security of the overall AWS ecosystem.
Ensure Amazon Redshift clusters should have automatic snapshots enabled
Ensure Amazon Redshift clusters should have automatic snapshots enabled
- Enabling automatic snapshots for Amazon Redshift clusters helps safeguard the data stored in these clusters by regularly creating backups. The loss or corruption of data could lead to significant operational and financial damages for the entity.
- Based on the policy, automatic snapshots can greatly help during disaster recovery situations. In case of a breach or system failure, the automatic snapshots can be used to restore the system to a point in time before the incident, reducing potential data loss.
- If Redshift clusters do not have automatic snapshots enabled, it can lead to non-compliance with various data protection and corporate governance requirements. This could result in penalties, legal repercussions, or loss of trust among customers and stakeholders.
- As the resource link suggests, using Infrastructure as Code (IaC) tools like Terraform can potentially automate enabling of snapshots and bring efficiency in operations, reducing manual intervention and errors. This helps maintain a consistent state of infra security management.
Ensure that Network firewalls have deletion protection enabled
Ensure that Network firewalls have deletion protection enabled
- Enabling deletion protection on network firewalls helps safeguard critical network infrastructure from accidental removals and disruptions, enhancing service continuity and availability.
- This policy mitigates unauthorized or wrongful alterations within the firewall settings by ensuring there is an additional layer of verification before any deletion attempts.
- By using Terraform, Infrastructure As Code (IaC) practices can integrate this policy into their deployment cycles, automating the protection settings and reducing manual error risk.
- The application of this policy on the ‘aws_networkfirewall_firewall’ resource signifies its importance in maintaining and securing AWS-based infrastructures against data loss due to accidental or intentional firewall deletions.
Ensure that Network firewall encryption is via a CMK
Ensure that Network firewall encryption is via a CMK
- Ensuring that Network firewall encryption is via a Customer Master Key (CMK) increases the control and transparency for the organization as they can manage their own key, which can be more secure than default keys provided by the service provider.
- Usage of CMK for encryption enhances data protection. It provides an extra layer of security for sensitive data by enforcing unbreachable encryption methodologies, which makes it difficult for potential hackers to access or tamper with the data.
- Leveraging CMK for encryption allows for improved auditing and compliance. Organizations can track usage and activity of the key, and demonstrate proper data protection measures according to regulatory requirements.
- The policy also contributes to a reduction in security vulnerabilities. By controlling who can use and manage your key, the potential for unauthorized key usage is minimized, thereby reducing threats and potential breaches.
Ensure Network Firewall Policy defines an encryption configuration that uses a customer managed Key (CMK)
Ensure Network Firewall Policy defines an encryption configuration that uses a customer managed Key (CMK)
- This policy promotes data security by ensuring that all data transferred through AWS network firewalls is encrypted using a customer-managed key (CMK), making it unreadable to unauthorized individuals and systems.
- Encryption with a CMK gives infrastructure managers direct control over the cryptographic keys for their data, providing a high level of granularity in access management which can be essential for regulatory compliance.
- The policy mitigates risks associated with key mismanagement by service providers by putting the responsibility in the hands of the customer, who, it can be assumed, has a vested interest in maintaining the confidentiality and integrity of their data.
- In the context of Infrastructure as Code (IaC) practices using Terraform, implementing this policy can ensure consistent and reproducible security configurations across firewalls, reducing the potential for human error and enhancing the overall security posture.
Ensure Neptune is encrypted by KMS using a customer managed Key (CMK)
Ensure Neptune is encrypted by KMS using a customer managed Key (CMK)
- This policy ensures that Neptune, Amazon’s managed graph database service, employs encryption at rest using a customer managed Key Management Services (KMS) key, providing an additional layer of security and control over data security.
- By enforcing this policy, organizations can comply with data protection laws, regulations, and best practices that require customer data to be encrypted, thereby enhancing the organization’s reputation and trustworthiness.
- The policy minimizes the risk of unauthorized access and data leakage by ensuring all Neptune data is unreadable without the corresponding customer-managed KMS key.
- If not implemented, unauthorized individuals could potentially exploit unencrypted data, which could lead to data breaches, negative business implications, and potential legal consequences, emphasizing the necessity of this policy.
Ensure IAM root user doesnt have Access keys
Ensure IAM root user doesnt have Access keys
- Ensuring the IAM root user doesn’t have access keys helps restrict super admin level permissions, preventing possible unauthorized and potentially destructive actions within the AWS environment.
- The policy aids in delegating permissions to specific IAM users who need them to perform certain tasks, thereby adhering to the principle of least privilege and enhancing overall security.
- Without access keys for the root user, there’s a reduces risk that they might be accidentally exposed or misused, helping to prevent incidences like unexpected charges or data breaches.
- This policy aids companies in aligning with AWS best practices, achieving regulatory compliance where certain standards mandate restricting root account privileges, and passing audits that verify secure cloud infrastructure.
Ensure EMR Cluster security configuration encrypts local disks
Ensure EMR Cluster security configuration encrypts local disks
- Ensuring EMR Cluster security configuration encrypts local disks is important as it protects data at rest from unauthorized access. If a physical disk is stolen, the data cannot be read without the correct encryption key, adding an extra layer of security.
- Implementing this policy helps in compliance with data protection regulations like GDPR, CCPA that mandate protective measures for personal data, reducing the risk of financial penalties and reputational damage.
- The absence of disk encryption can lead to potential data breaches and loss of sensitive data if the EMR clusters are compromised, thereby significantly impacting the confidentiality and integrity of the system.
- Using infrastructure as code tool like Terraform enables automated and consistent implementation of this policy across multiple EMR clusters, reducing manual errors, increasing efficiency, and ensuring that all AWS resources are compliant with best practice security settings.
Ensure EMR Cluster security configuration encrypts EBS disks
Ensure EMR Cluster security configuration encrypts EBS disks
- Encrypting EBS disks in EMR cluster configurations ensures that data stored is unreadable by unauthorized individuals. This prevents potential breach of sensitive data, protecting the integrity and confidentiality of the data stored on these disks.
- Non-encrypted EBS disks can be a major vulnerability as they can be accessed and tampered with if they fall into the wrong hands. Proper encryption will secure your cluster by making this data unintelligible without the appropriate decryption key.
- Enabling encryption for EBS disks in your EMR Cluster reduces the risk of regulatory non-compliance. It helps to meet requirements set out by data protection laws such as the GDPR and HIPAA which demand encryption of certain types of data.
- This security policy also ensures data is protected during transfer operations, especially in a multi-tenant AWS environment where EMR clusters may be shared between different users or departments. It prevents possible data leakage scenarios, which could result in financial loss and damage to an organization’s reputation.
Ensure EMR Cluster security configuration encrypts InTransit
Ensure EMR Cluster security configuration encrypts InTransit
- Ensuring EMR Cluster security configuration encrypts InTransit enhances data protection by encrypting data while it is being transferred between nodes or from node to storage, preventing the interception and misuse of data.
- The policy aids in maintaining regulatory compliance with data protection standards and laws that require encryption of sensitive data in transit, such as GDPR and HIPAA.
- A successful implementation using Terraform improves the overall security posture of the EMR cluster, reducing the risk of data breaches and enhancing trust among users or clients by demonstrating a strong commitment to data security.
- Non-compliance to this policy could expose the AWS EMR to potential security vulnerabilities, such as man-in-the-middle attacks, where unauthorized entities can access and potentially manipulate the data while in transit, leading to data loss, corruption, or breaches.
Ensure NACL ingress does not allow all Ports
Ensure NACL ingress does not allow all Ports
- This policy ensures the security of a network by limiting the accessibility of ports. It prevents unauthorized access to any open ports by restricting inbound traffic to specific, necessary ports only.
- Limiting the accessibility safeguards sensitive data and infrastructure from hacking attempts and data breaches. Specific ports can be made accessible only to trusted entities, reducing the risk of intrusion and potential damage.
- The policy compliance enhances the performance of Network Access Control Lists (NACLs) in AWS by preventing the overuse of all ports, thereby managing congestion and making the most of available resources.
- This policy’s enforcement with Terraform ensures a secure and standardized method of managing infrastructure and access control. It allows for automated checks and consistency across the infrastructure configuration, leading to efficient management of cloud resources.
Ensure that RDS instances have performance insights enabled
Ensure that RDS instances have performance insights enabled
- Enabling RDS instances with performance insights allows continuous monitoring of the database load, facilitating detection and resolution of performance issues faster. This ensures the availability and stability of business-critical applications that rely on these databases.
- By implementing this security policy, potential anomalies, and outliers which could signal attacks, breaches or performance issues are effectively identified and mitigated in a timely manner, reducing potential downtimes.
- The policy aids in optimizing the use of resources; analysis from the Performance Insights can guide decisions on scaling and allocation, influencing the efficiency, and cost-effectiveness of operations.
- Implementing this rule using Infrastructure as Code (IAC) tool like Terraform allows for automation, easily applying the policy across multiple instances and maintaining a consistent level of security and performance monitoring across the infrastructure.
Ensure RDS Performance Insights are encrypted using KMS CMKs
Ensure RDS Performance Insights are encrypted using KMS CMKs
- This policy ensures that RDS Performance Insights’ data, which may contain sensitive information about an application’s database activity, is securely encrypted at rest using KMS CMKs (Key Management System Customer Master Keys). It enhances data safety against unauthorized access.
- Using KMS CMKs specifically for encryption allows more granular and customized control over data encryption and decryption, thereby providing higher security standards compared to the default AWS managed keys.
- If the policy is not well observed, user data can be vulnerable to potential security breaches leading to data loss, financial damages, reputation harm, and non-compliance with data protection regulations.
- Implementing the policy via Terraform, an Infrastructure as Code (IaC) tool, enables the policy’s automated, consistent, and reliable application across different development cycles and environments, increasing the operational efficiency.
Ensure no IAM policies documents allow '*' as a statement's resource for restrictable actions
Ensure no IAM policies documents allow '*' as a statement's resource for restrictable actions
- Enforcing this infrastructure security policy helps avoid potential security incidents by restricting overly broad permissions. Allowing ’*’ as a resource in IAM policy statements could grant unintended, excessive permissions.
- This policy helps in complying with the principle of least privilege, which states that a user should be given only those privileges which are essential to perform his/her duties. Thus, it reduces the potential for accidental exposure of protected information or critical system operations.
- It mitigates the risk of a breach in one section of the system escalating to a more widespread security compromise. If a compromised entity has overly broad access permissions, the impact of the breach could be far more extensive.
- By avoiding usage of ’*’ in IAM policy documents, this policy promotes better security hygiene by requiring explicit naming of resources, ensuring clear visibility and control over who can do what, which in turn leads to easier auditing and governance.
Ensure Transfer Server allows only secure protocols
Ensure Transfer Server allows only secure protocols
- The policy ensures that data is transferred securely between the server and the client, protecting against unauthorized access during transit and breaches that may lead to data loss or compromise.
- With this policy in place, possibilities of harmful or malicious data being intercepted during the transfer process are significantly minimized. This is chiefly possible because secure transfer protocols implement encryption.
- If the transfer server allows insecure protocols, it could lead to compliance violations with industry standards like HIPAA, GDPR, and PCI-DSS which require safeguarding data, thus potentially resulting in hefty fines and damaged reputation.
- Implementing the policy through Infrastructure as Code (IaC) platform Terraform automates its enforcement across the entire infrastructure, ensuring consistent application and reducing the risk of manual configuration mistakes.
Ensure GitHub Actions OIDC trust policies only allows actions from a specific known organization
Ensure GitHub Actions OIDC trust policies only allows actions from a specific known organization
- This policy is important as it prevents unauthorized access to Github Actions from unknown organizations or entities, thereby mitigating the risk of cyber attacks and data breaches.
- Since the policy ensures that only specific known organizations can execute actions, it protects the AWS IAM policy document and keeps the infrastructure secure.
- Implementation via Infrastructure as Code (IaC) using Terraform makes this security policy more reliable and error-free, as it reduces the chance of manual configuration errors.
- The impact of this policy is crucial in maintaining the integrity of the Github Actions, preventing unwanted changes or manipulations which could disrupt system operations or compromise data privacy.
Neptune DB clusters should have IAM database authentication enabled
Neptune DB clusters should have IAM database authentication enabled
- Enabling IAM database authentication on Neptune DB clusters enhances security by allowing AWS to manage user credentials instead of the database, reducing the risk of credentials leakage.
- IAM authentication simplifies security management as it eliminates the need to manage a separate system for database user credentials, allowing for centralized control over database access.
- Database access can be managed more granularly with IAM roles and policies, reducing the chance of unauthorized access to the database, contributing to the enforcement of principle of least privilege.
- Non-compliance to this policy could lead to potential data breaches as a result of unauthorized access to the Neptune DB clusters, negatively impacting the reputation and operation of businesses.
Ensure DocumentDB has an adequate backup retention period
Ensure DocumentDB has an adequate backup retention period
- Ensuring DocumentDB has an adequate backup retention period is critical to prevent data loss in case of accidental deletions or system failures. Without proper data backups, businesses risk losing valuable information that can impact operational efficiency, customer relations, and overall profitability.
- The policy impacts both cost and storage. Maintaining an appropriate backup retention period prevents unnecessary expenditures on excessive storage space. Conversely, too short a retention period can lead to higher costs if data restoration is required.
- Lowering the risk of non-compliance with data protection regulations is another vital impact of this policy. Various jurisdictions have laws mandating certain durations of data retention, failure to comply can result in hefty fines or legal sanctions.
- Finally, the policy impacts disaster recovery strategies and business continuity plans. In the event of a significant disruption such as a cyber-attack, an adequate DocumentDB backup retention period ensures that companies can recover essential data quickly and resume normal operations as soon as possible.
Ensure that Neptune DB cluster has automated backups enabled with adequate retention
Ensure that Neptune DB cluster has automated backups enabled with adequate retention
- Ensuring that the Neptune DB cluster has automated backups enabled with adequate retention is crucial for data recovery in case of accidental deletion or system failures, reducing the risk of significant data loss and service outage.
- The policy ensures continuity of business operations, as the data can be quickly restored from backups, minimally impacting the services that depend on the database.
- Backups also provide an essential safeguard against any data corruption. In the event that the data in the active database is corrupted, the system can revert to a previous, uncorrupted state via the backups.
- Compliance with data retention regulations is another essential reason for this policy. By maintaining automated backups with adequate retention periods, organizations can satisfy legal and regulatory requirements regarding data preservation.
Neptune DB clusters should be configured to copy tags to snapshots
Neptune DB clusters should be configured to copy tags to snapshots
Ensure Lambda Runtime is not deprecated
Ensure Lambda Runtime is not deprecated
- Ensuring Lambda Runtime is not deprecated is important as deprecated runtimes may no longer receive security updates from AWS, leaving your applications potentially vulnerable to unpatched security flaws.
- The policy ensures long-term stability and reliability as deprecated runtimes might not be supported in future innovations, which could lead to unanticipated failures or incompatibility issues with other AWS services.
- Enforcing this policy help organizations to stay compliant with industry best practices and regulations, as using deprecated runtimes can be considered as non-compliance with best practices.
- The policy also imposes a drive toward consistent updating and upgrading within the infrastructure, leading to improved performance, efficiency, and enhancement of features over time.
Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount
Ensure that AWS Lambda function permissions delegated to AWS services are limited by SourceArn or SourceAccount
- This policy ensures that permissions to execute AWS Lambda functions are not overly broad, bolstering the security of the services that rely on these functions. This approach reduces the blast radius in case of an attack or security breach.
- Applying limitation by SourceArn or SourceAccount means that only specific resources or accounts can trigger the associated Lambda functions. Thus, unauthorized actors and sources are prevented access, reducing the risk of intrusion and manipulation.
- This policy assists in compliance with the principle of least privilege. Unnecessary permissions are one of the main causes of cloud security failures, and applying SourceArn or SourceAccount restrictions on Lambda functions helps limit this risk.
- Restricting access to AWS Lambda functions can help reduce unforeseen cloud expenditure. If a function is triggered by an unauthorized source resulting in unnecessary processing, this could incur added costs. By allowing only specified source accounts or Arn’s, operational efficiency gets enhanced.
Ensure SES Configuration Set enforces TLS usage
Ensure SES Configuration Set enforces TLS usage
- This policy ensures that Transport Layer Security (TLS) is enforced on the AWS Simple Email Service (SES) Configuration Set, thereby enhancing the security of email transmission by encrypting data during transit.
- It minimizes the risk of sensitive information being intercepted, tampered with or modified by unauthorized parties while being sent via email, offering a level of protection against various attacks.
- In the instance of non-compliance, where TLS usage isn’t enforced on SES, organizations could fail to meet regulatory requirements related to data protection, leading to potential legal and financial implications.
- Enforcing TLS encourages the adherence to best practices for secure email communication, and it offers a measurable control for auditors to assess the level of security applied to email data transmission.
Ensure that all NACL are attached to subnets
Ensure that all NACL are attached to subnets
- Ensuring that all Network Access Control Lists (NACLs) are attached to subnets is important because it allows for more granular control over the traffic entering and exiting your subnets, enhancing security by blocking unwanted traffic or allowing desired ones.
- This policy can help maintain an organized, predictable traffic flow, by explicitly defining which types of traffic are allowed or denied, diminishing the likelihood of inadvertent data exposures or breaches.
- This policy reduces the risk of malicious attacks such as Distributed Denial of Service (DDoS) or unauthorized access by regulating the traffic based on specific rules defined in NACLs, enhancing the overall security posture.
- By enforcing this policy, organizations can gain better control over their subnets, leading to more consistent security practices, and easier audits or compliance checks.
Ensure that only encrypted EBS volumes are attached to EC2 instances
Ensure that only encrypted EBS volumes are attached to EC2 instances
- Encrypting EBS volumes attached to EC2 instances helps to ensure the confidentiality and integrity of data at rest. This is crucial, as unencrypted data can be easily accessed if the underlying storage is compromised.
- Not encrypting EBS volumes may violate regulations such as GDPR, HIPAA, or PCI DSS, which require the protection of sensitive data. Non-compliance can result in severe fines and damage to the organisation’s reputation.
- Encrypting EBS volumes provides robust security measures such as cryptographic separation, which ensures no user can access raw disk blocks of another user’s EBS volume without knowing their encryption key, adding an extra layer of data protection.
- Connection of unencrypted EBS volumes to EC2 instances can lead to undesirable exposure of sensitive data, since EC2 instances often process and store critical information. Encrypting the EBS volumes reduces this risk by making any stolen or intercepted data unreadable without the decryption key.
Ensure GuardDuty is enabled to specific org/region
Ensure GuardDuty is enabled to specific org/region
- Enabling GuardDuty in a specific organization or region allows the continuous monitoring and detection of potentially malicious or unauthorized behavior, such as unusual API calls or potentially unsecured account activity, enhancing the security posture of your AWS environment.
- As this policy is implemented through Infrastructure as Code (IaC) using Terraform, it ensures that the security configuration is maintained consistently across all environments, thereby reducing configuration errors and enhancing security.
- Enforcing this policy not only helps in identifying potential threats but also accelerates incident response by providing detailed and actionable security findings, facilitating the organization’s ability to mitigate risks.
- Having GuardDuty enabled as specified in the security policy helps in meeting compliance requirements for certain regulations and standards, that mandate continuous threat detection and response mechanisms, thereby aiding in maintaining regulatory compliance.
Ensure API Gateway stage have logging level defined as appropriate
Ensure API Gateway stage have logging level defined as appropriate
- This policy ensures that every action performed via the API Gateway is properly logged, enabling organizations to monitor, track, and investigate any suspicious or harmful events that could compromise the security and performance of their infrastructure.
- By defining appropriate logging levels, you get fine-grained control over the level of detail provided in the logs, helping in effective troubleshooting, forensics and regulatory compliance, thereby improving overall security posture of the system.
- Non-compliance with this policy may lead to a black-box scenario where no information is available for diagnosis during a security issue or system failure. A lack of appropriate logging could also indicate underlying system vulnerabilities that may be exploited by attackers.
- Implementing this policy using Infrastructure as Code (IaC) tool like Terraform ensures consistency, repeatability, and infrastructure versioning. This can lead to reduced human errors as compared to manual configuration, thereby increasing the security and reliability of your API Gateway deployments.
Ensure that Security Groups are attached to another resource
Ensure that Security Groups are attached to another resource
- Ensuring that Security Groups are attached to another resource is critical for controlling inbound and outbound traffic in AWS. It safeguards against unwanted public or internal access, avoids the risk of exposure to breaches or vulnerabilities.
- Leaving any unused Security Groups that are not associated with any resources can cause clutter which makes the organization and management of security infrastructure complex. It can lead to confusion and mismanagement in the long run.
- Unused, unattached Security Groups can potentially be targeted by malicious actors and can be leveraged as an attack vector, thereby compromising the security of different AWS services in the network.
- Maintaining this policy supports optimized resource management and utilization, promoting compliance with security standards, and assists in monitoring and auditing resource usage effectively.
Ensure that S3 bucket has a Public Access block
Ensure that S3 bucket has a Public Access block
- This policy is critical because it ensures that Amazon S3 buckets are not unintentionally exposed to the public internet, hence reducing the risk of data breaches and unauthorized access to sensitive data.
- The policy helps to comply with industry best practices and standards regarding data privacy and security, thereby protecting the legal and reputational standing of the organization.
- Implementing this policy impacts resource management in Terraform by enforcing stricter access controls and ensuring data stored in S3 buckets is only accessible to authorized users or services under specified conditions.
- With the block on public access, it prevents the accidental modification of access control lists or bucket policies that could open up unrestricted access to the bucket, thereby maintaining the consistency of security configurations.
Ensure that Amazon EMR clusters' security groups are not open to the world
Ensure that Amazon EMR clusters' security groups are not open to the world
- The policy safeguards the Amazon EMR clusters against unauthorized access and potential security threats by ensuring that their security groups are not openly accessible from anywhere on the internet.
- By enforcing this policy, you protect sensitive, potentially proprietary data from being accessible, thereby preventing data breaches and maintaining compliance with data privacy laws and regulations.
- Implementing this policy via Terraform infrastructure-as-code tools provides streamlined, automated enforcement, reducing the risk of human error in configuration and enhancing overall cluster security.
- Violation of this policy could result in compromised EMR clusters, which can be exploited to launch larger-scale attacks on associated AWS resources, leading to unscheduled downtime, loss of customer trust, and potential financial and reputational damage.
Ensure that RDS clusters has backup plan of AWS Backup
Ensure that RDS clusters has backup plan of AWS Backup
- Ensuring that RDS clusters have an AWS Backup plan allows for seamless recovery of data in the event of accidental deletion, system failure, or data corruption, which in turn, significantly reduces the impact of data loss incidents.
- A Backup plan ensures operational continuity as any disruption in the database service due to unforeseen issues would not cause an extended halt in the services, thereby maintaining the SLAs and keeping client trust intact.
- AWS Backup plan can automate the backup process, reducing human error, and freeing up resources that would otherwise be required for manual backups. This can lead to increased efficiency in resource allocation and cost savings.
- This policy enforces good data governance practices by ensuring regular and consistent backups. This is important for regulatory compliance, especially for organizations handling sensitive customer information or those operating in highly regulated industries.
Ensure that EBS are added in the backup plans of AWS Backup
Ensure that EBS are added in the backup plans of AWS Backup
- Ensuring that Elastic Block Stores (EBS) are included in the backup plans of AWS Backup is essential for data recovery in case of accidental deletion, failures or any unforeseen disasters. This policy thus increases data resiliency and business continuity.
- Adding EBS volumes to AWS Backup greatly facilitates automated, centrally managed and policy-driven backups across AWS resources. This reduces administrative overhead and optimizes resource allocation.
- This policy ensures compliance in sensitive and regulated environments. Regularly backing up data is not just good practice, but often a stringent requirement in terms of regulatory and compliance rules.
- Exclusion of EBS volumes in the backup plan can lead to potential data loss, which can have serious financial, legal and reputational implications. By enforcing this policy, these risks are effectively mitigated.
Ensure CloudTrail trails are integrated with CloudWatch Logs
Ensure CloudTrail trails are integrated with CloudWatch Logs
- This policy ensures that all activity within your AWS CloudTrail is being recorded and monitored in CloudWatch Logs. This allows for comprehensive oversight of your infrastructure and can help improve troubleshooting, auditing, and investigative processes.
- The integration of CloudTrail with CloudWatch Logs enables real-time processing of log data. This results in faster detection and analysis of security incidents, operational problems, and other important information within your cloud environment.
- It offers storage and archival solutions. By integrating CloudTrail with CloudWatch, logs are stored and can be archived in a designated S3 bucket for later reference or in case of an audit, ensuring historical accountability of all changes and actions.
- It facilitates a proactive security measure due to CloudWatch’s capability of setting up alarms for unusual or unauthorized behavior. This can aid in minimizing damages caused by a security incident by addressing the issue as soon as it arises.
Ensure VPC flow logging is enabled in all VPCs
Ensure VPC flow logging is enabled in all VPCs
- Enabling VPC flow logging in all VPCs provides visibility into the traffic entering and exiting the VPCs, which is essential for monitoring and troubleshooting potential network security issues.
- VPC flow logging is key in auditing and compliance as it records and stores metadata like source and destination IP addresses, packet and byte counts, and TCP flags, amongst others, confirming or refuting compliance with established network policies.
- Without VPC flow logging, real-time and historical analysis of the VPC’s network traffic, which can be crucial in incident response, is impossible, thereby increasing the risk of undetected malicious activities and data breaches.
- The VPCHasFlowLog.yaml Terraform check ensures that the logging is enabled by default and therefore alleviates the manual task of enabling it each time a new VPC is created, making it more difficult for mistakes or oversights to occur that could lead to security vulnerabilities.
Ensure the default security group of every VPC restricts all traffic
Ensure the default security group of every VPC restricts all traffic
- This policy aims to mitigate the risk of unauthorized access, data breaches, and potential attacks on your infrastructure by ensuring that the default security group of every Virtual Private Cloud (VPC) restricts all traffic unless explicitly allowed, making your environment more secure.
- The policy implements Infrastructure as Code (IaC) using Terraform, facilitating automated and version-controlled security configurations. This not only ensures consistency and reproducibility across multiple environments, reducing human errors, but also enables quick responses to configuration deviations.
- It specifically targets the aws_default_security_group and aws_vpc resources, making it highly relevant for organizations using AWS for cloud services. It ensures that your infrastructural entities are compliant with the best security practices in the industry and adhere to principles of least privilege access.
- By enforcing this policy, organizations not only bolster their defenses against malicious parties but also create a conducive environment for achieving compliances, such as GDPR or HIPAA, which often require stringent traffic control mechanisms. It also allows for easier auditability and accountability within the organization for better governance.
Ensure that IAM groups includes at least one IAM user
Ensure that IAM groups includes at least one IAM user
- This policy ensures that each IAM group within AWS has at least one IAM user, which strengthens the security posture by avoiding idle or unused IAM groups that can become potential attack vectors.
- By requiring at least one IAM user per group, auditing and monitoring of user activity becomes easier and more efficient as AWS logs activities at the user level. This helps in tracking events and identifying any unusual behavior or security incidents.
- Unused or idle IAM groups can lead to mismanagement of IAM policies. Therefore, ensuring a group has at least one user helps to streamline IAM policy management and reduces administrative overhead.
- Implementing this policy assists organizations in complying with best practices and industry standards for identity and access management. It aligns the AWS infrastructure with the principle of least privilege and reduces potential security risks.
Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks.
Ensure that auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks.
- Ensuring that auto Scaling groups are using Elastic Load Balancing health checks is crucial in maintaining consistent performance and availability of applications even when there are traffic spikes or failures in one or more instances. This policy guarantees the appropriate response in these situations for minimizing disruption and maintaining business continuity.
- Elastic Load Balancing health checks helps in the early detection of issues in any instance within an auto Scaling group. The load balancer periodically sends requests to its registered instances to test their status, and based on the received responses, it can redirect traffic away from unhealthy instances thus preventing potential service disruptions.
- By adhering to this policy, organizations ensure that instances under heavy load or faulty behavior are automatically replaced by the auto scaling feature, promoting seamless operation of their applications. This guarantees an automated, self-healing infrastructure without the need for manual intervention.
- This policy also has a significant role in cost optimization. By using Elastic Load Balancing health checks, auto Scaling groups can efficiently scale out and in, based on the load. This ensures resources utilization is proportional to the demands, and that unnecessary costs due to over-provisioning are avoided.
Ensure that Auto Scaling is enabled on your DynamoDB tables
Ensure that Auto Scaling is enabled on your DynamoDB tables
- Enabling Auto Scaling on DynamoDB tables helps manage costs by automatically adjusting read and write capacity units to match the demand pattern, thus avoiding under-provisioning that could degrade performance or over-provisioning that could result in unnecessary cost.
- The policy is critical in maintaining application availability as DynamoDB Auto Scaling delivers better read and write traffic management, which ensures high throughput and low latency, automatically scaling down in periods of low demand.
- Auto Scaling reduces the complexity of capacity management for large scale applications. Without the policy, developers must manually manage the provisioned capacity for each table and potentially juggle multiple different tables, which could lead to human error.
- Implementing this policy with Infrastructure as Code (IaC) via Terraform, allows for more reliable and consistent scaling operations, as the code can be version controlled, tested and repeated across different environments. It provides an easy and error-free way to enforce the policy.
Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup
Ensure that Elastic File System (Amazon EFS) file systems are added in the backup plans of AWS Backup
- The policy ensures that critical data stored in Elastic File System is regularly backed up, mitigating risks associated with data loss during incidents of system failures, human errors, or cyber-attacks.
- Implementation of the policy facilitates easier recovery of lost or corrupted data, thereby minimizing potential business downtime and thus, maintaining business continuity.
- Regular backup as per this policy enables a smoother transition in migration processes, as it allows for the seamless retrieval and integration of data into new systems.
- The policy aids in compliance with various data protection regulations that require organizations to have a robust data backup and recovery plan in place.
Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances
Ensure that all EIP addresses allocated to a VPC are attached to EC2 instances
- Ensuring all Elastic IP (EIP) addresses allocated to a VPC are attached to EC2 instances helps to optimize resource utilization, as unused EIPs can result in unnecessary costs.
- This policy aids in reducing the surface area for potential security attacks. Unattached EIPs can be exploited by cyber criminals to gain unauthorized access or launch attacks.
- It ensures smooth network traffic flow and helps in avoiding the accidental misrouting of network traffic to unconnected resources, improving the overall networking performance.
- Implementing this policy can lead to improved management and transparency of infrastructure resources, reducing the likelihood of inconsistencies or misconfigurations that can potentially compromise the security or functionality of the VPC.
Ensure that ALB redirects HTTP requests into HTTPS ones
Ensure that ALB redirects HTTP requests into HTTPS ones
- This policy is crucial for boosting website security by forwarding all incoming unsecured HTTP requests to secured HTTPS, thereby mitigating the risk of intercepting and altering communications between users and web services.
- Using HTTPS ensures that any data transmitted between the user and the website is encrypted and, thus, safeguards sensitive user information from potential cyber threats like eavesdropping or MITM (Man in the Middle) attacks.
- A successful implementation of this policy assures compliance with industry standards and regulations regarding data protection, leading to enhanced trust and striking a good rapport with customers and stakeholders.
- It provides an automatic security update to the aws_alb and aws_lb_listener entities without requiring any manual changes in the configurations, making the process more efficient and less prone to human error.
Ensure that all IAM users are members of at least one IAM group.
Ensure that all IAM users are members of at least one IAM group.
- This policy improves security by ensuring access permissions are managed at the group level, providing a streamlined approach to user permission management. Rather than individually assigning permissions to each user, they can be assigned to a group that individual users are part of.
- Having users as members of at least one IAM group reduces the risk of unauthorized access. In a scenario where an IAM user’s credentials are compromised, the unauthorized actor would only be able to perform actions that the user’s group(s) are permitted to perform.
- Compliance with the policy minimizes human error in granting permissions. Whenever new users are added, instead of needing to manually assign each necessary permission, the user can simply be added to an existing IAM group that has already been configured with the appropriate permissions.
- Implementing this policy encourages best practices for role assignment and management within AWS, aiding in adherence to the principle of least privilege. With users being in specific groups, it’s easier to ensure that they only have access to the resources they need, without excessive privileges.
Ensure an IAM User does not have access to the console
Ensure an IAM User does not have access to the console
- This policy prevents unauthorized access to highly secure interfaces and reduces the risk of a data breach. By restricting access to the AWS Management console, only necessary entities have the ability to modify system configurations.
- IAM User access to the console can result in changes made outside of the Terraform configurations. This can lead to configuration drift where the actual system state does not match the described state, increasing complexity and causing potential vulnerabilities.
- Removal of direct console access enforces the principle of least privilege. Any action taken is linked to a specific function or service, and no user gets more access than they need, which in turn reduces the potential surface area for potential attacks.
- It increases auditability and traceability because actions are made through applications, scripts, or services that log every request. It improves understanding of user actions and establishes strong accountability by associating actions with a unique identity.
Route53 A Record has Attached Resource
Route53 A Record has Attached Resource
- Ensuring that Route53 A Record has an attached resource is important because it helps prevent misconfigurations in AWS instances. If a domain name is associated without a corresponding resource, the DNS record does not resolve properly which could cause application accessibility issues.
- This policy promotes better compliance with domain name system (DNS) management best practices, as it mandates that each DNS record corresponds to an active and functional resource. This leads to an efficient, well-mapped, and easy-to-navigate DNS system.
- The policy can help to detect orphaned records which are potentially hazardous. They can be used for subdomain takeover vulnerabilities where an attacker claiming the unattached resource could redirect traffic intended for your site to their site.
- Being an infrastructure as code (IaC) policy implemented via Terraform, it makes the enforcement scalable and consistent across the organization’s infrastructure. IaC allows changes to be tracked, reviewed, and automatically applied, streamlining the process of keeping the DNS records in check.
Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled
Ensure Postgres RDS as aws_rds_cluster has Query Logging enabled
- Enabling query logging on Postgres RDS can assist in identifying inefficient and potentially harmful queries. This helps improve the performance of your database by allowing you to optimize or replace resource-intensive SQL commands.
- Logs provide a breach detection system by helping determine if unauthorized access or unusual activity has occurred on your database. In the event of suspicious activity, logs may be used to trace actions back to their source, thereby enhancing the security of your data.
- It supports auditing and compliance requirements. Regulatory policies often necessitate the tracking and auditing of database activities, and having query logging enabled helps in meeting those demands.
- The policy facilitates troubleshooting efforts. In case of app failure or any database-related issues, logs can help identify not just what went wrong, but also when it started, thereby allowing quicker resolution of problems.
Ensure public facing ALB are protected by WAF
Ensure public facing ALB are protected by WAF
- This policy is crucial in preventing unauthorized access to applications via the public-facing Application Load Balancer (ALB). By enforcing the use of a Web Application Firewall (WAF), it helps block harmful traffic or suspicious requests that could compromise the security of the application.
- The policy assists businesses in complying with various data security standards (like PCI DSS and HIPAA) that require WAF for public-facing web applications. Non-compliance may result in fines or penalties, or increased vulnerability to cyberattacks.
- Implementation of this policy through IaC (Infrastructure as Code) tools like Terraform enables consistent and repeatable protections across environments, reducing the likelihood of configuration errors that could leave an ALB unprotected.
- By reliably utilizing WAF in front of ALB, this policy also aids in protecting against common web-based attacks such as SQL Injection and Cross-Site Scripting (XSS), thus maintaining the integrity and availability of the application as well as protecting sensitive user data.
Ensure public API gateway are protected by WAF
Ensure public API gateway are protected by WAF
- This policy ensures that any public-facing API Gateway is protected by a Web Application Firewall (WAF), acting as a shield between the API and the rest of the internet. This reduces the risk of malicious attacks, such as SQL injection or cross-site scripting, thereby improving data security.
- The policy’s enforcement is significant for the optimal function of aws_api_gateway_rest_api and aws_api_gateway_stage, as they deal with the management and deployment of your APIs. With unsecured APIs, potential vulnerabilities could compromise your deployed stages and API resources.
- The implementation of this policy through Terraform’s Infrastructure as Code (IaC) can reduce the costs and resources involved in security management. IaC allows infrastructure changes to be tracked and monitored, ensuring that the setup of WAF protection is consistently applied across deployments.
- Failure to comply with this policy could lead to data breaches, loss of customer trust, and potential financial penalties if the compromised data includes personally identifiable information. Therefore, the requirement for WAF protection is critical, ensuring every public-facing API is secured following industry best practices.
Ensure Postgres RDS as aws_db_instance has Query Logging enabled
Ensure Postgres RDS as aws_db_instance has Query Logging enabled
- Enabling Query Logging in Postgres RDS allows capturing and analyzing all SQL queries that are sent to the database, enhancing the ability to monitor and troubleshoot performance issues.
- Query Logging is essential for detecting potentially malicious activity, as unusual queries could be indicative of a security breach or harmful behaviors, thus improving the overall security posture of the database.
- Ensuring Query Logging is enabled via Terraform allows for consistency and automation in security practices, reducing the risk of human error, and maximizing the efficiency in recurring infrastructure setups.
- By analyzing the logged queries, developers and data administrators can identify inefficiencies in the database requests, allowing for optimization opportunities, and enhanced system performance in the long run.
Ensure WAF2 has a Logging Configuration
Ensure WAF2 has a Logging Configuration
- By ensuring Web Application Firewall (WAF2) has a logging configuration, the policy enables the tracking of all incoming and outgoing traffic, providing detailed visibility and control over access and modifications. This assists in auditing and tracking suspicious behavior.
- Regular logs of WAF2 activity provide crucial data in real-time that can be used for identifying and understanding potential security incidents, breaches, or vulnerabilities in your resources.
- Compliance with regulatory measures and industry standards are often required for entities operating in specific industries. Having a logging configuration for WAF2 demonstrates an active measure to follow these norms and could prevent penalties for non-compliance.
- Implementing this policy helps save time and resources. In the event of a security event, instant access to detailed, well-structured logs can significantly reduce investigation and recovery time, offering detailed information on the incident.
Ensure CloudFront distribution has a response headers policy attached
Ensure CloudFront distribution has a response headers policy attached
- This policy ensures that the CloudFront distribution returns specific headers with each request, thereby improving control over the data served to users and assisting with compatibility and debugging issues.
- Attaching a response headers policy to CloudFront distributions helps to enhance the security of the content by implementing security headers such as Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and X-Content-Type-Options.
- By specifying this rule, the infrastructure as code (IaC) ensuring that every deployment of aws_cloudfront_distribution resource has the necessary response headers policy, mitigating the risk of human error and maintaining a consistent security standard across all distributions.
- If this policy is not enforced, it could lead to potential information leakage, unauthorized modification of content and cross-site scripting attacks, making your CloudFront distributions vulnerable and causing violations of data compliance standards.
Ensure AppSync is protected by WAF
Ensure AppSync is protected by WAF
- Ensuring AppSync is protected by Web Application Firewall (WAF) helps safeguard your applications from common web exploits that could affect application availability, compromise security, or consume excessive resources.
- This policy helps maintain a robust security system by mitigating the risk associated with potential security vulnerabilities, such as SQL injection and cross-site scripting attacks which can lead to data loss or compromises.
- AppSync’s integration with WAF additionally allows for constantly updating security rulesets to combat new threats, enhancing the reliability and security of the service.
- In the context of compliance, ensuring AppSync is protected by WAF will assist businesses in adhering to data-protection regulations and audit requirements, therefore avoiding potential penalties or reputational damage.
AWS SSM Parameter should be Encrypted
AWS SSM Parameter should be Encrypted
- Encrypting the AWS SSM Parameter enhances data security by protecting the information from unauthorized access. Any malevolent entity attempting to access the data would be unable to interpret it without the encryption key.
- Using encrypted AWS SSM Parameters protects sensitive data in transit or at rest, which is essential for meeting various regulatory and compliance requirements like GDPR, HIPAA, or PCI DSS. Non-compliance can lead to legal penalties and damage to the organization’s reputation.
- When implementing Infrastructure as Code (IaC) with Terraform, encrypted AWS SSM Parameters minimize the risk of data leaks, as parameters are often used to store sensitive configuration data like hostnames, passwords, API keys, or database strings.
- Without encryption, if an unauthorized party gains access to the AWS SSM Parameters, it will directly expose sensitive data and could potentially compromise the entirety of the AWS environment. Thus, enabling encryption limits the impact of security breaches by providing an additional layer of security.
AWS NAT Gateways should be utilized for the default route
AWS NAT Gateways should be utilized for the default route
- Utilizing AWS NAT Gateways for the default route helps in controlling the outbound traffic from subnets to the internet, enhancing security by creating a controlled point of egress.
- AWS NAT Gateways provide built-in redundancy and high availability which helps in maintaining the consistency and reliability of services thus improving infrastructural resilience.
- By using AWS NAT Gateways, all instances in a private subnet can share one NAT gateway, reducing the operational complexity, interoperability hurdles and the level of security management.
- Implementing this policy will ensure organizations align with AWS best practices for route tables and network traffic management, thereby reducing the chance of data breaches through misconfigurations.
Ensure terraform is not sending SSM secrets to untrusted domains over HTTP
Ensure terraform is not sending SSM secrets to untrusted domains over HTTP
- This policy aims to prevent the exposure of SSM secrets during transmission over HTTP, which is not secure, thus significantly reducing the risk of sensitive data getting intercepted or compromised by malicious actors.
- Implementing this policy helps to meet compliance regulations and maintain data privacy as transmitting secrets over unsecured HTTP can violate laws and regulations related to data security that can result in substantial penalties.
- The rule emphasizes the importance of adopting secure communication protocols like HTTPS when transmitting critical data. Communicating over HTTPS, in contrast to HTTP, uses encryption to protect the information from being read by anyone except the intended recipient.
- Failing to adhere to this policy can potentially end up with an unauthorized third-party gaining access to sensitive system parameters, jeopardizing the system’s stability and potentially causing significant disruptions to the entire infrastructure operations.
Ensure CodeCommit associates an approval rule
Ensure CodeCommit associates an approval rule
- Ensuring CodeCommit associates an approval rule increases the security and reliability of code modifications. It requires changes to be reviewed and approved by designated authorities before they can be merged, reducing the risk of inappropriate or harmful changes being introduced.
- This policy helps in maintaining the quality of code by enforcing a peer review process before any code changes are propagated. This eliminates the chances of bad code being merged into the larger codebase, which can impact the functionality or security of the entire system.
- The policy instills best practices within the team by ensuring that code is always reviewed by someone other than the person who wrote it. This practice can contribute to improved code readability, maintainability, and reduces instances of single-points-of-failure in knowledge.
- The policy benefits compliance and audit requirements by leaving an audit trail of code change approvals. This can be reviewed to ensure adherence to corporate standards and regulatory or certification requirements pertaining to quality control and change management.
Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones
Ensure Domain Name System Security Extensions (DNSSEC) signing is enabled for Amazon Route 53 public hosted zones
- Enabling DNSSEC signing for Amazon Route 53 public hosted zones is crucial to protect against DNS spoofing. DNS spoofing is a type of cyber attack where false DNS responses are introduced into a DNS resolver’s cache, causing the resolver to send a user to a fake website every time they enter the legitimate site’s URL.
- The DNSSEC signing adds an extra layer of authentication by digitally signing the DNS data, thereby ensuring data integrity and source validation, which would be compromised if left disabled. This data encryption protects users from malicious entrapment such as phishing.
- Without DNSSEC signing, there would be no means to verify the DNS data’s authenticity when a user enters a domain name. This can result in sensitive information being accessed or modified by unauthorized individuals, resulting in potentially disastrous outcomes such as financial or data loss.
- It further helps in maintaining the brand’s reputation by providing users a secure environment to interact with the website or service, as it may deter users if their data or privacy is breached, resulting in potential loss of traffic or customers. On the other side, ISPs or customers are more likely to trust and favor DNSSEC-enabled websites.
Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones
Ensure Domain Name System (DNS) query logging is enabled for Amazon Route 53 hosted zones
- Enabling DNS query logging for Amazon Route 53 hosted zones assists in monitoring and troubleshooting DNS traffic, tracking down potential malicious activities, or diagnosing configuration issues.
- This policy implementation will allow transparency into the request patterns to the hosted domains, providing valuable insights into the accessibility and popularity of different resources within the infrastructure.
- It improves incident response capabilities by allowing admins to gain insights into the exact nature, time, and source of the DNS requests - an essential feature in case of an attack or breach.
- The use of Infrastructure as Code (IaC) through Terraform for implementing this policy ensures reproducibility, reducing the chance of errors, ensuring consistent configuration across multiple domains, and facilitating automation of resource creation.
Ensure AWS IAM policy does not allow full IAM privileges
Ensure AWS IAM policy does not allow full IAM privileges
- Ensuring AWS IAM policy does not allow full IAM privileges helps to reduce the risk of unauthorized access and data breaches. By limiting the powers of each IAM role, you make sure that even if an attacker somehow gains access to your AWS account, they will not have full control over all resources.
- The existence of full IAM privileges within your AWS infrastructure makes it difficult to track and manage access to resources. It violates the principle of least privilege, which states that an entity must be able to access only the information and resources necessary for its legitimate purpose.
- Implementing this policy aids in cloud governance and compliance. There might be legal and regulatory standards against giving unlimited access to your data and services, so by preventing full IAM privileges, you ensure your organization remains compliant and avoids potential fines or legal issues.
- Granting full access means that any mistake or misconfiguration could potentially result in large-scale problems. For example, an erroneously executed command could delete all of your resources, or a misconfigured access control could expose your data publicly. By limiting permissions, you’re reducing the likelihood of such catastrophic errors.
Ensure an IAM role is attached to EC2 instance
Ensure an IAM role is attached to EC2 instance
- Ensuring an IAM role is attached to EC2 instances can help to limit possible security vulnerabilities by granting the instances only the precise permissions they need to function, not overly permissive credentials.
- This policy can provide the necessary access controls that help reduce the risk of unauthorized operations being performed, enhancing the security of the infrastructure.
- With IAM roles assigned to EC2 instances, secure access to AWS services can be managed without having to share or manage AWS credentials, aiding in efficient and secure operations.
- Enforcing this policy can aid in tracking and auditing incidents because actions taken by the EC2 instance can be traced back to the associated IAM role, which can assist in incident response and compliance reports.
Ensure AWS CloudFront distribution uses custom SSL certificate
Ensure AWS CloudFront distribution uses custom SSL certificate
- This policy ensures that the CloudFront distribution utilizes a custom SSL certificate, which enables secure communication and guarantees the legitimacy of the served content, offering better trust and reliability for the end users.
- Utilizing a custom SSL certificate enables the organization to have more control over certificate management, such as expiration and renewal, ensuring continuous secure connections.
- Non-compliance to this policy might expose the CloudFront distributions to potential security threats such as man-in-the-middle attacks, where malicious entities can intercept and possibly alter the communication between the user and the server.
- Custom SSL certificates enhance detection of any unauthorized changes to the distribution or resource. If an attacker attempts to serve content from another server, they will not have the matching certificate, immediately flagging the change.
Ensure S3 Bucket does not allow access to all Authenticated users
Ensure S3 Bucket does not allow access to all Authenticated users
- This policy is crucial as it prevents broad access to S3 buckets thereby enhancing security. By restricting access to all authenticated users, it mitigates the risk of unauthorized access and data breaches.
- Access to all authenticated users isn’t usually required for business needs, so limiting this access helps to maintain the principle of least privilege. This principle states that a user should be given the minimum levels of access necessary to complete their tasks.
- A breach of an S3 bucket with access allowed to all authenticated users could expose a significant amount of confidential and sensitive data. This can lead to not only data loss but also compliance issues if regulations like GDPR, HIPAA, etc., are violated.
- Implementing this policy through Terraform makes it easier to integrate into Infrastructure as Code (IaC) workflows. This allows for consistent application of the policy across multiple S3 buckets and streamlines the security process in an automated way.
Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic
Ensure AWS route table with VPC peering does not contain routes overly permissive to all traffic
- The policy ensures data and network security by preventing unrestricted all-traffic access over the AWS route table and VPC peering. This guards against unauthorized access or data breach from potential attackers.
- Preventing overly permissive routes limits the exposure of resources and nodes in the network, thereby reducing possible attack vectors and increasing the resilience of the system.
- The policy encourages the principle of least privilege in network security configurations, allowing only necessary accesses and routes, thereby enhancing the overall security posture of the application in cloud environments.
- Non-compliance with this policy could lead to regulatory issues for organizations under strict compliance control such as GDPR, HIPAA, or PCI-DSS, potentially resulting in legal consequences or fines.
Ensure AWS Config recorder is enabled to record all supported resources
Ensure AWS Config recorder is enabled to record all supported resources
- Ensuring AWS Config recorder is enabled to record all supported resources allows for continuous monitoring and assessment of AWS resource configurations, aiding in identifying and fixing security vulnerabilities.
- With AWS Config recorder, auditable records of all important changes to the AWS resources are kept, allowing detailed forensic investigations when necessary, and helping to keep in compliance with data governance and privacy requirements.
- If not enabled, it will become challenging to track modifications in the resource configurations over time, potentially leading to difficulty in detecting unauthorized changes or security incidents.
- It improves system transparency by enabling detailed insight into resource configuration histories and relationships, improving incident response times and aiding in optimizing resource usage.
Ensure AWS CloudFront Distribution with S3 have Origin Access set to enabled
Ensure AWS CloudFront Distribution with S3 have Origin Access set to enabled
- Enabling Origin Access Identity (OAI) on AWS CloudFront Distributions that use S3 as an origin ensures that only CloudFront can access the S3 bucket, providing an extra layer of security.
- Allowing direct access to the S3 content bypassing CloudFront could lead to unauthorized data exposure or alteration. OAI prevents such security breaches, as the content in the S3 bucket can be accessed only through the CloudFront distribution and not by directly pointing to the S3 URL.
- Implementing this policy as an infrastructure-as-code (IaC) practice via Terraform contributes to a more secure, consistent, and maintainable infrastructure setup. It allows changes to be version-controlled, reproducible and scalable.
- Non-compliance with this policy may result in increased costs due to data transfer outside of CloudFront, potential denial of service (DoS) attacks, and could harm the business reputation if sensitive data is exposed publicly.
Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability
Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability
- This policy ensures AWS CloudFront utilizes AWS WAFv2 with AMR (Automatic Mitigation Rules) configured for the Log4j Vulnerability. It protects your system against this widespread and critical security flaw which if exploited, can allow unauthorized remote code execution, potentially leading to data breaches or system takeovers.
- The link provided is a Terraform script implementation that codifies this security measure, providing readily reproducible, human-readable, and version-controllable infrastructure configurations. It simplifies the process of implementing and deploying this important security policy across multiple or large-scale environments.
- The policy specifically targets two AWS resources: aws_cloudfront_distribution and aws_wafv2_web_acl. These are integral components of your AWS infrastructure which handle content delivery network services and web application firewall protection respectively. Ensuring they are properly configured helps enhance your overall AWS infrastructure security.
- Violations of this policy can expose your web applications to attacks, which is detrimental to your infrastructure security posture. Compliance not only reduces the risks of cybersecurity threats but also demonstrates adherence to security best practices, satisfying regulatory requirements and reputational assurances for stakeholders.
Ensure AWS Config must record all possible resources
Ensure AWS Config must record all possible resources
- This infra security policy ensures that all AWS resources are continuously monitored and audited. It provides a comprehensive view of the configuration of every AWS resource in the environment and how these resources are related to one another and tracks any changes.
- Recording all resources ensures that no changes or activities are missed, which can strengthen the overall security posture by enabling faster detection and response to changes that could represent security risks or non-compliance.
- This policy allows for easier auditing, as all historical data regarding resource creation, deletions, and modifications are stored and traceable. This can help in finding configuration issues, understanding the repercussions of changes, or recovering from operational mistakes.
- Since it uses Infrastructure as Code (IaC) approach, it promotes a more streamlined, repeatable, and automated configuration management process. Implementing the policy with Terraform reduces manual effort, minimizes error probability, and ensures uniformity in security controls across all resources.
Ensure AWS Database Migration Service endpoints have SSL configured
Ensure AWS Database Migration Service endpoints have SSL configured
- Ensuring AWS Database Migration Service endpoints have SSL configured is crucial for securing data during transmission. SSL encrypts the data, preventing unauthorized access or alterations during transfer between systems.
- Maintaining this policy helps in compliance with industry-standard security regulations and certifications. Many of these regulations, such as GDPR or HIPAA, mandate the encryption of data in transit. SSL configuration fulfills this requirement.
- Non-adherence to this policy can result in sensitive data being exposed during migration, possibly leading to data breaches and significant reputational damage for businesses.
- With the Infrastructure as Code (IaC) tool like Terraform, regular checks can be automated to ensure SSL is configured for all Database Migration service endpoints, significantly reducing the chances of human error in security setup.
Ensure AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to enabled
Ensure AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature set to enabled
- This policy is crucial as it ensures the high availability of the ElastiCache Redis cluster. By enabling the Multi-AZ Automatic Failover feature, services will continue running even if one or more cache nodes fail, thus minimizing disruption.
- The automatic failover feature is instrumental in safeguarding against single point of failure scenarios. In such events, AWS will automatically detect the failure, promote a read replica to be the new primary, and restore service operation with limited impact on performance.
- With the implementation of this policy, recovery time in case of failure is drastically reduced. AWS ElastiCache automatically handles the recovery process which could be a time-consuming and error-prone process if done manually.
- Ensuring this policy can help to minimize the potential loss of critical, high-speed cache data stored in ElastiCache Redis clusters. Keeping the Multi-AZ Automatic Failover feature always enabled helps organizations maintain business continuity even in the event of unexpected catastrophes.
Ensure AWS API Gateway endpoints uses client certificate authentication
Ensure AWS API Gateway endpoints uses client certificate authentication
- Enabling client certificate authentication on AWS API Gateway endpoints increases security by allowing only authenticated clients to establish a connection and access the data, preventing unauthorized access.
- The policy ensures that all data transmitted between the client and the server is encrypted and therefore protected against threats like eavesdropping, providing an extra layer of security on top of standard HTTPS communication.
- If the API Gateway endpoints do not use client certificate authentication, it will lead to vulnerabilities to man-in-the-middle (MITM) attacks and unauthorized access to sensitive or confidential information.
- Implementing this policy using Infrastructure as Code (IaC) tool like Terraform allows for automation and scalable rollout across all infrastructure, ensuring efficient and widespread application of critical security configurations and increased overall infrastructure security stance.
Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled
Ensure AWS ElasticSearch/OpenSearch Fine-grained access control is enabled
- The policy ensures that only authorized individuals have access to the ElasticSearch/OpenSearch Domain, protecting it against unauthorized usage or accidental modification which can compromise system integrity and performance.
- By enabling Fine-grained access control, the policy allows for more precise control over user and group permissions, significantly enhancing the security posture of the ElasticSearch/OpenSearch Domain.
- The policy aids in maintaining compliance with industry standards and regulations which mandate stringent control over data access, thus mitigating any legal or compliance risks.
- Through ensuring role-based access controls, the policy is instrumental in preventing potential data leaks or breaches by limiting the exposure of sensitive information within the AWS ElasticSearch/OpenSearch domain.
Ensure AWS API gateway request is validated
Ensure AWS API gateway request is validated
- The policy ensures that all incoming requests to the AWS API Gateway are validated, thus preventing unauthorized or malformed requests from passing through, protecting underlying services and resources from potential abuse or harm.
- Enforcing request validation in the API gateway provides the first line of defence. It can prevent invalid requests from consuming unnecessary resources, thereby improving the overall performance and efficiency of the system.
- Validation at the API gateway level is useful for enforcing consistent validation rules across multiple services, which in turn simplifies the process of ensuring and demonstrating compliance with relevant laws and regulations.
- Without this policy, there could be instances where a malicious or erroneous request is processed, leading to possible faulty functions, data breaches, or denial of service attacks. Ensuring request validation helps mitigate these security incidents.
Ensure AWS CloudFront distribution is using secure SSL protocols for HTTPS communication
Ensure AWS CloudFront distribution is using secure SSL protocols for HTTPS communication
- This policy ensures that all data transmitted between the AWS CloudFront distribution and clients is encrypted using HTTPS, substantially reducing the risk of data being intercepted and compromised by unauthorized parties.
- It verifies the use of secure SSL protocols which mitigate the vulnerabilities associated with older, less secure ones, making it harder for malicious actors to exploit potential weaknesses during data transmission.
- Applying this policy can safeguard cloud content, maintain user trust, and meet compliance requirements that mandate the use of secure connections for data transmission.
- Non-compliance with this policy could lead to data breaches, potential regulatory penalties, and reputational harm if insecure communications are exploited by cybercriminals.
Ensure AWS EMR cluster is configured with security configuration
Ensure AWS EMR cluster is configured with security configuration
- Ensuring the AWS EMR cluster is configured with security configuration is important because it enables the protection of data and operations in EMR clusters against malicious activities, reducing the potential security threats.
- This policy ensures that sensitive data is encrypted both in-transit and at-rest. Without the proper security configuration, data could potentially be intercepted or accessed by unauthorized individuals.
- Implementing this policy leads to adherence to best practices and compliance with many regulatory requirements on data security, contributing to the overall governance, risk management, and compliance strategies of an organization.
- The non-compliance of this policy can cause serious vulnerabilities, leading to breaches that may result in fines, damage to the organization’s reputation, and loss of trust from customers and stakeholders.
Ensure AWS Managed IAMFullAccess IAM policy is not used.
Ensure AWS Managed IAMFullAccess IAM policy is not used.
- This policy is important because the IAMFullAccess policy in AWS provides extensive permissions that can potentially be exploited if granted to the wrong entities, putting your AWS resources at risk.
- Applying this policy can prevent unwarranted access control. If this full access policy is wrongly used, it can give an entity full access rights, potentially making them a super administrator who can create, edit, and delete all IAM roles and resources without checks or restrictions.
- This policy’s implementation using Terraform ensures that infrastructure is defined and provided as code, making it easier to review, audit and adhere to security configurations, and avoid human error in security configurations.
- By implementing this rule and avoiding using the IAMFullAccess policy, there’s a heightened degree of data protection, a decrease in the chance of a data breach, and it strengthens an organization’s strategy towards complying with data privacy regulations.
Ensure Secrets Manager secrets should have automatic rotation enabled
Ensure Secrets Manager secrets should have automatic rotation enabled
- Enabling automatic rotation in Secrets Manager minimizes the risk of sensitive data being compromised due to prolonged periods of exposure, improving the overall security stance of your AWS assets.
- Automatic secrets rotation ensures that credentials are frequently refreshed, which can prevent unauthorized access due to lost or stolen credentials as they will quickly become obsolete.
- The constant changing of credentials reduces the possibility of password cracking or other brute force attacks, providing an additional layer of security for your AWS services and applications.
- By having this policy in place, compliance with strict security regulations and standards can be ensured, which may require periodical rotation of sensitive information such as passwords and API keys.
Ensure AWS Neptune cluster deletion protection is enabled
Ensure AWS Neptune cluster deletion protection is enabled
- Enabling AWS Neptune cluster deletion protection prevents accidental deletion of the database, ensuring that important and sensitive data is not lost due to inadvertent operations or automation scripts.
- This policy encourages strong infrastructure as code (IaC) practices. Using Terraform to automate enabling deletion protection on a Neptune cluster reduces manual effort and streamlines compliance across multiple resources.
- The safer administration of databases lowers the risk of data breaches and mishandling which can have major financial consequences and even damage the company’s reputation.
- Having a deletion protection enhances data longevity, enabling businesses to perform historical analysis and trends prediction over an extended period which leads to better data-driven decision-making and strategy development.
Ensure ElasticSearch/OpenSearch has dedicated master node enabled
Ensure ElasticSearch/OpenSearch has dedicated master node enabled
- Enabling a dedicated master node in ElasticSearch/OpenSearch ensures the stability of the cluster by preventing the master node from getting overloaded with tasks, thus enhancing the reliability and performance of the system.
- A dedicated master node aids in stronger consensus during recovery and rebalancing operations, which helps maintain data integrity and consistency in the cluster.
- This policy to enable dedicated master node increases the resilience of ElasticSearch/OpenSearch clusters to failures, reducing the risk of data loss or service downtime by minimizing effects of node failures.
- In Infrastructure as Code (IaC) environment like Terraform, adherence to this policy ensures automated and uniform configuration across clusters, making the system operationally efficient and easier to manage.
Ensure RDS instance with copy tags to snapshots is enabled
Ensure RDS instance with copy tags to snapshots is enabled
Ensure that an S3 bucket has a lifecycle configuration
Ensure that an S3 bucket has a lifecycle configuration
- Ensuring an S3 bucket has a lifecycle configuration is critical in managing objects efficiently and cost-effectively by automatically transitioning them to less expensive storage classes or archiving them over time.
- Without a lifecycle policy, old and rarely accessed data can accumulate, leading to higher storage costs. Hence, S3 bucket Lifecycle policies reduce costs by automatically moving data that is rarely accessed to less expensive storage classes.
- A lifecycle configuration also allows for automatic deletion of data that is no longer needed after a certain period, helping with data governance and compliance requirements.
- Unmanaged data in S3 buckets could potentially lead to security vulnerabilities or data breaches if the data is sensitive or unencrypted. Lifecycle configurations can ensure that unneeded data is promptly and securely disposed of.
Ensure S3 buckets should have event notifications enabled
Ensure S3 buckets should have event notifications enabled
- Enabling event notifications on S3 buckets is crucial as it alerts the administrators about any changes or activities in the bucket, increasing visibility and enabling faster response to potential security threats or data breaches.
- S3 bucket event notifications contribute to maintaining data integrity by triggering workflows or automated processes in response to specific events, ensuring that any modifications, deletions, or other activities do not go unaddressed.
- With this policy, all S3 bucket operations are monitored which assists in auditing and regulatory compliance needs by keeping a record of all actions performed on the data, who performed them, and when they were performed.
- The policy of enabling event notifications reduces the reliance on manual checking and lowers the risk of human error, as it utilizes Terraform and AWS S3 bucket resource to automate notifications for any changes, ensuring improved security and efficiency.
Ensure Network firewall has logging configuration defined
Ensure Network firewall has logging configuration defined
- Ensuring that Network firewalls have a defined logging configuration is crucial as it allows for the tracking and recording of network traffic. This comprehensive log of network activities will serve as valuable data for analysis in case of security incidents and potential breaches.
- Implementing this policy facilitates detailed auditing, thereby keeping track of all inbound and outbound network connections. It provides insights into security threats and potential vulnerabilities in aws_networkfirewall_firewall by correlating the events logged.
- The IaC - Terraform automates the deployment of this logging configuration, ensuring consistent policy application across all network firewall instances and decreasing the room for human errors.
- Without a defined logging configuration, the firewall might allow certain unauthorized access or network events to go unnoticed, posing a severe security risk. Hence, this policy assures continuous compliance with security protocols, enhancing the overall resilience of the infrastructure.
Ensure KMS key Policy is defined
Ensure KMS key Policy is defined
- Ensuring a KMS key Policy is defined helps in managing cryptographic keys that are used to encrypt data. Undefined key policies leave resources vulnerable to unintended access or use.
- The policy’s importance also lies in reinforcing role-based access control (RBAC) for the entities ‘aws_kms_key’, by validating who can use the keys and for what operations, therefore enhancing security and user account management in the AWS environment.
- Clear definitions of the KMS key policy are pivotal in enforcing AWS security best practices. They enable the application, tracking and auditing of robust security policies across the infrastructure, particularly when dealing with sensitive data.
- By using Infrastructure as Code (IaC) like Terraform, automating the definition of KMS key policies enhances operational efficiency as well as the overall security posture by reducing human errors and inconsistencies in configuration.
Ensure access control lists for S3 buckets are disabled
Ensure access control lists for S3 buckets are disabled
- The policy of disabling access control lists (ACLs) for S3 buckets ensures that only the intended users or roles have access to bucket data, thus minimizing the risk of unauthorized access or data leakage.
- By strictly enforcing ownership control, this policy enhances accountability as it provides a clear ownership trail which can be helpful during internal access audits or in the case of a security breach investigation.
- ACLs when enabled can complicate permission management and lead to security flaws due to misconfiguration or oversight. Therefore, disabling ACLs in favor of bucket policies and IAM roles can lead to a more robust security configuration.
- This policy impacts cost management as unauthorized access could lead to unexpected data transfer or storage usage charges. Ensuring that ACLs are disabled helps in optimizing AWS S3 costs by ensuring only authorized users/roles can perform operations on the data.
Ensure MWAA environment is not publicly accessible
Ensure MWAA environment is not publicly accessible
- Ensuring that the MWAA environment is not publicly accessible is essential to prevent unauthorized access or cyber attacks. A publicly accessible MWAA can be a vulnerability point for potential hackers or malicious users.
- Limiting access to the MWAA environment significantly reduces the potential attack surface, decreasing the chances of data breaches. If the environment is not private, sensitive information such as client data or system configurations could be exposed.
- By implementing this policy through Infrastructure as Code (IaC) using Terraform, it ensures consistent and repeatable outcomes, drastically reducing the risk of human error. This helps maintain a robust and secure AWS ecosystem.
- The AWS MWAA environment in particular should be kept private as it hosts critical workflows, serverless workflows, and data processing tasks. If compromised, it may lead to disruption of operation or misuse for harmful activities.
Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)
Ensure Azure Instance does not use basic authentication(Use SSH Key Instead)
- Ensuring Azure Instances do not use basic authentication is important because it protects sensitive information by using encryption, which makes it harder for attackers to access the data. With a SSH key, only those with the correct private key can decipher the encryption and gain access.
- SSH keys are typically more secure and complex than basic passwords, providing a higher level of security for Azure Instances. This reduces the risk of brute force attacks where attackers try multiple password combinations to gain access.
- This policy ensures compliance with best practices and industry standards for secure access management. Organizations that do not comply are at risk of not meeting regulatory compliance requirements, which can lead to penalties.
- Enforcement of this policy can mitigate potential security incidents, thereby reducing the potential financial and operational loss associated with data breaches, system downtime, and reputational damage.
Ensure Azure managed disk have encryption enabled
Ensure Azure managed disk have encryption enabled
- Encrypting Azure managed disks ensures that data at rest is protected from unauthorized access, increasing data privacy and regulatory compliance.
- The policy helps to satisfy the requirements of various regulatory standards, such as GDPR, HIPAA, and PCI-DSS, which mandate encryption of data at rest.
- If the Azure managed disks are not encrypted, it could lead to data breaches or leaks, making sensitive information vulnerable to attackers.
- Enabling disk encryption has minimal impact on disk performance, thus ensuring security without compromising user experience or system efficiencies.
Ensure that 'supportsHttpsTrafficOnly' is set to 'true'
Ensure that 'supportsHttpsTrafficOnly' is set to 'true'
- Ensuring ‘supportsHttpsTrafficOnly’ is set to ‘true’ secures sensitive data by enforcing the use of HTTPS - a more secure protocol compared to HTTP - for all incoming and outgoing data traffic in the storage accounts. This is crucial for entities like Microsoft.Storage/storageAccounts and azurerm_storage_account where a large amount of data is stored.
- This policy reduces the risk of man-in-the-middle attacks, where unauthorized individuals can intercept and possibly alter the communication between two parties. With ‘supportsHttpsTrafficOnly’ set to ‘true’, all data transferred is encrypted, making it largely unintelligible to those without the correct decryption keys.
- By implementing this policy, compliance with various data security regulations and standards, like GDPR, can be assured. Many of these regulations mandate data in transit to be encrypted, which is achieved through setting ‘supportsHttpsTrafficOnly’ to ‘true’.
- In the case of infrastructure as code (IaC) approach using ARM (Azure Resource Manager), setting this rule can help in standardizing the security configurations across multiple storage accounts under different deployments, thus ensuring consistency and homogeneity in security settings. This link, StorageAccountsTransportEncryption.py, provides the implementation details for this rule.
Ensure AKS logging to Azure Monitoring is Configured
Ensure AKS logging to Azure Monitoring is Configured
- This policy ensures that all Azure Kubernetes Service (AKS) activities are monitored and logged, which helps in auditing, debugging, and identifying patterns for applications running on the cluster.
- Enabling AKS logging to Azure Monitor provides critical insights about your Kubernetes environments including performance and health metrics, thereby enhancing stability and performance.
- By ensuring AKS logging is configured, administrators are able to respond promptly to critical alerts, incidents, and troubleshoot potential issues effectively, thus minimizing the operational downtime.
- The policy aligns with regulatory compliance requirements for data storage and processing infrastructures. Firms that operate under data sensitive regulations can remain compliant by maintaining comprehensive logs of their infrastructure.
Ensure RBAC is enabled on AKS clusters
Ensure RBAC is enabled on AKS clusters
- Ensuring Role-Based Access Control (RBAC) is enabled on Azure Kubernetes Service (AKS) clusters is vital for maintaining secure access. RBAC allows you to granularly control who can do what within your clusters, limiting potential security risks.
- Without RBAC, all users with access to the cluster have root-level privileges, allowing them to execute any command. This could lead to misuse, either accidentally or maliciously, making the setting vital for proper risk management.
- Enforcing the policy helps an organization adhere to best practices for infrastructure security by centralizing the management of privileged access and simplifying the process for auditing access controls, which is useful for compliance.
- The impact of not having RBAC enabled can be severe including data breaches, accidental changes, downtime, and even complete compromise of the Kubernetes cluster, which underlines the importance of this policy.
Ensure AKS has an API Server Authorized IP Ranges enabled
Ensure AKS has an API Server Authorized IP Ranges enabled
Ensure AKS cluster has Network Policy configured
Ensure AKS cluster has Network Policy configured
- The policy ensures the secure interaction between pods in a Kubernetes cluster, limiting the exposure of services to only those necessary for the application, and preventing potential attacks from compromised pods.
- Network policies act as internal firewalls for applications deployed on the AKS clusters, allowing administrators to enforce ingress and egress rules, helping to keep deployments isolated even when they share the same network segment.
- Non-compliance to the policy may introduce vulnerabilities by allowing unauthorized network connections to pods, which could lead to unauthorized data exposure or manipulations.
- The policy governs resources implemented in Azure Resource Manager (ARM), specifically pertaining to Microsoft.ContainerService/managedClusters and azurerm_kubernetes_cluster, ensuring that settings applied at these levels propagate throughout the entire Kubernetes environment.
Ensure Kubernetes Dashboard is disabled
Ensure Kubernetes Dashboard is disabled
- The Kubernetes Dashboard is a user interface that offers visibility into the Kubernetes infrastructure. However, when enabled, it can be a potential threat as it may expose sensitive data and increase the attack surface area, hence disabling it enhances the security posture.
- The policy to disable Kubernetes Dashboard helps in minimizing the risk of unauthorized users gaining access to the system, thus ensuring integrity of the Kubernetes cluster managed by Microsoft.ContainerService.
- Compliance with this security policy can reduce the potential for data breaches and other malicious activities by restricting direct access to cluster resources through the Kubernetes Dashboard.
- Disabling the Kubernetes Dashboard will also limit the likelihood of misconfigurations happening from the user end, ensuring that infrastructure configuration stays compliant with Infrastructure as Code (IaC) practices.
Ensure that RDP access is restricted from the internet
Ensure that RDP access is restricted from the internet
- Restricting Remote Desktop Protocol (RDP) access from the internet minimizes the attack surface for potential security breaches, as it denies bad actors attempt to exploit vulnerabilities over this protocol.
- Unrestricted RDP access can pose a significant threat, as attackers could gain unauthorized access and control over resources, potentially causing data theft and disrupting business operations.
- It can protect the intranet and the inter-communication between resources in Microsoft.Network/networkSecurityGroups, which contain virtual machines and other cloud services, directly affecting their security posture.
- Considering this infrastructure is orchestrated as code via Azure Resource Manager (ARM), ensuring RDP access is restricted is good practice for maintaining secure and compliant IaC configurations.
Ensure that SSH access is restricted from the internet
Ensure that SSH access is restricted from the internet
- Restricting SSH access from the internet is crucial to prevent unauthorized access and potential security breaches, as SSH usually grants full control over the systems it is connected to.
- An open SSH could be the target of brute-force attacks, where attackers try countless combinations of usernames and passwords to gain access, hence the restriction mitigates such security risks.
- By having this policy in place, it enables an additional security layer, ensuring that only authorized network traffic, ideally from trusted networks, is allowed, providing a more controlled environment.
- The policy affects entities such as network security groups and security rules in a Microsoft Network, providing a focused approach for managing network traffic and enhancing the overall infrastructure security strategy.
Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
Ensure no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)
- This policy prevents unauthorized access to your SQL databases by restricting ingress from all IP addresses, thereby strengthening the security of your data. It specifically helps in safeguarding sensitive information stored in the databases.
- By limiting access only to trusted and known IP addresses, it significantly reduces the risk of SQL injection attacks, where malicious SQL code is inserted into a database query.
- This policy validates the principle of least privilege, meaning that a user or process will have only the bare minimum privileges necessary to complete their job function, which serves as an effective measure in data breach prevention. -_SQL databases that allow ingress from ANY IP can be exploited by bad actors to steal, alter or destroy data, cause a denial of service, or execute arbitrary code. Having this policy in place reduces the potential attack surface and protects against such threats.
Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
Ensure that Network Security Group Flow Log retention period is 'greater than 90 days'
- Ensuring a Network Security Group Flow Log retention period of more than 90 days allows for extended incident response capabilities. It gives security teams broader visibility into past events and a better chance to identify and investigate unusual activity.
- A retention period greater than 90 days enables organizations to comply with various legal, industry, or corporate governance rules that demand extended log retention periods for IT security and audit purposes.
- This policy instantly alerts for any violation, hence providing a robust defense mechanism. Proactive notification of a less than 90-day retention policy allows quick remediation before it can be exploited or creates compliance issues.
- By using Infrastructure as Code (IaC) service to ensure this policy, organizations can automate the process, reducing manual effort and the risk of human error, thereby improving the overall security and reliability of the infrastructure.
Ensure App Service Authentication is set on Azure App Service
Ensure App Service Authentication is set on Azure App Service
- This policy ensures that authentication is enforced on Azure App Services, helping to prevent unauthorized access to these services. This protects sensitive data and other resources that may be accessible through the app service.
- By enabling Azure App Service Authentication, user identities can be better managed and controlled. This allows for user-specific permissions and access levels, enhancing the overall security of the app service.
- Without this policy, unauthenticated users could exploit vulnerabilities of the app service, leading to potential data breaches or other cyber attacks. Therefore, this policy plays a crucial role in minimizing such security risks.
- The policy applies to different types of Azure App Services including azurerm_app_service, azurerm_linux_web_app, and azurerm_windows_web_app, which makes it important for maintaining uniform and centralized security standards across different platforms and technologies within Azure cloud.
Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service
Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service
- This policy helps to ensure all information sent from and to the web app is encrypted, enhancing data security by preventing unauthorized access to sensitive information during transmission.
- Enforcing this rule aids compliance with stringent data protection regulations that require secure transmission of data, ensuring businesses avoid heavy fines associated with non-compliance.
- Implementing this policy reduces the vulnerability of data transfer to man-in-the-middle attack, where attackers intercept and alter communication between two parties without their knowledge.
- Not redirecting HTTP traffic to HTTPS can lead to degraded search engine rankings, as search engines prefer secure websites. Thus, adhering to this policy can help increase organic website traffic.
Ensure web app is using the latest version of TLS encryption
Ensure web app is using the latest version of TLS encryption
- Ensuring that web apps use the latest version of TLS encryption is crucial for protecting sensitive data from being intercepted during transit. It adds an extra layer of security that makes it harder for unauthorized users to access the data.
- The policy will help in complying with industry standards and regulations that demand the implementation of strong encryption mechanisms. Non-compliance can lead to legal penalties, damage to the organization’s reputation and loss of customer trust.
- This policy ensures that the web apps are less vulnerable to attacks like packet sniffing, session hijacking and man-in-the-middle attacks which can lead to data breaches and system compromises.
- By implementing the latest version of TLS, the web app can benefit from the improved performance, better error reporting and streamlined handshaking processes compared to its predecessor SSL or earlier versions of TLS, contributing to a better user experience.
Ensure that Register with Azure Active Directory is enabled on App Service
Ensure that Register with Azure Active Directory is enabled on App Service
- Enabling Register with Azure Active Directory on App Service ensures secure access management by allowing only authorized users or services to access a web app, providing an additional layer of security.
- It prevents unauthorized modifications to the web applications, reducing the risk of unwanted changes or potential breaches resulting from such alterations that can compromise the overall security infrastructure.
- The policy aids in detailed auditing as registered users’ activities can be logged and monitored, aiding in identifying any security gaps or suspicious actions.
- Compliance with this policy aligns with best security practices and regulations, avoiding potential penalties or sanctions from failing to adhere to prescribed standards, and ensuring that the web applications remain trustworthy to stakeholders.
Ensure the web app has 'Client Certificates (Incoming client certificates)' set
Ensure the web app has 'Client Certificates (Incoming client certificates)' set
- This policy ensures that the web app verifies the identity of its clients using a digital certificate, building trust between the server and its users by authenticating them before a successful connection is established.
- It helps prevent unauthorized access to your web applications by making it significantly more difficult for an attacker to pose as a legitimate user, as they would need possession of a valid client certificate.
- The policy assists in meeting regulatory and compliance requirements that mandate strong user authentication, especially in industries such as healthcare, finance, and e-commerce.
- Non-compliance with this policy might leave the web applications vulnerable to various potential breaches, including man-in-the-middle attacks, session hijacking, or sensitive data exposure.
Ensure that 'HTTP Version' is the latest if used to run the web app
Ensure that 'HTTP Version' is the latest if used to run the web app
- It ensures that the latest HTTP version is being used, thereby employing the most current security features and patches to protect the web application from potential security threats.
- Using the latest HTTP version increases performance which leads to an improved user experience due to faster content loading and efficient data transfers.
- With each update to HTTP versions comes advances in web functionality and improved capacity to handle diverse content, making this policy directly pertinent to web app evolution.
- Compliance with this policy aids in meeting industry’s best practices and regulations, thus maintaining the organization’s reputation and relevance in the business environment.
Ensure that standard pricing tier is selected
Ensure that standard pricing tier is selected
- Following this policy ensures optimized cost management, as the standard pricing tier is often more cost-effective, offering a range of services for a fixed price, avoiding the higher costs associated with premium or custom pricing tiers.
- This policy promotes compliance checking, as it provides the tool to confirm whether the used resources in Azure stick to the standard pricing policy, preventing unexpected budget overflows.
- It supports overall security strategy, as the standard pricing tier in Microsoft Security Center offers a range of security features, which could be more comprehensive than those offered in the basic tier, helping to safeguard valuable corporate data and IT systems.
- Implementation of this policy affects budget planning and management, as it determines the cost associated with a company’s Azure subscription, and thereby directly impacts the allocation of resources within the company’s overall IT budget.
Ensure that security contact 'Phone number' is set
Ensure that security contact 'Phone number' is set
- This policy ensures that there is a designated contact phone number in case of security issues. This facilitates immediate communication, allowing for faster responses and mitigations of possible threats or breaches.
- Without a specified security contact phone number, there can be delays or confusion in communication during crucial security incidents, which can exacerbate damage or risk.
- Having a security contact ‘Phone number’ set provides clear direction for the response team during an incident, preventing ambiguity and ensuring that the right parties are brought in to handle the situation.
- This policy also reinforces accountability and transparency in security protocols. This can contribute to improved trust and reliability between the organization and its stakeholders.
Ensure that 'Send email notification for high severity alerts' is set to 'On'
Ensure that 'Send email notification for high severity alerts' is set to 'On'
- The policy ensures that stakeholders are promptly notified via email when high severity alerts are triggered on the system, allowing them to take immediate corrective actions and mitigate potential damage.
- By turning ‘On’ the ‘Send email notification for high severity alerts’ setting, the security team can swiftly respond to critical vulnerabilities or breaches, reducing the window of opportunity for attackers to exploit any weaknesses.
- This policy increases transparency and accountability by ensuring that all high-risk security incidents are communicated to the relevant parties in real-time, thus ensuring that no critical alerts are overlooked.
- Implementing this policy could help solve imminent threats which otherwise might have led to financial losses, reputational damage and regulatory compliance penalties, had the alerts not been acted upon promptly.
Ensure that 'Auditing' is set to 'Enabled' for SQL servers
Ensure that 'Auditing' is set to 'Enabled' for SQL servers
- Enabling auditing on SQL servers ensures that all activities performed on the server are tracked and logged. This aids in accountability, ensuring all actions can be traced back to an individual user, and can help identify potential security breaches.
- Having auditing enabled assists in maintaining compliance with certain regulations, such as the General Data Protection Regulation (GDPR), which require an audit trail to be maintained for data handling and processing activities.
- It provides visibility into the SQL server operations and helps to identify any potentially harmful or malicious SQL queries that have been executed, thereby providing protection against SQL injection attacks.
- Auditing allows for early detection of unauthorized access or unusual activity, aiding in preventing data breaches and enabling quicker incident response. This can also help in identifying potential performance issues, security vulnerabilities, and other problems.
Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers
Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers
- Ensuring that ‘Auditing’ Retention is ‘greater than 90 days’ for SQL servers allows for a comprehensive review of system activities over a prolonged period. This aids system administrators in detecting any suspicious actions or patterns that may indicate a potential breach or misuse.
- Long-term retention of audit logs enhances an organization’s capacity to perform a strong forensic analysis should a security incident occur. This helps in identifying the root cause, the impact, and in preventive measures for similar incidents in the future.
- The policy complies with various regulatory standards and legal requirements which mandate the retention of auditing data for specific periods. Non-compliance may result in fines, penalties or loss of certified status for the organization.
- Having an auditing retention period of more than 90 days improves the potential for threat detection since threats often remain undetected for an average of 196 days. Therefore, this policy significantly contributes to the organization’s overall cybersecurity strategy.
Ensure that 'Threat Detection types' is set to 'All'
Ensure that 'Threat Detection types' is set to 'All'
- The policy ensures that your system is set to detect all types of threats, providing comprehensive security coverage and reducing the risk of overlooked vulnerabilities that could be exploited by cybercriminals.
- By requiring ‘Threat Detection types’ to be set to ‘All’, the policy guarantees maximum utilization of SQL Server Threat Detection capabilities, further enhancing the security of Microsoft.Sql/servers/databases entities.
- Adherence to this policy facilitates faster detection and response to security threats, thereby minimizing potential damage - such as data breaches, system instability, or unauthorized access - that could result from delayed threat management.
- Implementing this policy reinforces security measures of ‘azurerm_mssql_server_security_alert_policy’, ensuring optimal operation and providing a robust defense mechanism against SQL-based attacks.
Ensure that 'Send Alerts To' is enabled for MSSQL servers
Ensure that 'Send Alerts To' is enabled for MSSQL servers
- Enabling ‘Send Alerts To’ for MSSQL servers ensures that administrators are promptly notified when security events or anomalies occur on the database servers. This allows immediate action to be taken, minimizing potential harm or data loss.
- The policy aids in achieving compliance with various security standards and regulations that necessitate real-time alerts for potential security issues in the databases and servers.
- By automating the notification process, the infra security policy articulates the commitment towards proactive security monitoring, instead of reactive troubleshooting.
- With the resource implementation in Azure Resource Manager (ARM) templates, the policy facilitates efficient and consistent enforcement of alert configuration across multiple MSSQL servers.
Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers
Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers
- Enabling ‘Email service and co-administrators’ for MSSQL servers allows administrators to receive critical alerts, improving real-time response to potential security threats or performance issues providing for superior troubleshooting and rapid incident resolution.
- It promotes accountability amongst administrators by ensuring all are notified of any issues or changes, reducing the chances of miscommunication and misunderstandings, thus improving coordination in mitigating risks and troubleshooting.
- The policy is important for compliance with various information security standards and regulations, that mandate immediate notification of security incidents to relevant personnel - failure could result in penalties or loss of certifications.
- By enabling ‘Email service and co-administrators’, it ensures swift detection and rectification of unauthorized changes, therefore enhancing the overall security of the database and contributing to the prevention of data breaches.
Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server
Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server
- Ensuring ‘Enforce SSL connection’ is enabled for MySQL Database Server helps to protect sensitive data in transit over network connections from being intercepted and misused by unauthorized entities, thus enhancing the overall data security.
- This policy has a direct impact on preventing man-in-the-middle (MITM) attacks, in which attackers intercept and potentially alter the communication between the MySQL Database Server and clients without either party knowing.
- Having this policy enforced ensures that the MySQL database is complying with best practices and industry standards for secure connections, which could be crucial for maintaining certifications like ISO 27001 or GDPR compliance.
- Non-compliance with this policy could lead to insecure connections, making it easier for attackers to gain unauthorized access to database content. Hence, maintaining the policy contributes to the robustness and integrity of the system’s security infrastructure.
Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server
Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server
- The policy ensures that all data transmitted between the PostgreSQL server and client is encrypted, preventing unauthorized access to sensitive information during transmission.
- Enforcing SSL connections adds an additional layer of security to the database server, reducing the risk of potential cyber threats such as man-in-the-middle attacks.
- By enforcing SSL connection, the policy also ensures that the server can trust the client’s identity, enhancing overall system integrity and secure communication.
- Not having this policy enforced could result in compliance violations with certain regulations and standards that require data to be encrypted during transmission, potentially leading to penalties.
Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server
Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server
- Setting the ‘log_checkpoints’ parameter to ‘ON’ allows the PostgreSQL server to log each time a new checkpoint is started. This helps in debugging and monitoring any issues related to data flushing to the disk or data recovery scenarios.
- Failure to log checkpoints can result in a lack of traceability, making it more difficult to diagnose and resolve system performance issues or crashes. Thus, enabling this feature ensures a smoother troubleshooting experience.
- Checkpoints are integral to PostgreSQL’s write-ahead-log (WAL) mechanism, which ensures data integrity. By logging checkpoints, the system creates a crucial record of these events, enhancing the overall system’s reliability.
- This policy also aligns with best practices for Infrastructure as Code (IaC), making it easier for teams to maintain consistent and secure configuration across different environments and stages of the application lifecycle.
Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server
Ensure configuration 'log_connections' is set to 'ON' for PostgreSQL Database Server
- Ensuring ‘log_connections’ is set to ‘ON’ for PostgreSQL Database Server is crucial as it provides audit trails and visibility. Enabling this setting will record every attempt to connect to the database, which allows security teams to identify unauthorized or suspicious activities.
- Setting ‘log_connections’ to ‘ON’ enhances incident response. In the case of a detected security breach or data leak, logs can be used to understand the source of the issue, the duration, and help identify the exact data that was compromised.
- An ‘OFF’ setting for ‘log_connections’ can be a liability in meeting regulatory compliance requirements. Many guidelines, such as GDPR, HIPAA, and PCI DSS, require the monitoring and logging of all accesses and changes made to sensitive data. Non-compliance can result in severe fines and penalties.
- The presence of robust logs can facilitate troubleshooting issues with the PostgreSQL Database Server as well. This can lead to quicker resolution times, minimal disruptions to operations, and maintain overall system performance and uptime.
Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server
Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server
- Enabling ‘connection_throttling’ on PostgreSQL Database Server prevents malicious attacks aimed at exhausting the server’s available connections, thus safeguarding overall performance and enhancing server reliability.
- This policy ensures the availability of resources for legitimate users, as ‘connection_throttling’ stops rapid-fire connection requests that may lead to the server being overwhelmed and unavailable.
- Switching ‘connection_throttling’ to ‘ON’ enables PostgreSQL servers to maintain their performance during high traffic situations, thereby enabling IT teams to uphold service quality and manageability.
- The application of this policy directly strengthens the database security posture, as it mitigates Denial of Service (DoS) attacks or other high-load situations that could potentially disrupt or take down the entire database server.
Ensure Storage logging is enabled for Queue service for read, write and delete requests
Ensure Storage logging is enabled for Queue service for read, write and delete requests
- Enabling Storage logging for Queue service helps track read, write, and delete requests, thus providing a comprehensive transaction history in case of data breaches and helping identify potential vulnerabilities.
- Logging is crucial to auditing. It allows for regular examination and analysis of logs, assisting with ensuring compliance with various standards and regulations specific to data storage and handling.
- This policy improves accountability among users or services accessing the storage queue by accurately tracking every transaction. This may deter malicious activity and foster a culture of responsibility.
- Failing to activate storage logging can hinder incident response and make post-incident investigation more challenging, potentially extending downtime during cyber security events and hindering the restoration of normal operations.
Ensure that 'Public access level' is set to Private for blob containers
Ensure that 'Public access level' is set to Private for blob containers
- This policy mitigates the risk of unauthorized data access by ensuring that blob containers in cloud storage are not publicly accessible and can only be accessed with specific permissions, thus enhancing data security.
- With the ‘Public access level’ set to private, the possibility of accidental data exposure is significantly reduced. This is particularly critical for sensitive data such as personal identification information, financial data, confidential business information, etc.
- Setting blob containers to private also limits the surface area for potential attacks. This way, it becomes more challenging for attackers to exploit any security vulnerabilities or carry out malicious actions on publicly accessible data.
- The policy also promotes adherence to compliance standards and regulations surrounding data privacy and security, which often necessitate that data should be accessible only to authorized individuals or entities, thus avoiding legal penalties and reputational damage.
Ensure default network access rule for Storage Accounts is set to deny
Ensure default network access rule for Storage Accounts is set to deny
- The policy ensures that the default rule for network access to Storage Accounts is set to deny. This is a crucial security control to protect data privacy, as unauthorized users cannot easily exfiltrate data from the storage account as they are denied by default.
- This policy helps in the reduction of the attack surface for potential data breaches. If the default rule is set to allow access, this could inadvertently open up a pathway for malicious actors to gain access to confidential and sensitive data stored in the storage account.
- Implementing this policy can support regulatory compliance measures that require stringent data access controls, such as GDPR, HIPAA, PCI-DSS. It allows the organization to be in line with the best practices for data security and protection, thus mitigating potential compliance risks.
- The policy’s implementation via Infrastructure as Code (IaC) allows for an automated and scalable security control process. This means the control can be consistently applied to all storage accounts in the infrastructural setup, ensuring there are no security gaps left due to manual errors.
Ensure 'Trusted Microsoft Services' is enabled for Storage Account access
Ensure 'Trusted Microsoft Services' is enabled for Storage Account access
- Enabling ‘Trusted Microsoft Services’ for Storage Account access allows secure interoperability between Azure services, maintaining the integrity and security of the data stored in the account.
- The policy ensures that data within storage accounts is only accessed by authenticated and authorized Azure services, reducing the risk of data breaches or unwanted data manipulation.
- If ‘Trusted Microsoft Services’ is not enabled, data transfer between Azure services and the storage account may be exposed, leading to potential vulnerabilities and data leakage.
- Implementation of this policy aids in compliance with regulations and industry standards regarding data privacy and security, by ensuring that only trusted services are granted access to critical data storage accounts.
Ensure that Activity Log Retention is set 365 days or greater
Ensure that Activity Log Retention is set 365 days or greater
- Sets a baseline for data retention in activity logs, providing sufficient historical data for investigations. Storing logs for a minimum of 365 days guarantees that there’s access to records of all significant operations and their associated metadata for audits, reviews, or incident handling.
- The policy aids in compliance with legislative and industry requirements about record keeping. Certain regulations and standards, such as GDPR, PCI DSS, or ISO 27001, require data and activity logs to be retained for specific durations.
- Decreases the risk of losing valuable forensic data that could help identify and respond to security incidents. By storing logs for at least a year, there remains a comprehensive source of information about system activities, user behaviour, and potential vulnerabilities that can be utilized to strengthen security posture.
- Helps in building trend analyses and spotting abnormalities over a longer period. A 365-day log retention policy can provide a solid foundation for comparing current system activities with those from the past, leading to a better understanding of event cycles and enabling the detection of unusual or suspicious activities.
Ensure audit profile captures all the activities
Ensure audit profile captures all the activities
- It ensures absolute transparency and accountability as all activities within the infrastructure are monitored and logged. This aids in maintaining an accurate record of changes made in the system.
- It facilitates forensic analysis and problem diagnosis in case of any security incidents or system failures as it provides a history of all previous system activity.
- It allows for early detection of potential security threats or breaches by providing continuous monitoring and alerting mechanism based on captured activity.
- It aids in compliance with various regulations and standards as many of them require businesses to have a certain level of monitoring and logging in place for their IT infrastructures.
Ensure that no custom subscription owner roles are created
Ensure that no custom subscription owner roles are created
- Preventing the creation of custom subscription owner roles helps maintain the principle of least privilege in infrastructure security, as it deters unauthorized users from obtaining permissions they don’t require for their job functions.
- By restricting custom subscription owner roles, the policy reduces the risk of potential security breaches should such roles be exploited by either internal or external malicious entities.
- The policy streamlines permissions and roles management within an organization, reducing complexities and the workload for the Infra team, minimizing errors and regulating control over resources.
- Enforcing this policy assures compliance with various regulatory frameworks that mandate strict access and permissions controls, avoiding potential legal and financial repercussions for non-compliance.
Ensure that the expiration date is set on all keys
Ensure that the expiration date is set on all keys
- Setting an expiration date on all keys helps prevent unauthorized or prolonged use of keys, enhancing the security of data and limiting potential data breaches.
- Ensuring the key expires after a certain period helps in achieving regulatory compliance that often requires periodical key rotation, thus preventing penalties and fines.
- An expiration date enforces a policy that unused or rarely used keys are phased out over time, reducing the risk of those keys becoming a security vulnerability.
- It translates to a proactive security practice, instigating timely key renewal and review of access rights which eliminates the possibility of keys being used maliciously unnoticed.
Ensure that the expiration date is set on all secrets
Ensure that the expiration date is set on all secrets
- Setting an expiration date on all secrets ensures that these sensitive pieces of data don’t remain valid indefinitely, reducing the risk of their disclosure and misuse in the event of a security breach.
- The policy helps automate the life cycle management of keys, certificates, and secrets. If an expiration date isn’t set, manually tracking and renewing these entities can become a resource-intensive task.
- It encourages the regular rotation of secrets in Azure Key Vault, which is a best practice for improving security posture and mitigating the risk of long-term vulnerabilities.
- Non-compliance with this policy may lead to non-adherence with industry specific regulations and standards such as GDPR, ISO/IEC 27001, that mandate time-bound validity of secrets and access credentials.
Ensure the key vault is recoverable
Ensure the key vault is recoverable
- Ensuring the key vault is recoverable provides a contingency plan for accidental deletion or loss of key vaults, strengthening the resiliency of the infrastructure and maintaining business continuity.
- This policy minimizes the impact of data compromise by facilitating the quick recovery of keys, secrets, and certificates. This can greatly reduce the downtime and negative impact on services relying on these elements.
- Implementing the policy helps meet compliance requirements for data protection and disaster recovery. Many regulations mandate the ability to recover sensitive data, failing which can result in hefty penalties.
- The policy promotes best-practice security by requiring the setup of a recovery mechanism for the key vault. This protects against potential losses from security breaches or unintentional mishaps in managing the vault.
Ensure Storage Accounts adhere to the naming rules
Ensure Storage Accounts adhere to the naming rules
- Ensuring storage accounts adhere to the naming rules helps in maintaining a standardized, logical architecture which is easier to manage, troubleshoot, and scale.
- Properly named Storage Accounts improve traceability and accountability, thereby aiding audit procedures and regulatory compliance.
- Implementing this policy using Infrastructure as Code (IaC) tool like Terraform allows for automation, reducing human error, and ensuring naming rules are consistently applied.
- Misnamed or non-standard Storage Account names can lead to misconfigurations or difficulty in identifying specific resources, potentially impacting access control and security protocols.
Ensure Storage Account is using the latest version of TLS encryption
Ensure Storage Account is using the latest version of TLS encryption
- Using the latest version of TLS encryption ensures that the storage account is protected using the most secure, up-to-date cryptographic protocols, reducing the potential data breach risk.
- Non-compliant TLS versions can expose the storage account to vulnerabilities such as man-in-the-middle attacks, weakening the integrity and confidentiality of the data stored.
- Regularly updating to the latest version of TLS encryption aids in meeting compliance standards, such as PCI DSS or HIPAA that mandate using secure data transmission protocols.
- Ensuring that the storage account uses the latest TLS version improves overall system security by enabling newer security features and fixes for known vulnerabilities, making exploitation attempts less likely to succeed.
Ensure that no sensitive credentials are exposed in VM custom_data
Ensure that no sensitive credentials are exposed in VM custom_data
- Ensuring no sensitive credentials are exposed in VM custom_data is important because it prevents unauthorized access or malicious actions on the virtual machine. Leaked credentials can potentially provide full control over the virtual resources to attackers.
- This policy is essential to comply with various data protection standards and regulations, such as GDPR or HIPAA, which require organizations to protect sensitive data from exposure. Non-compliance could lead to substantial fines and reputational damage.
- The VM custom_data being unencrypted and readily accessible makes it critical to keep it free of sensitive credentials. Exposure of these could lead to compromises in infrastructure stability and functionality, causing service disruptions or even long-term damage.
- Implementing this policy helps maintain the organizational infrastructure security standards. Developers and administrators using Infrastructure as Code tools (like Terraform) should adhere to this rule to establish a consistent security posture across the infrastructure.
Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers
Ensure 'Enforce SSL connection' is set to 'ENABLED' for MariaDB servers
- Enabling ‘Enforce SSL connection’ for MariaDB servers ensures that all data communication between the client and the server is encrypted, minimizing the risk of data breaches and cyber-attacks.
- This policy reduces the possibility of man-in-the-middle attacks where a malicious entity can intercept and possibly alter the data during transfer between a MariaDB server and a client.
- Ensuring ‘Enforce SSL connection’ is enabled adds an extra layer of security in case other security measures fail, as encrypted data would be difficult to decode and misuse.
- Non-compliance with this policy can lead to potential regulatory infractions if sensitive data is involved, as many data privacy laws and regulations mandate the use of encrypted connections for transmitting personal data.
Ensure 'public network access enabled' is set to 'False' for MariaDB servers
Ensure 'public network access enabled' is set to 'False' for MariaDB servers
- Ensuring ‘public network access enabled’ is set to ‘False’ for MariaDB servers helps improve data security by eliminating the risks of unauthorized access and data breaches from external threats.
- Having ‘public network access enabled’ set to ‘False’ forces all traffic to MariaDB servers to go through private network links, thus providing high assurance of data confidentiality and integrity.
- The policy follows the principle of least privilege, where only authorized internal networks or systems have access to the MariaDB servers, thereby minimizing the potential attack surface.
- Utilizing the Terraform’s infrastructure as code (IaC) practices, automatic enforcement of this rule ensures consistent security across all MariaDB servers without the necessity for manual configurations, reducing human error potential.
Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead)
Ensure Azure linux scale set does not use basic authentication(Use SSH Key Instead)
- This policy is important as it ensures a more secure authentication method. SSH keys provide a higher level of security than basic password-based authentication due to their complexity and uniqueness, reducing the risk of unauthorized access.
- The rule protects system infrastructure from brute-force attacks and password cracking tools, as these methods are ineffective against SSH keys, further boosting the security of Azure linux scale set.
- Implementing this policy helps to maintain compliance with many regulatory standards and best practices, such as PCI-DSS and HIPAA, which require strong authentication methods.
- Non-compliance with this policy could expose the scale set to potential cyber threats, enabling attackers to gain control over resources and perform malicious activities, which could lead to data breaches, financial loss, and reputational damage.
Ensure Virtual Machine Extensions are not Installed
Ensure Virtual Machine Extensions are not Installed
- This policy is important because Virtual Machine Extensions can introduce vulnerabilities, as they can run with administrative privileges on Azure Virtual Machines; forbidding their installation reinforces infrastructure security.
- Ensuring no Virtual Machine Extensions are installed prevents potential execution of unsafe code that could potentially lead to unauthorized access, thereby safeguarding critical infrastructure and data.
- By adhering to this policy, it reduces the attack surface area, thus diminishing the risks of breaches and improving an organization’s overall security posture.
- The impact of this policy is to enforce a secure configuration for different types of virtual machines such as azurerm_linux_virtual_machine and azurerm_windows_virtual_machine, thus maintaining system integrity regardless of the underlying operating system.
Ensure MSSQL is using the latest version of TLS encryption
Ensure MSSQL is using the latest version of TLS encryption
- Ensuring MSSQL is using the latest version of TLS encryption is important for maintaining the highest level of data security, as updates often contain security enhancements and patch vulnerabilities present in older versions.
- The policy ensures that data transmission to and from the MSSQL server is encrypted using the latest and most secure methods, significantly reducing the risk of data interception by unauthorized entities.
- Implementing the latest TLS encryption for MSSQL server through the IaC tool Terraform ensures a standardized, automated, and efficient change process across the infrastructure, minimizing human errors.
- Without the enforcement of this policy, azurerm_mssql_server resources could potentially use outdated and insecure TLS versions, opening the door for potential security breaches and non-compliance with regulations such as GDPR or HIPAA.
Ensure 'public network access enabled' is set to 'False' for mySQL servers
Ensure 'public network access enabled' is set to 'False' for mySQL servers
- Disabling ‘public network access’ reduces the risk of unauthorized access to the mySQL servers, enhancing the security of data and proprietary information present therein.
- Ensuring ‘public network access’ is set to ‘False’ is a strong defense against potential external cyber threats and intrusions, which might lead to data breaches.
- This policy directly affects the azurerm_mysql_server entity, and consequently, any applications relying on these servers may gain performance enhancements due to reduction in non-essential traffic.
- Setting up this policy via Infrastructure as Code using Terraform allows for consistency across multiple servers, as well as ease of auditing and maintaining the security configuration.
Ensure MySQL is using the latest version of TLS encryption
Ensure MySQL is using the latest version of TLS encryption
- This policy ensures that the MySQL server is using the most secure method of data transmission. By enforcing the use of the latest version of TLS encryption, it reduces the chances of data breaches and unauthorized data interception during transmission.
- Up-to-date TLS encryption versions are less likely to have identified vulnerabilities that could be exploited by malicious hackers. The policy thus reduces the risk of the infrastructure being compromised through this potential attack vector.
- As part of the overall security posture of a system, this policy assists in meeting compliance standards that require the use of latest encryption protocols, thereby avoiding regulatory fines and penalties that could impact both financial and reputational aspects of the business.
- By ensuring that the infrastructure is using the latest version of TLS for MySQL, it can provide performance optimizations and improved features, ultimately leading to a more efficient and secure operation of the database services.
Ensure that Azure Defender is set to On for Servers
Ensure that Azure Defender is set to On for Servers
- This policy is important as enabling Azure Defender on servers provides a powerful layer of security that helps to protect data and applications in Azure from threats and vulnerabilities, making servers less prone to potential attacks.
- The implementation of Azure Defender on servers offers automated security assessments and alerts that guide IT teams towards important steps to harden their servers, improving the overall security status and resilience of the system.
- By enforcing this policy, organizations can avail of the threat intelligence capabilities of Azure Defender to detect unusual attempts to access or exploit servers. This allows for quicker response to potential threats and reduces their impact and downtime.
- The Azure Defender when turned ON for servers also tends to provide advanced analytics and visualizations for server security data, enabling the organization to maintain efficient auditing and tracking of security-related incidents.
Ensure that function apps enables Authentication
Ensure that function apps enables Authentication
- Enabling authentication provides an essential layer of security for function apps by limiting access to only the authenticated entities, reducing potential exploitation from unauthorized intrusions.
- This policy ensures data protection compliance by enforcing authentication on function apps, which minimizes the risk of accidental data disclosure or loss due to unauthorized access.
- In the context of Infrastructure as Code (IaC) with Terraform, this policy promotes security best practices within the automated provisioning of function apps on the Azure platform, increasing trust and confidence in the system.
- Non-compliance to this policy can lead to uninhibited access to the function app resources, escalating the risk of malicious activities like data breaches, unauthorized data manipulation, and potential system downtime.
Ensure that CORS disallows every resource to access app services
Ensure that CORS disallows every resource to access app services
- This policy protects sensitive data and services from Cross-Origin Resource Sharing (CORS) vulnerabilities that could allow unauthorized domains to access resources. By disallowing every resource to access app services, it helps maintain strict boundaries and control over who can request and receive data.
- It can prevent potential security breaches that could result from poorly configured CORS policies. In specific cases where unauthorized access to app services is successful, sensitive information can be extracted and manipulated, posing a significant risk to the system’s overall security integrity.
- This policy ensures that infrastructure as code (IaC) practices, in this case implemented with Terraform, follow the principle of least privilege. This means providing only the minimal privileges necessary for a function to work, thus limiting any potential attack surface and making the overall system more secure.
- Following this policy helps organizations comply with industry security standards and regulations, including GDPR and HIPAA, which require strict policies for information exchange and inter-domain communication. Therefore, enforcing this policy can help organizations avoid potential legal issues, penalties, or damage to their brand reputation.
Ensure that Azure Synapse workspaces enables managed virtual networks
Ensure that Azure Synapse workspaces enables managed virtual networks
- Ensuring Azure Synapse workspaces enable managed virtual networks allows a more fine-grained control of network security, as it permits the defining of security rules and the restriction of unauthorized user access.
- This policy helps in complying with security best practices by isolating the workspaces in a controlled network environment. This reduces the exposure of these workspaces to potential attacks and unauthorized access.
- The policy adds an extra layer of security that goes beyond default network security measures. Managed virtual networks provide enhanced protection mechanisms like traffic segmentation, intrusion detections, and application firewalls.
- By enforcing this policy, organizations can increase their confidence in data security and privacy, as managed virtual networks in Azure Synapse enable data encryption, ensuring that sensitive data cannot be intercepted or compromised.
Ensure that Storage accounts disallow public access
Ensure that Storage accounts disallow public access
- Disallowing public access to storage accounts is important because it mitigates the risk of unauthorized data access and potential data breaches, enhancing the overall infrastructure security.
- This policy helps in complying with data privacy regulations and standards as it limits the exposure of sensitive data stored in the storage accounts to unauthorized personnel or third-party users.
- Implementing this policy avoids inadvertent data leaks. Because storage accounts often contain critical or sensitive information, disallowing public access minimizes the chance of such data being accidentally or maliciously exposed.
- This policy manages access control through Azure Resource Manager (ARM) templates, providing a dependable and manageable method to control resource-level permissions in Azure environments, thereby enhancing infrastructure manageability and security.
Ensure that Azure Defender is set to On for App Service
Ensure that Azure Defender is set to On for App Service
- Ensuring that Azure Defender is set to ‘On’ for App Services is crucial as it offers advanced threat and vulnerability management protection capabilities. It uses machine learning to detect and block potentially harmful activities, thereby improving the security of the application.
- By setting Azure Defender to ‘On’ for App Service, it provides added layers of protection like Just-In-Time access control for safe and secure management of the resources thereby limiting the attack surface.
- Infrastructure as Code (IaC) tools like Terraform are used in the implementation of this policy using scripts. This allows for an automatic, consistent, and trackable way of ensuring the Azure Defender setting, reducing manual effort and errors.
- With this policy, security teams can specifically target the
azurerm_security_center_subscription_pricingresource. This ensures that they are optimizing spend and not paying for more protection than they actually need. It gives the teams more control over their security budget and priorities.
Ensure function apps are not accessible from all regions
Ensure function apps are not accessible from all regions
- This policy minimizes the attack surface by only allowing specific trusted regions to access the function apps, reducing the potential risk of unauthorized users exploiting vulnerabilities in the application.
- Function apps that are accessible from all regions can increase latency and resource usage due to requests coming from far away regions, impacting performance and efficiency.
- It promotes compliance and control over data sovereignty laws and regulations which may require data to be stored, processed, and managed in specific geographical locations.
- Implementing this policy through Infrastructure as Code tool like Terraform can help maintain consistency across different environments and reduces the chances of potential misconfigurations.
Ensure that App service enables HTTP logging
Ensure that App service enables HTTP logging
- Enabling HTTP logging on App service helps track and monitor each incoming and outgoing HTTP request, which aids in troubleshooting server errors, diagnosing operational problems, and maintaining security effectiveness by revealing problematic patterns or specific security incidents.
- Security breaches, such as unauthorized access attempts and suspicious user behavior, could be detected early and addressed effectively when HTTP loggings are enabled. This feature records IP addresses and user activity, providing essential evidence in the event of an investigation.
- HTTP logging centrally collects and stores standardized logs, which could be important for maintaining regulatory compliance. Many governing laws, standards, or organizational policies require companies to keep a record of all HTTP transactions for a stipulated duration.
- Lack of enabled HTTP logging in App service may not only compromise incident detection and hinder troubleshooting, but it can also result in non-compliance with certain regulations that could lead to financial penalties and reputational damage.
Ensure that Azure File Sync disables public network access
Ensure that Azure File Sync disables public network access
- This policy helps protect sensitive organizational data by preventing public network access to the Azure File Sync, thus reducing the threat surface that an attacker can exploit.
- As data lethality is minimized through this policy, it proves to be critical in compliance with data governance and privacy regulations, including GDPR and CCPA, which require strict control over data access and transfer.
- By ensuring public access is disabled for Azure File Sync, the risk of data breaches is significantly reduced. Unauthorized access could lead to data theft, manipulation, or ransomware attacks, which can cost organizations financially and harm their reputation.
- Using infrastructure as code (IaC) tool Terraform, automated and repeatable deployments can be leveraged. This helps maintain consistency across different environments (like production, staging), making it easier to manage security configurations and reduce human error.
Ensure that App service enables detailed error messages
Ensure that App service enables detailed error messages
- Ensuring that an App Service enables detailed error messages can provide valuable insight into the failure points within the system, allowing developers to identify and rectify issues more effectively.
- With detailed error messages enabled, it becomes easier to troubleshoot and prevents the need for extensive trial and error approaches, thus increasing productivity and reducing downtime.
- Since debugging is easier, it also increases the speed at which systems can be developed and updated, leading to more efficient service delivery.
- Despite the potential risks of revealing sensitive system information, having detailed error messages in a controlled and secure set-up enhances system reliability and security since issues can be promptly detected and solved.
Ensure that App service enables failed request tracing
Ensure that App service enables failed request tracing
- This policy ensures that all failed requests in the App Service are properly logged and traced. This aids in identifying and rectifying issues that lead to request failures, enhancing the stability and performance of the application.
- By enabling failed request tracing, detailed error information including the precise point of failure in the application’s processing pipeline can be obtained. This functionality enables developers to quickly diagnose and fix issues, reduce downtime, and optimize performance.
- Implementing this policy as a part of resource entities like Microsoft websites or Azure app service can assist in maintaining high standards of security by spotting potential vulnerabilities related to failed requests. This could prevent possible breaches or attacks.
- The policy impacts resource cost management within Azure. While failed request tracing provides useful data, it can also increase storage needs and associated costs. Therefore, data retention policies should be in place to delete older log files, keeping a balance between security needs and cost efficiency.
Ensure that 'HTTP Version' is the latest, if used to run the Function app
Ensure that 'HTTP Version' is the latest, if used to run the Function app
- Ensuring that the ‘HTTP Version’ is the latest if used to run the Function app minimizes the potential for security vulnerabilities, as outdated versions may have known, unpatched vulnerabilities that could be exploited by malicious actors.
- Adherence to this policy enhances application performance as the latest HTTP versions incorporate improvements like faster data transmission, lesser latency and better connection management, impacting the user experience positively.
- Following this policy supports progressive app development and maintenance as newer HTTP versions often include enhancements to functions, feature support, and developer tools that can streamline coding and bug resolution.
- It facilitates compliance with industry best practices or regulatory standards for information security and data privacy, as using the latest technology versions usually forms a key part of such requirements.
Ensure that PostgreSQL server disables public network access
Ensure that PostgreSQL server disables public network access
- This policy ensures the PostgreSQL server disables public network access, thereby reducing the potential attack surface, increasing the security level of databases, and preventing unauthorized access from the internet.
- By complying with this policy, exposure of sensitive data is mitigated as only approved and designated networks are allowed access, significantly reducing the risk of data breaches.
- Violation of this policy could lead to unauthorized data modification, disruption of data availability, or leakage of data, all of which are serious threats to the integrity and confidentiality of stored information.
- When implemented via the referenced Terraform IaC module, this security measure enables automated enforcement of the policy on the ‘azurerm_postgresql_server’ resource, streamlining the application of security best practices.
Ensure that Azure Defender is set to On for Azure SQL database servers
Ensure that Azure Defender is set to On for Azure SQL database servers
- Enabling Azure Defender for SQL database servers ensures advanced threat protection, which can detect unusual activities indicating unusual attempts to access, breach, or exploit the databases in real time.
- Keeping Azure Defender set to ‘On’ allows automated security checks to run, providing alerts on potential vulnerabilities and reducing the time to detect and respond to threats.
- This setting allows for more robust database protection, including features such as vulnerability assessment, threat detection, data discovery and classification, and more, contributing to system resiliency and data integrity.
- In the context of infrastructure as code (IaC) via Terraform, maintaining this security policy in the scripts ensures consistent application of this key security measure, improving overall infrastructure security and compliance.
Ensure that Function apps is only accessible over HTTPS
Ensure that Function apps is only accessible over HTTPS
- The policy ensures that all data communication to and from Azure Function Apps is encrypted, thereby preventing unauthorized interception and access to sensitive data being transmitted.
- It helps in enforcing compliance with security standards and regulations that require secure transfer of sensitive data over the network, such as PCI-DSS or HIPAA, thus avoiding regulatory non-compliance fines or penalties.
- The policy enables protection against Man-In-the-Middle (MITM) attacks, where an attacker intercepts and possibly alters the communication between two parties without their knowledge, thus improving overall system and data integrity.
- It promotes the usage of secure best practices by disallowing access over HTTP which is unencrypted, enhancing the organization’s reputation by assuring customers and stakeholders that their information is securely handled.
Ensure that Managed identity provider is enabled for app services
Ensure that Managed identity provider is enabled for app services
- This policy ensures that Azure App Services are utilizing managed identities, which provide an automatically managed identity in Azure Active Directory (AAD), to authenticate and authorize the apps. This enhances the security posture by eliminating the need for developers to manage credentials.
- With Managed Identity Provider enabled, the Azure services have an identity in AAD. This eliminates the need for storing and managing secrets in the code, reducing the risk of sensitive data exposure and simplifying credential management.
- Compliance with this policy ensures that user access can be centrally controlled and monitored, facilitating audit tracking, and non-compliance could subject to potential unauthorized access.
- Non-compliance with the policy may result in a downgrade in security posture, potential data breaches, and may not meet regulatory compliance requirements such as PCI-DSS or HIPAA, causing significant financial and reputational damage.
Ensure that remote debugging is not enabled for app services
Ensure that remote debugging is not enabled for app services
- Ensuring remote debugging is not enabled for app services minimizes the risk of unauthorized access. Remote debugging can provide a potential entry point for attackers, who can use it to access sensitive data or manipulate application functionality.
- By disabling remote debugging, fault isolation and system integrity in azurerm_app_service, azurerm_linux_web_app, and azurerm_windows_web_app are preserved. If remote debugging is enabled, debugging sessions could inadvertently impact the performance or stability of these entities.
- The policy specifically helps in adhering to the principle of least privilege. Only necessary access is granted, and remote debugging capability - which allows broad access to the application for troubleshooting purposes - is restricted, hence reducing possible security breaches.
- With the implementation of this policy through Terraform, as defined in AppServiceRemoteDebuggingNotEnabled.py, the infrastructure-as-code model’s security posture is strengthened. It enables the automatic enforcement of security controls, hence making the cloud environment more secure and compliant.
Ensure that Automation account variables are encrypted
Ensure that Automation account variables are encrypted
- Encrypting Automation account variables ensures the confidentiality of sensitive data, as encrypted data is unreadable to unauthorized users, thereby minimizing the risk of accidental or malicious data exposure.
- This policy ensures compliance with security standards and regulations that mandate data encryption, hence, minimizing the risk of legal penalties and reputational damage.
- Unencrypted variables can potentially provide unauthorized users with valuable details about the system if intercepted, leading to operational risk and impact on business continuity.
- The policy has a preventative role in detecting any non-compliant configurations during the development phase through Infrastructure-as-Code (IaC) checks, hence, facilitating early and cost-effective resolution of potential security breaches.
Ensure that Azure Data Explorer (Kusto) uses disk encryption
Ensure that Azure Data Explorer (Kusto) uses disk encryption
- Ensuring that Azure Data Explorer uses disk encryption is vital to safeguard sensitive data from unauthorized access and potential data breaches, even when the data is ‘at rest’, i.e., stored on a disk.
- Disk encryption within Azure Kusto clusters assists in compliance with data protection regulations. It automatically encrypts data prior to storing it and decrypts the data when read, satisfying conditions in laws such as GDPR and HIPAA.
- Unencrypted data is an easy target for cybercriminals, therefore, the activation of disk encryption in Azure Data Explorer also protects against data theft, minimizing potential business and financial losses.
- As this policy is managed with Terraform’s Infrastructure as Code (IaC) approach, it facilitates automation, making the implementation of disk encryption uniform across all resources, reducing the chance of misconfigurations that could leave data unprotected.
Ensure that Azure Data Explorer uses double encryption
Ensure that Azure Data Explorer uses double encryption
- This policy ensures that data stored in Azure Data Explorer (ADX) is doubly encrypted, providing an extra layer of data security. The double encryption makes the data even more resilient against unauthorized access, including insider threats, enhancing the confidentiality of data.
- It helps meet regulatory compliance standards, as many data privacy regulations require stringent data security measures which include encryption. This policy may support compliance with regulations like GDPR, PCI DSS, and HIPAA.
- Implementing this policy through Infrastructure as Code (IaC) using Terraform script allows for easy replication, auditability, and management of infrastructure changes across various operational environments with reduced risks of human errors.
- The policy specifically impacts ‘azurerm_kusto_cluster’ entity. Any configuration change to this entity will trigger a check against the stated policy, ensuring ADX data security configurations are as per the defined standard, and minimizing potential data breaches.
Ensure that Azure Batch account uses key vault to encrypt data
Ensure that Azure Batch account uses key vault to encrypt data
- Ensuring that Azure Batch account uses Key Vault to encrypt data adds an additional layer of security to the data, decreasing the chances of unauthorized access or data breaches. This is especially important for sensitive or classified information.
- The policy helps in meeting industry standards and regulatory compliances related to data security and encryption, such as GDPR, HIPAA, etc. Noncompliance can lead to severe penalties and damage to the company’s reputation.
- Using Azure Key Vault for encryption allows for centralized management of cryptographic keys and secrets, simplifying key management and reducing the chances of human error leading to a security breach.
- The implementation of this policy via Infrastructure as Code (IaC) using Terraform promotes automation, consistency, and repeatability in the deployment and configuration of the Azure Batch accounts, thereby improving operational efficiency and reducing manual errors.
Ensure that UDP Services are restricted from the Internet
Ensure that UDP Services are restricted from the Internet
- This policy prevents unauthorized users from accessing UDP services from external networks, thus mitigating potential risks posed by suspicious Internet-based traffic and securing data confidentiality and integrity.
- By restricting internet connectivity to the specified resources (azurerm_network_security_group, azurerm_network_security_rule), it helps to significantly limit the potential attack vector for malicious entities and minimize the risk of security incidences like a denial of service (DoS) attack that leverage UDP protocol.
- Implementing this policy also ensures compliance with best security practices and standards, which is critical for regulatory requirements, maintaining brand reputation, and avoiding potential penalties for non-compliance, especially in sectors with strict data protection laws.
- The policy is implemented using Terraform, a popular infrastructure as code (IaC) tool, which allow for consistent and repeatable deployments, reducing the human error factor, and therefore increasing the overall security posture of the infrastructure.
Ensure FTP deployments are disabled
Ensure FTP deployments are disabled
- Disabling FTP deployments is important to mitigate the risk of unauthorized access or data breaches, as FTP does not use encryption and leaves data vulnerable during transit.
- This policy significantly improves the security posture of azurerm_app_service, azurerm_linux_web_app, and azurerm_windows_web_app resources within Azure by eliminating the potential misuse or exploitation of a less secure transfer protocol.
- Monitoring and ensuring the compliance of this policy using Infrastructure as Code (IaC) tool like Terraform enables automated security checks, contributing to the overall efficiency and agility of the software delivery process.
- Due to the policy, there might be an impact on existing workflows that leverage FTP for data transfer. Alternatives such as SFTP or SCP which provide secure file transfers should be considered.
Ensure that Azure Defender is set to On for SQL servers on machines
Ensure that Azure Defender is set to On for SQL servers on machines
- Ensuring that Azure Defender is turned on for SQL servers increases the overall security of your infrastructure by detecting potential threats in real time, reducing the risk of SQL injections or other types of attacks on your database.
- This policy directly impacts cost management. While enabling Azure Defender comes with added costs, it provides substantial value in the form of enhanced protection for SQL servers, saving potential high expenses derived from security breaches.
- The policy contribution to the compliance aspect is important. Keeping Azure Defender on for SQL servers on Azure ensures that your infrastructure adheres to regulatory policies and industry standards related to data and infrastructure security.
- The implementing resource for this policy, AzureDefenderOnSqlServerVMS.py, provides an IaC solution that enables scalable, consistent deployment of this critical security setting across multiple SQL servers on Azure. This helps to prevent configuration drift and maintains uniform security standards.
Ensure that 'Net Framework' version is the latest, if used as a part of the web app
Ensure that 'Net Framework' version is the latest, if used as a part of the web app
- Ensuring the ‘Net Framework’ version is the latest provides the latest security updates and patches, protecting the web app from potential threats and vulnerabilities, which otherwise, would make the application susceptible to breaches and disclosure of sensitive information.
- Staying up-to-date with the latest ‘Net Framework’ version allows users to leverage new features and enhancements, which can improve the overall performance and efficiency of the application.
- Outdated versions of the ‘Net Framework’ might not be compatible with other up-to-date systems and software, leading to operational issues and possible downtime. Therefore, maintaining the latest version ensures seamless interoperability.
- Regular compliance with this policy means constantly staying ahead of potential threats as each new version of ’.Net Framework’ tends to fix bugs and known issues from the previous versions.
Ensure that 'PHP version' is the latest, if used to run the web app
Ensure that 'PHP version' is the latest, if used to run the web app
- Ensuring the PHP version is the latest helps protect the web app from newly discovered vulnerabilities that older versions contain, thereby improving the overall security posture against hackers and malicious threats.
- Using the latest PHP version in azurerm_app_service can introduce new functionalities and improvements, offering better performance and efficiency for the web application. This can optimize resource utilization and reduce operational cost.
- Staying up-to-date with the PHP version through Terraform ensures compatibility with other evolving apps and services, facilitating smoother interactions and integrations, thus avoiding potential disruptions or system breakdowns.
- Failure to adhere to this policy can lead to compliance issues especially if your infrastructure needs to follow certain IT standards or laws requiring use of updated and secure software, potentially resulting in fines or sanctions.
Ensure that 'Python version' is the latest, if used to run the web app
Ensure that 'Python version' is the latest, if used to run the web app
- Ensuring the ‘Python version’ is the latest is important as updated versions contain patches for security vulnerabilities that may exist in older versions. This ensures that the web app is less vulnerable to security threats that exploit these vulnerabilities.
- The latest Python version may have enhanced security features and improved performance, which could improve the overall performance and security of the web app when it runs.
- Incompatibilities and errors can occur if the web app relies on features or functions that have been deprecated in older Python versions but are supported in the latest versions. Ensuring the ‘Python version’ is the latest can prevent such issues.
- The policy continuously enforces the use of the latest Python version. This ensures that any new changes, features, or improvements are immediately available to the web apps, keeping them up-to-date and optimized for the best performance.
Ensure that 'Java version' is the latest, if used to run the web app
Ensure that 'Java version' is the latest, if used to run the web app
- Keeping the ‘Java version’ updated is essential to maintain the security of the web app, as the latest versions usually address the vulnerabilities and security issues found in previous versions.
- The latest Java version ensures optimal performance and stability of the web app being run, as updates typically include performance improvements, bug fixes and added features.
- This policy is crucial for resources ‘azurerm_app_service’, specifically when using Terraform for Infrastructure as Code (IaC) as outdated Java versions may lead to compatibility issues with newer modules, providers, or features of Terraform.
- The policy contributes to the organization’s overall security posture and relies on tools like the provided Python script link for its implementation, which simplifies compliance by automating the process of checking if the latest Java version is being used for the ‘azurerm_app_service’ resource.
Ensure that Azure Defender is set to On for Storage
Ensure that Azure Defender is set to On for Storage
- Ensuring that the Azure Defender is set to On for Storage helps in identifying and preventing potential security threats to stored data. It offers an additional layer of security measure for vulnerabilities, thereby reducing the risk of data breach.
- The Azure Defender On for Storage provides alerts for anomalous activities that can indicate potential security threats. It monitors the patterns of storage access and immediately alerts the users in case of abnormal behavior detected.
- Implementing this policy enables the user to have an automated solution for continuous scanning and threat detection for cloud storage. This allows for quicker response times to suspected hostile actions and, therefore, enhances the overall security of the application.
- Not enabling Azure Defender On for Storage could lead to undetected security threats, data leaks, and non-compliance with regulatory requirements related to data security and privacy. It can increase the risk of potential downtime and financial loss due to successful cyber-attacks.
Ensure that Azure Defender is set to On for Kubernetes
Ensure that Azure Defender is set to On for Kubernetes
- Enabling Azure Defender for Kubernetes helps to identify and remedy security vulnerabilities on your Kubernetes nodes, significantly reducing the risk of breaching the security of your cloud infrastructure.
- This policy ensures that the Kubernetes service in Azure is constantly monitored for any suspicious activities, providing an additional layer of security alongside the native security measures in place within Kubernetes.
- When set to ‘On,’ Azure Defender performs real-time threat protection, providing continuous security health monitoring, and advanced threat detection. It increases the ability to detect and respond promptly to any cyber threats.
- By enforcing this rule, it improves the security posture by identifying misconfigured Kubernetes resources and mitigates potential risk caused by malicious or erroneous deployments, ensuring compliance in line with best practices for Infrastructure as Code (IaC).
Ensure that Azure Defender is set to On for Container Registries
Ensure that Azure Defender is set to On for Container Registries
- Turning Azure Defender on for Container Registries helps identify potential security threats and vulnerabilities in the container images, boosting the overall security posture of the infrastructure.
- Having Azure Defender on would mean constant monitoring and real-time threat detection, enabling immediate response to potential attacks and security breaches.
- Enabling Azure Defender can assist in compliance with security standards and regulations, as it can provide detailed reports and logs needed for auditing purposes.
- Since the policy can easily be enforced using the Terraform ‘azurerm_security_center_subscription_pricing’ resource, it aids in the standardization of security configurations across all managed Container Registries.
Ensure that Azure Defender is set to On for Key Vault
Ensure that Azure Defender is set to On for Key Vault
- This policy ensures the extra layer of security provided by Azure Defender for Key Vault, a managed service that offers unified security management and threat protection. This is critical for detecting potential threats and preventing malicious activities.
- By enforcing Azure Defender to be set to On, the policy helps in protecting cryptographic keys, secrets, and certificates stored in Azure Key Vault, which are often the most sensitive pieces of data a company has.
- Compliance with this policy can significantly decrease the risk of data breaches or attacks against confidential data, enhancing the overall security of the Azure environment. It can provide real-time threat detection, weekly secure score, and remediation steps.
- The use of Infrastructure as Code (IaC) Terraform script allows for predictable and repeatable deployment, minimizing human error while turning on Azure Defender. This results in effective and efficient security policy enforcement for all the keys, secrets, and certificates stored within Azure Key Vault.
Ensure that app services use Azure Files
Ensure that app services use Azure Files
- This policy ensures that app services are utilizing Azure Files, an Azure cloud-based service that provides serverless file shares. This makes file data available to applications regardless of where they are running, thus enhancing application portability and efficiency.
- It reduces the risk associated with the complexity and overhead of creating and managing local file servers or NAS devices. Azure Files takes care of the management tasks, thus improving the security of app services by minimizing potential attack vectors that can come from poorly configured or managed resources.
- Azure Files used in App services provides a built-in disaster recovery solution as it comes with Azure Backup and Azure File Sync, providing easy data protection and replication, which makes it an important security measure to consistently backup crucial data and reduce the impact of data loss scenarios.
- The policy also helps ensure compliance with certain regulatory requirements that mandate data to be stored securely. By enabling app services to use Azure Files, organizations can potentially meet compliance obligations easier due to Azure’s multiple certifications and the inherent encryption provided for data at rest.
Ensure that Azure Cache for Redis disables public network access
Ensure that Azure Cache for Redis disables public network access
- Ensuring that Azure Cache for Redis disables public network access mitigates potential threats from the internet. Without this policy, the service could be at risk of malicious attacks such as Denial of Service (DoS) or unauthorized data access.
- This policy aids in the compliance with various security standards and regulations. For example, the GDPR and CCPA require the protection of data against unauthorized access, which can be achieved by blocking public network access to sensitive data caches.
- By disabling public network access, data transmission happens only over private network. This leads to efficient management of network traffic and reduces latency, thus helping in optimized performance for applications making use of Azure Cache for Redis.
- Adherence to this policy could limit the attack surface for potential hackers. As a result, the security incidents to be handled by the organization’s IT security team could be reduced, freeing them to focus on other important tasks.
Ensure that only SSL are enabled for Cache for Redis
Ensure that only SSL are enabled for Cache for Redis
- Only enabling SSL for Cache for Redis enforced data encryption during transmission, keeping the information safe from external threats and unauthorized intervention.
- Strict adherence to the policy promotes transparency and ensures that all attempts for data intervention are legitimate, aiding in the maintenance of data integrity.
- The policy reduces the threat landscape and potential attack vectors by disabling unsecure, non-SSL ports, which significantly increases the resilience of the infrastructure against cyber attacks.
- Its implementation on Terraform allows for consistent practices across the cloud infrastructure, making it easily adoptable and efficient to maintain in large scale operations.
Ensure that Virtual Machines use managed disks
Ensure that Virtual Machines use managed disks
- Ensuring that Virtual Machines use managed disks helps to encrypt disk data at rest using Azure’s platform-managed keys or your organization’s own keys, automatically enhancing data security and compliance.
- Using managed disks enables integration with Azure Backup service, providing an automatic backup and point-in-time restore function, which improves the system’s reliability and disaster recovery capability.
- Managed disks handle storage behind the scenes, reducing the management overhead and complexity for users associated with storage accounts, hence reducing potential security risks due to misconfiguration.
- Managed disks allow for the assignment of granular access permissions using Azure role-based access control (RBAC), reducing the chance of unauthorized access and enhancing the control over who can manage and access the resources.
Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption
Ensure that managed disks use a specific set of disk encryption sets for the customer-managed key encryption
- Ensuring managed disks use a specific set of disk encryption sets for customer-managed key encryption enhances data protection and ensures compliance with industry standards and best practices for data security. Personal or sensitive data is safeguarded against unauthorized access, enhancing overall cybersecurity posture.
- Strict adherence to this policy allows organizations to retain control over their encryption keys, avoiding potential security risks associated with third-party key management. This enhances accountability and provides assurance regarding data accessibility.
- Implementing this policy using Azure Resource Manager (ARM) facilitates centralized and standardized key management, enhancing operational efficiency and decreasing opportunities for human error, which can lead to security vulnerabilities.
- Non-compliance with this policy can lead to a security breach and loss of sensitive data, leading to regulatory fines, and damaging the reputation of the business. Adherence to the policy substantially mitigates these risks and promotes trust among clients and customers.
Ensure that My SQL server enables geo-redundant backups
Ensure that My SQL server enables geo-redundant backups
- This policy ensures that data is protected in the event of regional outages or natural disasters by being stored in multiple geographically diverse locations. This increases data availability and reduces the risk of data loss.
- With geo-redundant backups, systems can fail over to a secondary region for restored access to critical data, thus maintaining business continuity and minimizing downtime.
- Implementing this policy aligns with best practices for Disaster Recovery planning. It ensures that downtime is kept to a minimum and business operations can quickly resume even in extreme scenarios.
- The policy reduces the manual effort required in disaster recovery. In the case of a server failure, data can be restored quickly and efficiently due to the multiple copies in different regions.
Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets
Ensure that automatic OS image patching is enabled for Virtual Machine Scale Sets
- Enabling automatic OS image patching for Virtual Machine Scale Sets ensures that all the virtual machines within the set are always up-to-date with the latest operating system patches. This significantly reduces the attack surface that hackers can exploit due to outdated software weaknesses.
- The policy ensures continuity in operations, as patches often contain fixes to bugs and glitches. An un-patched operating system may result in interruptions that could degrade service performance or even lead to complete outages.
- The automated nature of the patches eliminates the need for manual intervention, which not only saves time and effort but also eliminates the risks of human error. This increases the efficiency of the organization’s infrastructure management efforts.
- Implementing this policy using Infrastructure as Code (IaC) approach allows for rapid, efficient, and scalable handling of patches across multiple virtual machine scale sets. It offers the ability to align patching processes with the broader DevOps practice, improving overall operational agility and consistency.
Ensure that MySQL server enables infrastructure encryption
Ensure that MySQL server enables infrastructure encryption
- This policy is imperative to maintain the confidentiality of data stored in MySQL servers. By enabling infrastructure encryption, the data at rest is securely encrypted, thereby preventing unauthorized data access.
- The impact of the policy is that even if the physical security is compromised and disks are stolen or accessed, the data remains secure and unusable to malicious parties as it is encrypted.
- This policy helps the companies or entities using Microsoft.DBforMySQL/flexibleServers or azurerm_mysql_server to comply with various industry regulations and standards (for instance, GDPR, HIPAA) that require data encryption for data protection.
- Not adhering to the policy might not only lead to potential data breaches and hefty regulatory fines, but could also erode customer trust, tarnish the organization’s reputation and negatively impact business continuity.
Ensure that Virtual machine scale sets have encryption at host enabled
Ensure that Virtual machine scale sets have encryption at host enabled
- Enabling encryption at the host for Virtual Machine scale sets helps protect the underlying infrastructure and sensitive data from unauthorized access and security breaches, providing enhanced security.
- With encryption at host turned on, it ensures that data is encrypted while it’s at rest, in transit, and during processing within the host. This mitigates the risk of sensitive data being exposed.
- Compliance with industry data security standards and regulations, such as GDPR and PCI DSS, often require encryption at host to be activated to prevent unauthorized access to data being handled by the virtual machines.
- It offers an additional layer of security for organizations dealing with highly sensitive data, fortifying defense against potential cyber threats and reducing the overall risk profile.
Ensure that Azure Container group is deployed into virtual network
Ensure that Azure Container group is deployed into virtual network
- Deploying Azure Container groups into a virtual network isolates them from the public internet, reducing exposure to external attacks and potential security threats.
- Ensuring deployment into a virtual network provides a control layer for network traffic, enabling administrators to manage incoming and outgoing traffic through security rules and border gateways.
- Architecting the deployment of Azure Container groups into virtual networks assists in the compliance with certain regulatory requirements and standards that emphasize data security and protection.
- The policy enhances network performance and inter-container communications, as traffic within a virtual network is typically faster and less congested than traffic over the shared public network infrastructure.
Ensure Cosmos DB accounts have restricted access
Ensure Cosmos DB accounts have restricted access
- This policy ensures that the access to Cosmos DB accounts is limited, enhancing the security by reducing the potential risk of unauthorized users gaining access to sensitive information in these accounts.
- By implementing this policy through Terraform, organizations can automate the security configurations of their infrastructure, protecting their Cosmos DB accounts without the need for manual intervention.
- The policy impacts the resource ‘azurerm_cosmosdb_account’, which is an Azure Resource Manager component related to Cosmos DB, Microsoft’s globally distributed, multi-model database service. Hence, it directly impacts data management and security on the Azure platform.
- It reinforces best practice to have restrictive permissions and secure access controls in place, thereby helping organizations prevent unnecessary exposure of their critical data stored in Cosmos DB and enhancing their overall security posture.
Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest
Ensure that Cosmos DB accounts have customer-managed keys to encrypt data at rest
- This policy ensures the protection of sensitive information by enforcing the usage of customer-managed keys (CMK) for at-rest data encryption in Cosmos DB accounts. This provides an additional layer of data protection by allowing customers to control, manage and rotate their own encryption keys.
- The policy increases regulatory compliance as certain standards and regulations mandate the use of customer-managed keys for at-rest data encryption. Non-compliance to such standards not only exposes the data to potential threats but also can lead to legal ramifications and fines.
- It protects data even when it is no longer actively being used without sacrificing performance, hence maintaining consistent and quality data access. Encrypting Cosmos DB data at rest prevents unauthorized access in case of any security incidents or breaches.
- By implementing this security measure, users can mitigate the risk of data exposure in the event that an unauthorized party gains physical access to the hardware on which the data is stored. It adds a safeguard to protect the integrity and confidentiality of your data even when it is stored inside the Azure infrastructure.
Ensure that Azure Cosmos DB disables public network access
Ensure that Azure Cosmos DB disables public network access
- Enabling this policy ensures that Cosmos DB instances are not exposed to the public internet, reducing the potential surface area for attacks and unauthorized access. This strengthens the overall security of your Azure infrastructure.
- By restricting the access to the Azure Cosmos DB to local networks only, the risk of data exposure and breaches is significantly diminished. This is crucial for organizations dealing with sensitive data as it limits the possibility of data leaks.
- The policy aligns with best practice for cloud security, as it minimizes the likelihood of unauthorized entry by ensuring the Azure Cosmos DB access is only available to trusted internal networks.
- Implementing this policy can also help organizations meet compliance requirements for data protection and privacy, such as GDPR or HIPAA, as they often require data to be restricted and secured against public access.
Ensure that PostgreSQL server enables geo-redundant backups
Ensure that PostgreSQL server enables geo-redundant backups
- Enabling geo-redundant backups for a PostgreSQL server ensures that all data is backed up and stored in a separate geographic location. This guarantees the availability and durability of data, even in the event of unexpected disasters or regional outages that could potentially lead to data loss.
- Geo-redundant backups provide an extra layer of failsafe by having a backup in a different geographical area. This redundancy mitigates risks associated with data center failure, natural disasters, or other location-specific issues that may disrupt access to important data.
- Using Infrastructure as Code (IaC) tools like Terraform to implement this policy allows automated and consistent security governance across multiple PostgreSQL servers. This way, databases are provisioned with geo-redundant backups by default, reducing the chance of human error in backup settings.
- Non-compliance with this policy may result in severe disruptions to business operations if critical data becomes irretrievably lost or inaccessible. Compliance therefore ensures business continuity and minimizes possible impacts on productivity and revenue.
Ensure that Azure Data Factory uses Git repository for source control
Ensure that Azure Data Factory uses Git repository for source control
- Ensuring Azure Data Factory uses a Git repository for source control is crucial for maintaining a streamlined history of changes, which makes debugging and risk management easier by enabling easy rollback to previous versions in case of faulty updates.
- This policy promotes collaboration and productivity among development teams, as Git acts as a single source of truth that allows multiple developers to work on a single project without overwriting each other’s changes.
- Enforcing the utilization of Git repositories aids in preventing data loss. Code stored on local machines can fall at risk during system failures, but Git provides an additional layer of security by offering remote and distributed version control.
- Compliance with this policy ensures an effective and efficient audit trail. In a secured Git repository, each code change is associated with a specific commit that identifies who made the change, when it was made, and why, thus increasing accountability and traceability.
Ensure that Azure Data factory public network access is disabled
Ensure that Azure Data factory public network access is disabled
- Disabling Azure Data factory’s public network access is critical as it limits the attack surface by preventing unauthorized access from potentially malicious public network users, thereby reducing the risk of data breaches.
- This policy can enable an organization to comply with various regulations and standards related to data protection and privacy, such as GDPR and CCPA, as it helps prevent unauthorized access to sensitive data processed or stored in the Azure Data Factory.
- The policy directly impacts the overall security posture of the organization’s infrastructure-as-code (IaC) environment by ensuring resources are secured by default. Using Terraform, automated compliance checks become easier and the risk of human error in configuring resources is minimized.
- The enforcement of this policy means that access to Azure Data Factory must be made via secure and approved private connections, which solidifies the network security infrastructure and calls for strict network access management.
Ensure that Data Lake Store accounts enables encryption
Ensure that Data Lake Store accounts enables encryption
- The policy is crucial as it ensures that data stored in the Azure Data Lake Store is encrypted, adding an extra layer of defense against unauthorized access, interception, and leakage of sensitive information.
- By enforcing this policy, confidentiality and integrity of data is maintained – even if data storage is compromised, encryption would render data inaccessible or unreadable to attackers.
- Without this policy, organizations run the risk of non-compliance with industry standards or regulations (such as GDPR or HIPAA) that mandate encryption of sensitive data at rest, potentially resulting in hefty fines and damage to reputation.
- Utilizing Infrastructure as Code (IaC) with Terraform to implement this policy provides consistency, ease of deployment and the ability to apply this policy at scale across multiple Data Lake Store accounts, increasing operational efficiency and reducing the risk of human error.
Ensure that Azure Event Grid Domain public network access is disabled
Ensure that Azure Event Grid Domain public network access is disabled
- Disabling Azure Event Grid Domain public network access is crucial in limiting the exposure of the event grid system to potential external attacks, therefore, enhancing the security of the system by reducing the surface area susceptible to exploits.
- This policy can prevent unauthorized access or manipulation of event grid data, which could have significant negative consequences such as data leaks, tampering, or even the triggering of unforeseen harmful events within the operation of the dependent systems.
- Ensuring public network access is disabled on Azure Event Grid Domain enforces the principle of least privilege, limiting the communication only to trusted and necessary entities, which is an important element in maintaining solid security governance in the cloud infrastructure.
- Non-compliance to this policy could lead to breaches of regulatory frameworks that dictate how data should be secured in public cloud environments, potentially leading to hefty fines and reputational damage for businesses.
Ensure that API management services use virtual networks
Ensure that API management services use virtual networks
- Ensuring API management services use virtual networks can help to isolate the APIs from the public internet, reducing the exposure of the APIs and consequently minimising the risk of external threats and attacks.
- Implementing this policy means only authorized internal networks can access the API management services, significantly enhancing data security and integrity by preventing unauthorized access.
- API management within virtual networks allows for more predictable and controlled network traffic, as traffic comes through known and manageable network paths, thereby improving the visibility and traceability of traffic.
- The use of virtual networks within API services follows the principle of least privilege, as it allows for implementation of network controls, such as subnets and network security groups, which can be fine-tuned to restrict access to only necessary entities.
Ensure that Azure IoT Hub disables public network access
Ensure that Azure IoT Hub disables public network access
- This policy ensures that Azure IoT Hub is protected from the large number of potential malicious actors on the public internet, thus fortifying the network infrastructure against possible breaches.
- Disabling public network access for Azure IoT Hub reduces the attack surface and prevents unauthorized individuals from attempting to access, manipulate, or disrupt the system’s functionality.
- Adhering to this policy aligns with best security practices of ensuring that sensitive IoT devices and data are not exposed unnecessarily to public networks, thereby reducing the potentially catastrophic consequences of a successful attack.
- Since infrastructure as Code (IaC) such as Terraform is being leveraged, this policy ensures the security is pre-configured and automatically enforced during the provisioning and configuration process, enhancing the consistency and efficiency of security controls.
Ensure that key vault allows firewall rules settings
Ensure that key vault allows firewall rules settings
- This policy ensures that all interactions with the key vault are regulated through firewall rules, thereby strengthening the overall security posture by preventing unauthorized access or tampering with the keys.
- By enforcing firewall rules settings on the key vault, the policy mitigates the risk of data breaches from both within and outside the entity. This can shield the entity from potential reputational and financial damages.
- It increases the robustness of the infrastructure, particularly in regulated sectors such as banking and healthcare where the safe storage and access of data are paramount. Compliance with regulatory norms could be easier.
- The strict enforcement of firewall rules on key vault aids in attaining an elaborate audit trail for security events. Any events or attempts breaching the security norms can be monitored and rectified promptly.
Ensure that key vault enables purge protection
Ensure that key vault enables purge protection
- Purge protection in key vaults ensures that, once deleted, the data in the vault cannot be permanently removed until a retention period expires, preventing accidental or malicious data loss.
- Any data loss, accidental or deliberate, can be restored as long as the retention period hasn’t expired, providing a solid recovery pathway for businesses and minimizing the risk of business disruption.
- This security policy helps with regulatory compliance as some legislation and guidelines require certain sensitive data to remain accessible or recoverable for a specific period of time.
- Implementing this policy in Terraform provides infrastructure as code (IaC) benefits such as versioning, testing, and repeatability, thereby improving the overall security posture in a scalable and manageable way.
Ensure that key vault enables soft delete
Ensure that key vault enables soft delete
- This policy makes sure that accidentally deleted keys can be recovered by enabling soft delete on key vault. It acts as a safety measure against unintended data loss and ensures business continuity.
- Enabling soft delete adds an extra layer of security by providing a recovery period before the data is permanently deleted, thereby thwarting malicious attempts to erase vital cryptographic keys and secrets.
- Given the critical role of key vaults in managing and safeguarding cryptographic keys and secrets, lack of this policy could lead to severe security breaches, unauthorized access, and potential loss of sensitive data.
- This rule also provides a mechanism of auditing and monitoring where all deletions (soft deletes) can be tracked, allowing security teams to investigate any untoward incidents or suspicious activities.
Ensure that key vault key is backed by HSM
Ensure that key vault key is backed by HSM
- This policy ensures that keys stored in the Key Vault are backed by Hardware Security Module (HSM). HSM is a physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. This policy ensures cryptographic keys are stored in a more safe and secure space.
- Without the keys being backed by HSM, they would be susceptible to security attacks. This policy improves the security infrastructure, ensures the sustainability of keys, and assists in reducing potential attack vectors to the keys in the vault.
- This security policy focuses on mitigating risks and improving data security which is paramount, especially for companies dealing with sensitive and confidential data. Mismanagement of cryptographic keys would lead to a potential data breach that could be disastrous for any organization.
- This policy is vital as it adds an extra layer of protection by making the unauthorized extraction of keys practically impossible, even under physical access. This utilization of hardware-backed keys increases the trust in the overall system that the keys are kept secret.
Ensure that SQL server disables public network access
Ensure that SQL server disables public network access
- Disabling public network access to SQL servers is crucial to enhancing data security and access control, as servers are vulnerable to SQL injection attacks and other malicious hacking attempts that may compromise data integrity.
- By limiting access to the SQL server to a local network or VPN, the policy reduces the attack surface and the likelihood of unauthorized access or data breaches.
- In the event of a data breach, this security measure can limit the spread of the attack inside the network, aiding in incident management and response.
- With the Infrastructure as Code (IaC) model (in this case, Azure Resource Manager or ‘arm’), this policy can be implemented and enforced automatically across an organization’s infrastructure, ensuring consistent security implementations and reducing the possibility of human error in configuration.
Ensure that key vault secrets have 'content_type' set
Ensure that key vault secrets have 'content_type' set
- Specifying the ‘content_type’ for key vault secrets aids in the optimal organization and management of secrets stored in Microsoft Azure Key Vault, enhancing operational efficiency by allowing users to categorize and filter secrets based on content type.
- It helps developers and users to quickly identify the type of secret they are dealing with, preventing potential confusion or misuse that could result from uncertainty, thereby, increasing the application security and productivity.
- It could safeguard against potential security issues or breaches, as failing to specify the type of content stored in key vault secrets can leave the infrastructure vulnerable to attacks or unauthorized access, if the content type is incorrectly inferred.
- In compliance and auditing perspective, having ‘content_type’ set helps in tracking the types of secrets stored in a key vault, making the Azure infrastructure more resilient and compliant with standards like ISO 27001, PCI-DSS, which require proper management and classification of confidential elements.
Ensure that AKS enables private clusters
Ensure that AKS enables private clusters
- Ensuring that Azure Kubernetes Service (AKS) enables private clusters adds an extra layer of security by limiting access to the Kubernetes API server endpoint to the virtual network which the AKS cluster is deployed in, making it only reachable through a private IP and not exposed to the public, helping to prevent unauthorized access.
- This policy promotes best practices for virtual networking in a Kubernetes environment, reducing the risk that misconfigurations or overlooked settings could leave vulnerable endpoints exposed to potential attackers.
- Its implementation can lead to enhanced control over traffic flow, as private clusters mean that all the control plane and node traffic remains within the Azure network, boosting both security and performance.
- Utilizing this rule within the Terraform infrastructure provides a repeatable and consistent method of applying this policy across multiple AKS environments, promoting scalability without compromising policy adherence.
Ensure that AKS uses Azure Policies Add-on
Ensure that AKS uses Azure Policies Add-on
- This policy ensures that Azure Kubernetes Service (AKS) clusters are configured with Azure Policies Add-on. Having the Azure Policies Add-on enables a more robust security posture, as it allows for implementing and enforcing compliance at scale, across multiple clusters and in real-time.
- Utilizing the Azure Policies Add-on as part of AKS can help maintain compliance with company policies or regulatory standards. By directly integrating it into the AKS environment, organizations can automate compliance assessments and remediate non-compliant resources.
- The Azure Policies Add-on for AKS continuously monitors for undesirable configurations, alerting administrators of any potential security threats or policy violations. A proactive approach to infra security is crucial in protecting sensitive data and maintaining customer trust.
- Integration of this security policy via the mentioned Infrastructure as Code (IaC) resource link for Terraform enables efficient and reliable implementation. This ease of use reduces potential human error during manual configuration and promotes consistency across different deployments.
Ensure that AKS uses disk encryption set
Ensure that AKS uses disk encryption set
- The policy ensures that the Azure Kubernetes Service (AKS) utilizes disk encryption sets for disk-level data protection, hence reducing the risk of exposure or theft of sensitive data stored on the disks.
- This policy helps organizations comply with certain regulations (like GDPR, HIPAA) and standards that mandate data encryption at rest, by enforcing that disk encryption functionality is implemented in Kubernetes clusters managed by Azure’s azurerm_kubernetes_cluster resource.
- The policy reduces the burden on developers by automating the enforcement of disk encryption via an Infrastructure as Code (IaC) approach using Terraform. This promotes a proactive, preventative approach to security and reduces the likelihood of human errors resulting in insecure configurations.
- Ensuring AKS uses disk encryption sets helps maintain the integrity and confidentiality of data, thereby minimizing the potential damage and financial cost that could result from security breaches and reinforcing customer trust.
Ensure that Network Interfaces disable IP forwarding
Ensure that Network Interfaces disable IP forwarding
- Disabling IP forwarding on Network Interfaces helps to limit the data flow between network devices, thus potentially preventing unauthorized traffic within the network infrastructure. This adds an extra layer of security by reducing the possibility of malicious activities such as man-in-the-middle attacks.
- By ensuring that IP forwarding is disabled, it helps to enforce the principle of least privilege where a device or a user only has access to the information and resources that are necessary for its legitimate purpose.
- This policy is useful in protecting sensitive data within a network. If IP forwarding is enabled, a compromised device could potentially be used to redirect traffic to other network devices, allowing an attacker to gain access to these devices and data they contain.
- Using Infrastructure as Code (IaC) tool like Terraform to maintain this policy ensures consistent application across all network interfaces. It also allows easy tracking and auditing of security configurations, enhancing the visibility and control over network security posture.
Ensure that Network Interfaces don't use public IPs
Ensure that Network Interfaces don't use public IPs
- Implementing this policy minimizes exposure to cyber threats by avoiding public IPs, which are accessible from the internet and therefore more susceptible to attacks such as DDOS and unauthorized access attempts.
- Ensuring network interfaces utilize private IPs enhances control over access as traffic can only come from within the same network, allowing for better regulation of data flow and increased data security.
- This policy is significant towards complying with data protection regulations. It aids in safeguarding sensitive information from exposure to public networks, thus reducing the chances of data breaches and potential related legal repercussions.
- By ensuring your network interfaces don’t use public IPs, you also decrease the likelihood of IP address conflicts that can occur from the wider pool of devices utilizing public IP addresses, thus ensuring reliable network connectivity and operation.
Ensure that Application Gateway enables WAF
Ensure that Application Gateway enables WAF
- Enabling Web Application Firewall (WAF) on Application Gateway helps in defending against common web-based attacks, such as Cross-Site Scripting and SQL Injection, thus protecting web applications from malicious traffic.
- The WAF-enabled Application Gateway also allows for closer inspection of HTTP traffic, providing better visualization and mitigation of attacks, thereby strengthening the security posture of the application.
- It promotes compliance with security standards and regulations by implementing a layer of security that detects and prevents exploits from affecting the system. This is crucial for businesses dealing with sensitive customer information.
- Without the WAF enabled, the system would be exposed to possible application layer attacks, which could lead to data breaches, downtime, and ultimately financial losses and reputational damage.
Ensure that Azure Front Door enables WAF
Ensure that Azure Front Door enables WAF
- This policy ensures that a Web Application Firewall (WAF) is enabled on Azure Front Door, providing an added layer of security and protection from common threats such as SQL injection, cross-site scripting (XSS), and other web exploits.
- WAF on Azure Front Door allows businesses to define custom security rules that meet their specific needs, enhancing flexibility while maintaining a robust defense against potential cyber attacks.
- Without enabling WAF on Azure Front Door, the system may be more vulnerable to attacks, potentially resulting in unauthorized access, data breaches, system downtimes, compliance violations, and damage to business reputation.
- The enablement of WAF directly impacts the overall security posture, reliability, and robustness of a system or application hosted on Azure, hence the policy is critical in maintaining data integrity and system uptime in Azure environments.
Ensure that Application Gateway uses WAF in 'Detection' or 'Prevention' modes
Ensure that Application Gateway uses WAF in 'Detection' or 'Prevention' modes
- The policy ensures the Microsoft Azure Application Gateway is using a Web Application Firewall (WAF) in either ‘Detection’ or ‘Prevention’ modes, enhancing the security level by detecting and potentially blocking harmful traffic to the applications served by the gateway.
- By adhering to this policy, potential security threats can be logged in ‘Detection’ mode or both logged and blocked in ‘Prevention’ mode, alerting the system administrators about any potentially harmful patterns and activities.
- Failing to use WAF or using it in a wrong mode could expose applications protected by the gateway to web vulnerabilities, such as SQL injection, cross-site scripting, and other OWASP top 10 threats, thereby impacting the integrity, confidentiality and availability of the application data.
- The policy ensures an improved security posture and reduces potential breaches by automating the configuration and setting of WAF modes through Infrastructure as Code (IaC) using Terraform, minimizing human-error and enhancing consistent, repeatable deployments.
Ensure that Azure Front Door uses WAF in 'Detection' or 'Prevention' modes
Ensure that Azure Front Door uses WAF in 'Detection' or 'Prevention' modes
- This policy ensures that Azure Front Door, a scalable and secure entry point for fast delivery of your global applications, has the Web Application Firewall (WAF) turned on in either ‘Detection’ or ‘Prevention’ modes. This is crucial in protecting the server and network from a plethora of potential vulnerabilities and attacks.
- ‘Detection’ mode in WAF records most of the cyber attacks but does not stop them, thereby providing invaluable information on the types of attacks the server/network is most susceptible to. ‘Prevention’ mode not only detects these attacks but actively takes steps to stop them, adding an additional layer of protection against cyber threats.
- Implementing this policy benefits from the automatic updates and protection against new vulnerabilities provided by WAF. This significantly reduces management complexity and security risk, and thus creating a more reliable and secure environment.
- A policy of proactively activating WAF at the Azure Front Door will contribute dynamically to the organization’s overall security posture, enhancing its resilience against cyber attacks, potentially preserving data integrity, and upholding service availability.
Ensure that Azure Cognitive Search disables public network access
Ensure that Azure Cognitive Search disables public network access
- Disabling public network access to Azure Cognitive Search reduces the surface area for potential threats such as unauthorized access or breaches, enhancing the security of the service.
- This policy can prevent potential data leakage or loss, as search service contains sensitive data like user queries, and any unauthorized exposure could lead to misuse of the information.
- Enforcing this rule can help organizations comply with data privacy regulations which often require that personal or sensitive data is stored or transmitted over secure networks only.
- The policy can help maintain secure service-to-service communication within Azure, assuring clients and stakeholders about the efficient and secure management of the Search Services.
Ensures that Service Fabric use three levels of protection available
Ensures that Service Fabric use three levels of protection available
- This policy increases the security of the Service Fabric by enabling three levels of protection, reducing the risk of unauthorized access, data breaches, and inadvertent exposure of sensitive information.
- By utilizing infrastructure as code (IaC) with Terraform, the policy can be rapidly and consistently deployed across multiple instances, increasing operational efficiency and ensuring a uniform security posture across an organization’s Service Fabric clusters.
- The policy makes sure that the azurerm_service_fabric_cluster resource is conforming to best practices and meeting an organization’s internal security standards, thereby achieving compliance with regulatory requirements and industry standards.
- The automated validation of this policy provided through the resource implementation link allows for continuous monitoring and regular auditing, thereby enabling quick detection and correction of potential security vulnerabilities in the Service Fabric clusters.
Ensures that Active Directory is used for authentication for Service Fabric
Ensures that Active Directory is used for authentication for Service Fabric
- This policy ensures that all authentication requests for Service Fabric are passed through Active Directory, providing a single point for administrating and enforcing security policies, which enhances the overall security landscape of the infrastructure.
- Implementing this policy aids in minimizing the risk of unauthorized access by necessitating that users authenticate against Active Directory, a proven and robust identity management system, before they can interact with Service Fabric.
- The policy, when applied, helps in compliance with various regulatory standards that require stringent user access controls, auditability and traceability, as it ensures that user access logs to Service Fabric can be tracked via Active Directory.
- If this policy isn’t adhered to, it could lead to inconsistencies in user access controls which may potentially open up vulnerabilities in the Service Fabric, compromising the security and integrity of the whole system.
Ensure that My SQL server enables Threat detection policy
Ensure that My SQL server enables Threat detection policy
- Enabling MySQL server threat detection policy significantly fortifies the database’s security posture by identifying and mitigating potential threats and anomalous activities, reducing the likelihood of data breaches and unauthorized access.
- The policy plays a crucial part in regulatory compliance, ensuring that the MySQL server operations align with laws and industry regulations like GDPR or HIPAA that mandate specific security measures including threat detection, hence avoiding potential fines or legal issues.
- If a threat detection policy is not enabled, the MySQL server may lack critical proactive monitoring which could lead to undetected anomalies and compromise the server’s stability and the integrity of data stored within, potentially causing operational disruptions.
- Enabling this policy provides automated security alerts which can accelerate incident response times, enabling quicker remediation of vulnerabilities or malicious activities, and preserving the system’s performance and reliability.
Ensure that PostgreSQL server enables Threat detection policy
Ensure that PostgreSQL server enables Threat detection policy
- Enabling Threat Detection Policy on PostgreSQL servers helps to detect unusual and potentially harmful attempts to access or exploit databases, thereby increasing the overall cybersecurity posture of the system.
- It provides a proactive security measure for your Azure PostgreSQL servers by identifying, detecting, and responding to potential threats as they occur, preventing unauthorized access or data breaches.
- By using the IaC tool Terraform to activate this policy, you’ll gain a programmatic and systematic approach to enforce security rules consistently across all PostgreSQL server instances, eliminating manual error.
- Without threat detection enabled on your PostgreSQL server, your databases may stay vulnerable to potential security attacks, leading to possible data loss or breach, undermining customer trust and potentially causing significant business impact.
Ensure that MariaDB server enables geo-redundant backups
Ensure that MariaDB server enables geo-redundant backups
- This policy ensures that backups of your MariaDB server will not be lost due to a single geographic outage, as backups are stored in more than one region, thereby mitigating risks associated with geographically localized catastrophes.
- Enforcing this policy helps in business continuity and disaster recovery process as geo-redundant backups can be used to restore services quickly in case of failures, reducing the downtime of business-critical applications.
- With MariaDB server enabling geo-redundant backups, businesses can ensure compliance with data sovereignty regulations that require data to be stored in multiple, geographically distant locations.
- By employing this policy through Infrastructure as Code (IaC) using Terraform, consistent application of such backup strategy is guaranteed across all MariaDB servers, offering efficiency and eliminating the chance of human error in manual configuration.
Ensure that PostgreSQL server enables infrastructure encryption
Ensure that PostgreSQL server enables infrastructure encryption
- Enabling PostgreSQL server infrastructure encryption is crucial for protecting sensitive information stored in the database. It ensures the data cannot be accessed in raw format if intercepted during transfer or accessed without proper authentication.
- The policy helps in maintaining compliance with data protection regulations. Many businesses require proof of data protection measures such as encryption to meet legal and compliance standards like GDPR, PCI DSS, and HIPAA.
- Enforcing the policy ultimately contributes to reducing the chances of data breaches. Even in the event of a system compromise, encrypted data remains indecipherable, thus ensuring the safety of the stored information.
- The policy ensures secure communication within the cloud infrastructure. This effectively prevents man-in-the-middle attacks, where unauthorized entities can intercept and potentially manipulate data during transmission.
Ensure that 'Security contact emails' is set
Ensure that 'Security contact emails' is set
- Setting ‘Security contact emails’ ensures that important security notifications related to Azure resources, including alerts about potential threats and vulnerabilities, are promptly delivered to a designated contact, enhancing the organization’s response times.
- Without ‘Security contact emails’ set, crucial security alerts could be missed, potentially leading to prolonged exposure to security risks or breaches, which in turn could result in data loss or system compromise.
- With infrastructure as code (IaC) tool like Terraform, setting ‘Security contact emails’ ensures consistent implementation across all deployed resources, reducing the complexities associated with manual configurations and the probability of human error.
- Violation of this policy could lead to non-compliance with standard security practices and regulations, potentially resulting in penalties or reputational damage for the company.
Ensure cosmosdb does not allow privileged escalation by restricting management plane changes
Ensure cosmosdb does not allow privileged escalation by restricting management plane changes
- This policy prevents unauthorized users from escalating their privileges, enhancing the security of cosmosdb by limiting potential malicious activities such as data manipulation or theft.
- By restricting management plane changes, the policy ensures that the fundamental logical controls governing the system cannot be easily altered, therefore maintaining the overall infrastructure’s security.
- The implementation link provided (CosmosDBDisableAccessKeyWrite.py) shows how this policy can be deployed in Azure Resource Manager (arm), making it particularly applicable for entities using Microsoft.DocumentDB/databaseAccounts and azurerm_cosmosdb_account.
- Compliance with this policy reduces the risk of security breaches and regulatory non-compliance, while facilitating secure and controlled access to the CosmosDB databases.
Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
Ensure Front Door WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
- The policy ensures that the Azure Front Door WAF (Web Application Firewall) can prevent message lookup in Log4j2, offering protection against the critical vulnerability known as log4jshell (CVE-2021-44228). This improves the security robustness of the system by effectively reducing the potential attack surface.
- By incorporating this policy in the Terraform code, developers can create Infrastructure as Code (IaC) that inherently adheres to important security standards, thereby reducing the chances of human-error security breaches.
- This policy can enhance an organization’s cybersecurity posture, as it directly addresses specific known vulnerabilities that could be exploited, potentially leading to unauthorized access, data theft, or disruption of services.
- It’s particularly essential, as the log4j vulnerability has broad implications across multiple software ecosystems due to its widespread usage, and its exploitation can lead to remote code execution, one of the most harmful types of security vulnerabilities.
Ensure that Cognitive Services accounts disable public network access
Ensure that Cognitive Services accounts disable public network access
- This policy ensures that access to Cognitive Services accounts is appropriately restricted, reducing the risk of unauthorized access and potential data breaches, which can be damaging to business operations and reputation.
- By disabling public network access, it forces all connections to be made over private networks, minimizing exposure to external threats such as hackers and cybercriminals.
- Enhances compliance with data protection regulations and standards like GDPR or HIPAA, which often mandate certain security measures such as securing network access to sensitive resources.
- Since the policy is enforced through Infrastructure as Code (IaC), it brings consistency in the security configuration across multiple instances of Cognitive Services accounts and allows for easy tracking of security policy compliance.
Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
Ensure Application Gateway WAF prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
- This policy mitigates the risk of the critical Log4j vulnerability (CVE-2021-44228), also known as log4jshell, which allows remote code execution by attackers via logging events and could expose sensitive information in your applications.
- By preventing message lookup in Log4j2 within your Application Gateway Web Application Firewall (WAF), it helps to block the path of potential exploits that would take advantage of unchecked log message lookups in a Java-based system using Log4j.
- Azurerm_web_application_firewall_policy resources would be more secure following this rule, by stopping any malicious log injection attacks from reaching the application layer, thereby greatly decreasing the vulnerability surface area that an attacker might exploit.
- Integration in Infrastructure as Code (IaC) processes, enabled by this policy through a Terraform tool, means that the policy is applied consistently across all environments, reducing the likelihood of configuration inconsistencies and errors.
Ensure that PostgreSQL Flexible server enables geo-redundant backups
Ensure that PostgreSQL Flexible server enables geo-redundant backups
- This policy ensures that in the event of a regional outage, your PostgreSQL Flexible server data remains available since the geo-redundant backups allow you to recover your data in a different geographical area.
- Enabling geo-redundant backups for PostgreSQL Flexible server enhances the security against data loss as it provides an extra layer of protection against local catastrophic events like natural disasters.
- Implementing this policy via Infrastructure as Code (IaC) tool like Terraform allows more consistent and reliable deployment, contributing to the overall resiliency of the system.
- Non-compliance to this policy could lead to potential business continuity risks and failures in disaster recovery strategies, if primary region fails and no redundancy is available.
Ensure ACR admin account is disabled
Ensure ACR admin account is disabled
- The policy ensures that the Azure Container Registry (ACR) admin account is disabled, limiting potential vectors of unauthorized access or security breaches. This safeguards sensitive data and functions within the container registry from being manipulated or accessed without proper authorization.
- Enforcing this policy guarantees adhering to the principle of least privilege by restricting admin account access, thus reducing the risk of internal security threats caused by excessive permissions, misconfigurations, and potential misuse of admin privileges.
- By disabling the ACR admin account, the policy prompts the use of individual Azure Active Directory (AAD) credentials for authentication. This provides better auditability of actions performed within the registry, as each operation can be linked to the unique identifier of an AAD account.
- The policy’s implementation with Infrastructure as Code (IaC) tool Terraform allows for security to be seamlessly integrated into the DevOps process. This facilitates automated security checks, compliance assessments, and remediation of violations before they become security vulnerabilities, improving overall infrastructure security.
Ensures that ACR disables anonymous pulling of images
Ensures that ACR disables anonymous pulling of images
- This policy prevents unauthorized or anonymous users from pulling and downloading images from Azure Container Registry (ACR), thus enhancing control over access to image repositories and reducing potential risks from uncontrolled distribution.
- Disabling anonymous pulling of images helps maintain the integrity of the images by ensuring only authenticated and authorized users can access them, safeguarding against potential malicious manipulation or unintentional modifications.
- It protects against potential exploits where cyber criminals or malicious servers could anonymously pull and inject malicious software code into the container images, thereby compromising the entire container infrastructure.
- Implementation of this policy can help comply with various strict data privacy regulations, security standards, and audits that require controlling and restricting access to sensitive data, including software codes.
Ensure ACR set to disable public networking
Ensure ACR set to disable public networking
- The policy ensures that the Azure Container Registry (ACR) is not publicly accessible, which greatly reduces the threat surface by preventing unauthorized access or interference from potentially malicious actors.
- By disabling public networking in ACR, data privacy is enhanced as it prevents unintentional exposure and leak of sensitive data stored in the containers, which can lead to serious data breach.
- Implementing this policy through Infrastructure as Code (IaC) tool like Terraform allows for standardized and consistent enforcement across different environments, enhancing overall enterprise security posture.
- Enforcing this policy minimizes the risk of regulatory non-compliance as many governance standards and laws demand specific security measures such as limiting the exposure of data to public networks.
Ensure that Local Authentication is disabled on CosmosDB
Ensure that Local Authentication is disabled on CosmosDB
- Disabling Local Authentication on CosmosDB ensures that all requests to the database are authenticated via Azure Active Directory (AAD) instead of locally stored credentials, enhancing security by minimizing potential entry points for hackers.
- This policy helps organizations meet compliance requirements for data protection since sensitive data in CosmosDB is accessed through an additional layer of security provided by AAD.
- Misconfigured or accessible local authentication can lead to data breaches, loss of sensitive information, and denial of service attacks. Enforcing this policy minimizes these vulnerabilities.
- By implementing this policy via Infrastructure as Code (IaC) tool like Terraform, developers can maintain consistent security configurations across different environments and deployments, reducing human errors and ensuring best security practices are followed.
Ensure AKS local admin account is disabled
Ensure AKS local admin account is disabled
- The policy is crucial in minimizing potential attack vectors to the AKS cluster by ensuring that the local admin account is disabled. Local admin accounts can be easily abused if compromised, hence disabling these accounts improves the security posture.
- This policy not only enhances the overall security of the AKS cluster but also ensures compliance with security best practices and regulations, such as the principle of least privilege, which suggests limiting user permissions to only those needed.
- Enablement of the AKS local admin account increases the risk of an unauthorized user gaining escalated privileges, potentially leading to a security breach. Once this account is disabled as per policy, it reduces the likelihood of such breaches.
- This policy can impact resource availability if not followed correctly. By disabling the local admin account, it could potentially lock out legitimate users who need administrative access. Adequate precautions and granting necessary role-based access are crucial to prevent a denial of access situation.
Ensure Machine Learning Compute Cluster Local Authentication is disabled
Ensure Machine Learning Compute Cluster Local Authentication is disabled
- Disabling local authentication for Machine Learning Compute Cluster prevents unauthorized access by eliminating potential internal vulnerabilities, thus enhancing the overall security of the ML infrastructure in Azure.
- Leaving local authentication enabled could lead to potential abuse of authentication loopholes, posing a risk to the integrity and confidentiality of the data processed within the ML Compute Cluster.
- By enforcing this policy, the risk of insider threats is significantly reduced as it limits the authentication process specifically to trusted and approved external user identities or services.
- Compliance with this policy will streamline the authentication process, leading to more secure and manageable audits, and accountability within the system, which is often required for corporate security standards and regulation compliance.
Ensure AKS cluster nodes do not have public IP addresses
Ensure AKS cluster nodes do not have public IP addresses
- Restricting AKS cluster nodes from having public IP addresses prevents potential unauthorized access and data breaches as it reduces the attack surface by limiting nodes’ exposure to the public internet.
- This policy ensures that all communication with the AKS nodes must pass through the Kubernetes API server, increasing the control and visibility over the network traffic, hence improving network security.
- Compliance with this policy prevents DDoS attacks, IP spoofing, or any outbound connections to malicious sites by globally isolating the AKS nodes with no direct connections to the internet.
- Non-compliance can increase resource costs, as public IP addresses are billable resources. If an AKS node unnecessarily uses a public IP address, it can lead to wasteful spending.
Ensure that Public Access is disabled for Machine Learning Workspace
Ensure that Public Access is disabled for Machine Learning Workspace
- Disabling public access for the Machine Learning Workspace in Azure helps to maintain security by limiting the possibility of unauthorized access or malicious intrusion from the open internet, which can cause data breaches or unauthorized operations.
- The policy enhances data privacy because if public access is allowed, sensitive information processed within the ML workspace could be exposed, leading to a violation of confidentiality agreements or regulations such as GDPR.
- Making the ML workspace private is crucial for compliance with several regulations and standards, including the privacy rule of HIPAA and the security controls of ISO 27001. The enforcement of this policy ensures that the organization stays compliant with these rules.
- Implementing this policy through Infrastructure as Code (IaC) using Terraform automates the deployment of secure infrastructures, reducing human error, and maintaining consistency in security configurations across multiple environments and workspaces.
Ensure Function app is using the latest version of TLS encryption
Ensure Function app is using the latest version of TLS encryption
- Ensuring the Function app uses the latest version of TLS encryption helps keep the data transmission secure between the client and the server, protecting sensitive or confidential information from being intercepted or tampered in the process.
- This policy enhances the overall security posture of the cloud infrastructure and reduces the potential for vulnerability exploitation. Older versions of TLS encryption have known vulnerabilities that can be exploited by malicious actors, making this update crucial.
- Non-compliance to this policy may result in functions being unable to establish secure connections with other services or clients that only support the latest TLS version causing hindrance in the operation.
- The policy directly impacts the entities azurerm_function_app, azurerm_function_app_slot, azurerm_linux_function_app, azurerm_linux_function_app_slot, azurerm_windows_function_app, azurerm_windows_function_app_slot, as they all require secured communication channels for reliable and secure function execution.
Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server
Ensure server parameter 'log_retention' is set to 'ON' for PostgreSQL Database Server
- Enabling ‘log_retention’ for PostgreSQL Database Server ensures that activity logs are kept for a longer period, providing necessary audit trails and incident tracking which are crucial for incident management and forensic analysis in case of a security breach.
- By having ‘log_retention’ set to ‘ON’, any abnormal changes or questionable activities can be tracked and investigated right away, enhancing the security of the PostgreSQL database server, detecting fraud, and preventing potential security threats.
- ‘Log_retention’ set to ‘ON’ supports compliance with data governance and regulatory standards that require maintaining specific log retention periods, preventing potential fines or sanctions due to non-compliance.
- Setting ‘log_retention’ to ‘ON’ through Infrastructure as Code (IaC) implementation with Terraform can automate the process of maintaining this policy across multiple servers or instances, ensuring a consistent security posture and reducing chances of human error in configuration.
Ensure PostgreSQL is using the latest version of TLS encryption
Ensure PostgreSQL is using the latest version of TLS encryption
- Ensuring PostgreSQL is using the latest version of TLS encryption maximizes defense against data breaches. Updated encryption standards offer more sophisticated protection.
- With this policy, PostgreSQL connections benefit from stronger encryption algorithms and enhanced mechanisms which secure data during transmission. TLS encryption greatly reduces the possibility of eavesdropping attacks.
- Using outdated versions of TLS encryption may have known vulnerabilities that attackers can exploit. This policy mitigates this by ensuring only latest versions with known secure implementations are in use.
- Compliance with this policy ensures safer database management and access, which is a must for sensitive data stored within PostgreSQL servers.
Ensure Redis Cache is using the latest version of TLS encryption
Ensure Redis Cache is using the latest version of TLS encryption
- Ensuring Redis Cache uses the latest version of TLS encryption prevents potential data breaches, as it uses modern encryption algorithms to secure data transmissions making it harder for attackers.
- This policy ensures the strongest possible encryption communication between clients and the Redis Cache server, protecting sensitive data from being intercepted or tampered.
- By using the latest TLS version, the policy ensures the infrastructure stays up-to-date with current encryption standards, leading to better protection against emerging security threats.
- Non-compliance with this policy may result in failing regulatory and industry-specific data security standards, potentially leading to fines, penalties, or loss of customer trust.
Ensure that Virtual machine does not enable password authentication
Ensure that Virtual machine does not enable password authentication
- Ensuring that virtual machines do not enable password authentication reduces the risk of unauthorized access. Without this policy, systems could be easily compromised if passwords are weak, reused, or not securely stored.
- This policy promotes the use of more secure alternatives such as key pair authentication which is often considered more secure due to the private key being only stored on user’s local machine.
- Implementing this policy supports adherence to best practices in secure computing and aligns with compliance requirements for many industry standards (like HIPAA or PCI DSS) that stipulate strong access controls and authentication mechanisms.
- A breach resulting from inadequate authentication methods like passwords can cause significant damage, ranging from data loss or alteration, service disruption, to reputational harm for the organization. This policy helps to prevent these potential impacts.
Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0
Ensure Machine Learning Compute Cluster Minimum Nodes Set To 0
- This policy ensures that resources are effectively utilized by allowing the Machine Learning (ML) compute cluster to scale down to zero nodes when not in use, thus preventing wastage and reducing cost on Azure.
- The policy facilitates on-demand scalability by dynamically adjusting the number of nodes based on the processing needs. When the load is low, the cluster size can go down to zero ensuring efficiency.
- As the cluster can scale down to zero nodes, it reduces the surface area for potential attacks, enhancing the infrastructure’s security.
- Implementation of this policy using Infrastructure as Code (IaC) tool, Terraform ensures consistency, repeatability and minimizes human errors while setting up ML compute clusters.
Ensure Windows VM enables encryption
Ensure Windows VM enables encryption
- Enabling encryption on Windows Virtual Machines safeguards sensitive data from potential breaches or unauthorized access, enhancing overall data security on the cloud platform.
- The practice reduces the risk of data leakage that can occur during the process of transmitting and storing data, thereby protecting confidential corporate information and customer details.
- The policy implementation helps to comply with security standards and regulations like GDPR that require strict data confidentiality and integrity measures in place to avoid heavy penalties.
- It reassures customers and other stakeholders about data safety, fostering their trust in the organization’s robust IT security practices.
Ensure Client Certificates are enforced for API management
Ensure Client Certificates are enforced for API management
- Enforcing client certificates for API management is essential because it ensures all clients are authenticated using a common trusted certificate, which significantly reduces the chance of unauthorized access or malicious attacks.
- This policy is beneficial for improving the overall security of data exchanged between the client and the server, as the use of certificates provides an extra layer of protection, ensuring the data transmitted is from a trusted source.
- Enforcing this policy enables detection of any tampering or interception attempts in the communication between the client and the server, safeguarding the data integrity. If the certificate does not match the client certificate on the server, it would be flagged as an unauthorized access attempt.
- It can also prove advantageous in a multi-client environment where managing access for individual clients can become cumbersome. By enforcing client certificates, administrators can manage all clients collectively, simplifying the management process and protecting the system from potential security loopholes.
Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot
Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service Slot
- This policy enhances data security by ensuring that data transmitted between the client and the server is encrypted. Redirecting all HTTP traffic to HTTPS in Azure App Service Slot prevents interception of data, as HTTPS uses SSL/TLS protocols which encrypt the data.
- It helps to protect user privacy by ensuring their sensitive information such as login credentials, credit card numbers, or personal data is not transmitted in clear text, which could be accessed by anyone with network access. This is especially important for applications dealing with sensitive user data.
- Non-compliance to this policy can negatively impact the reputation of the app service and can lead to loss of user trust and potential legal implications. Users and search engines prefer HTTPS websites and it can directly affect search engine rankings and the number of visits to the site.
- Implementation of this policy using Infrastructure as Code (IaC) tool like Terraform, ensures consistency and automation of the security set-up across multiple app service slots. This reduces the likelihood of human error and increases the speed of security deployments in Azure.
Ensure the App service slot is using the latest version of TLS encryption
Ensure the App service slot is using the latest version of TLS encryption
- Ensuring the App service slot uses the latest version of TLS encryption helps protect data in transit from being intercepted, altered, or stolen by malicious actors, ensuring the confidentiality and integrity of communication.
- The rule is particularly crucial for entities
azurerm_app_service_slotin Azure Resource Manager to prevent the potential exploitation of any known vulnerabilities present in older TLS versions, thus reducing overall security risk. - With Infrastructure as Code (IaC) tools such as Terraform, automatic checks and enforcement of this policy can be done during the development process, helping to catch and fix security issues early, promote DevSecOps, and increase operational efficiency.
- Using the latest version of TLS encryption in App service slots enhances compliance with regulations and standards that require strong encryption practices, promoting trust with customers and stakeholders while potentially avoiding legal and financial penalties for non-compliance.
Ensure debugging is disabled for the App service slot
Ensure debugging is disabled for the App service slot
- This policy ensures that the debugging feature is turned off for App service slots, safeguarding business applications from potential exposure of sensitive or confidential data during debugging processes which could be exploited by unauthorized individuals.
- Leaving debugging enabled for the App service slot could also introduce performance issues, as debugging uses considerable system resources which could slow down the application’s overall speed and efficiency.
- Adhering to this policy significantly reduces the attack surface for threat actors, as debugging tools often provide deep system access and considerable control over the system being debugged.
- Failure to implement this policy could result in non-compliance with various cybersecurity standards and regulations, possibly leading to financial penalties and reputation damage for the organization.
Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs
Ensure default Auditing policy for a SQL Server is configured to capture and retain the activity logs
- The policy ensures that all database activities are tracked, providing a complete record of who accessed what part of the system and when. This is crucial for identifying and investigating unauthorized or suspicious activity, potentially preventing a security breach.
- By enabling the default Auditing policy, it helps the organization meet compliance regulations, as many laws and industry requirements mandate thorough action tracking. Noncompliance could result in heavy penalties or loss of certification.
- The activity logs captured by the auditing policy are important in forensic analysis during breach investigation or data recovery. These logs can provide crucial information about the circumstances of the event and the extent of its impact.
- As the policy is implemented using Infrastructure as Code (IoC) tool Terraform, it ensures consistent configuration across different SQL server instances, reducing any possible human errors and security vulnerabilities across the infrastructure.
Ensure that Synapse workspace has data_exfiltration_protection_enabled
Ensure that Synapse workspace has data_exfiltration_protection_enabled
- This policy ensures that Synapse Workspace, a powerful analytics service, in Azure has data exfiltration protection enabled. Data exfiltration prevention is critical to avoid unauthorized data transfer or retrieval from the system, keeping the sensitive information secure.
- Implementation of this policy mitigates the risk of data breaches and the subsequent financial, legal, and reputational damage. Unauthorized data extract can lead to compliance problems, severe fines, and loss of customer trust.
- The Terraform script check, ‘SynapseWorkspaceEnablesDataExfilProtection.py’, indicates that Infrastructure as Code (IaC) practices are employed for better manageability, consistency, and repeatability of infrastructure deployment while ensuring the necessary security control is in place.
- It is specifically applicable to ‘azurerm_synapse_workspace’ resource type, emphasizing a resource-specific security policy, thus preventing any strategy gaps that may occur due to blanket policies. It adds to the layered security approach, thus reducing the attack surface.
Ensure that databricks workspace is not public
Ensure that databricks workspace is not public
- The policy helps to prevent unauthorized access to your Databricks workspace by ensuring that it is not publicly accessible, thus protecting sensitive data and resources from potential security threats.
- This rule prevents the potential leakage of sensitive data or intellectual property that might be stored in the workspace, as making it public could potentially expose this information to untrusted entities.
- Adherence to this policy would help to comply with various data privacy regulations and industry standards that mandate the protection of sensitive data through proper access control mechanisms.
- Implementing this policy using Infrastructure as Code (IaC) tool like Terraform allows consistent enforcement of the security policy across the whole infrastructure, reducing the risk of human error and increasing the efficiency of security operations.
Ensure function app builtin logging is enabled
Ensure function app builtin logging is enabled
- Enabling function app built-in logging is critical for monitoring and troubleshooting applications. If logging isn’t enabled, administrators and developers may struggle to identify and solve problems that arise within the function app.
- With built-in logging enabled, all function app codes’ runtime and executions logs are recorded. This is essential for auditing and monitoring who or what is interacting with those resources, when, and how.
- Activating logging helps maintain the security and integrity of data within the azurerm_function_app and azurerm_function_app_slot entities. It helps identify any suspicious activity or breach attempts, thereby aiding in the prevention and management of security threats.
- Implementing this policy using Infrastructure as Code (IaC) tool like Terraform ensures all deployed function apps are configured to support logging. This removes the risk of human error and ensures consistency across all environments.
Ensure that HTTP (port 80) access is restricted from the internet
Ensure that HTTP (port 80) access is restricted from the internet
- Restricting HTTP access minimizes the risk of unencrypted data interception across the internet, protecting sensitive information from potential hackers or unauthorized users trying to exploit this vulnerability.
- Having unrestricted HTTP access can expose the system to various types of attacks like SQL injection, Cross-Site Scripting (XSS), and Denial-of-service (DoS) attacks, which can be detrimental to the system’s integrity and operations.
- The policy can help limit the service surface area exposed to the Internet, therefore reducing the chances of getting detected by automated scanning tools used by attackers, improving the overall infrastructure security.
- Ensuring access is restricted assists in compliance with various cybersecurity standards and regulations, such as GDPR and ISO 27001, fostering trust with customers and partners by demonstrating a commitment to data protection.
Ensures Spring Cloud API Portal is enabled on for HTTPS
Ensures Spring Cloud API Portal is enabled on for HTTPS
- This policy ensures that all data transmitted between the Spring Cloud API Portal and the client is encrypted while in transit, which mitigates the risk of sensitive information being intercepted and compromised on unsecured networks.
- Enabling HTTPS on Spring Cloud API Portal is essential for compliance with data privacy and security regulations. Non-compliance can result in penalties, fines, or loss of customer trust.
- By leveraging Infrastructure as Code (IaC) through a tool like Terraform, this policy can be automatically enforced across the entire infrastructure, reducing the potential for human error and enhancing consistency and efficiency.
- This policy specifically impacts azurerm_spring_cloud_api_portal resources, ensuring that these specific entities are securely configured and in line with the best practice of using HTTPS protocol for secure communication.
Ensures Spring Cloud API Portal Public Access Is Disabled
Ensures Spring Cloud API Portal Public Access Is Disabled
- Disabling public access to the Spring Cloud API portal significantly reduces the attack surface for potential cyber threats, ensuring that sensitive data and operations are not exposed to any unauthorized outside entities.
- This policy helps in enforcing the principle of least privilege. Only authorized, internal entities need to have access to the API portal, this reduces chances of misuse or incorrect handling of the portal.
- Ensuring that public access is disabled for Spring Cloud API portal enhances the organization’s compliance with data governance and privacy regulations, as exposure of API endpoints can lead to potential data leaks or unauthorized access.
- Implementing this policy using Infrastructure as Code (IaC) tool such as Terraform allows for the mitigation strategy to be automated, repeatable and scalable, ensuring consistent security across all instances of azurerm_spring_cloud_api_portal resource.
Enable vulnerability scanning for container images.
Enable vulnerability scanning for container images.
- Enabling vulnerability scanning for container images identifies and helps rectify security weaknesses in the container images used by azurerm_container_registry, thereby enhancing the overall security posture of the infrastructure.
- This policy shows proactive threat management strategy as potential vulnerabilities in the container images are detected and addressed before they can be exploited by malicious actors, hence reducing the risk of attacks and breaches.
- Good security hygiene is maintained when security problems are detected and fixed in the container build stage alongside development and operations, contributing to the practice of DevSecOps.
- Using Terraform and scripts such as ACRContainerScanEnabled.py to automate the vulnerability scanning process of container images increases efficiency and consistency, reducing the scope for human error.
Ensures that ACR uses signed/trusted images
Ensures that ACR uses signed/trusted images
- This policy ensures that the Azure Container Registry (ACR) utilizes only signed and trusted images, which protects systems from deploying unknown or potentially malicious containerized applications, increasing the overall security of the cloud environment.
- Enforcing the use of signed/trusted images in ACR reduces the risk of image tampering, enabling enterprises to establish clear chain-of-custody for their applications that could be important for compliance and regulatory audits.
- The referenced Infrastructure as Code (IaC) tool, Terraform, makes it easier and more efficient to manage and enforce this policy across multiple registries, providing consistency and scalability in the deployment and management of secure container images.
- By validating the ACR configurations against this policy using the provided python script, an organization can easily identify and address security misconfigurations, minimizing the risk of exploitation due to the use of unverified images.
Ensure geo-replicated container registries to match multi-region container deployments.
Ensure geo-replicated container registries to match multi-region container deployments.
- This policy ensures that container registries are geo-replicated according to the locations where binaries are executed. Matching the geo-replication of registries with the geographic locations of deployments minimizes latency and increases the speed of content delivery.
- By geo-replicating container registries, if a regional outage or disaster occurs, there is no disruption to the service as deployments can pull images from a different geographically replicated container registry. This supports high availability and resilience.
- The policy aids in compliance with regulations related to data residency and sovereignty. Certain rules might require data to reside in the same geographical location where applications are run, and having geo-replicated container registries ensures this requirement is met.
- By enforcing this policy, it aids in infrastructure cost optimization. If container registries were not replicated to match the multi-region deployments, one could end up with unnecessary data transfer costs when pulling images across regions, but with replicated registries, these costs are minimized.
Ensure container image quarantine, scan, and mark images verified
Ensure container image quarantine, scan, and mark images verified
- This policy is crucial to ensure the integrity of the container environment by quarantining and scanning images for potential vulnerabilities and malware before they are deployed, thereby contributing to the overall safety and security of the infrastructure.
- It assists in preventing the execution of potentially malicious code and halts the spread of malware within the containerized environment, reducing the opportunity of a security breach and limiting potential damage.
- Since the rule is implemented via Infrastructure as Code (IaC) using Terraform, it allows swift and automated enforcement of security controls across different stages of the DevOps lifecycle, ensuring consistent application of security policies.
- By marking images as verified after quarantine and scan, it provides a layer of trust and assurance on the scanned container images, thus ensuring that only verified and secure images are deployed into the production environment.
Ensure a retention policy is set to cleanup untagged manifests.
Ensure a retention policy is set to cleanup untagged manifests.
- Ensuring a retention policy for untagged manifests helps to maintain an efficient and clean working environment within the azure container registry by discarding unneeded or untagged images, thereby reducing clutter and potential vulnerabilities.
- This policy automates the housekeeping of the container registry, ensuring that unused resources do not consume necessary storage or bandwidth and saving overall costs.
- Effective cleanup of untagged manifests reduces the risk of accidental deployment of old or insecure versions of the images.
- By using Resource Implementation via Terraform in the given link, the organization can easily and quickly implement this policy across the infrastructure, benefiting from Terraform’s capabilities for infra-as-code, versioning, and repeatability.
Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods.
Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods.
- Ensuring a minimum of 50 pods per AKS node promotes high availability and ensures sufficient resources for replicating and distributing workload across the cluster without overloading or compromising the performance of individual nodes.
- Adhering to this policy can aid in automatically scaling the application to accommodate high traffic volume. With more available pods, an application can handle more user requests simultaneously, thereby ensuring smoother operation even under increased load.
- By adhering to this policy, you reduce the risk of pod eviction due to resource scarcity. When resources like CPU or memory become scarce on a node, Kubernetes may decide to evict pods, disrupting service operation. Having a minimum of 50 pods per node somewhat mitigates this risk.
- A policy of using a minimum of 50 pods is foundational in infrastructure cost management. Under-provisioning pods could mean underutilizing the nodes you are paying for while over-provisioning may result in paying for underutilized resources. Having a set minimum aids in cost-efficiency while still ensuring resource availability.
Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets
Ensure Azure Kubernetes Cluster (AKS) nodes use scale sets
- Ensuring that AKS nodes use scale sets increases the scalability of applications hosted on Azure Kubernetes by allowing dynamic modification of the node count based on the system load.
- Utilizing scale sets enhances the availability and reliability of applications, as it ensures the distribution of nodes across fault domains, upgrade domains, and availability zones, minimizing the impact of potential failures.
- The policy helps effectively manage resources, maintaining a balance between the computational power requirements and costs, as scale sets can adjust the number of nodes based on computational demand.
- Implementing this policy through Infrastructure as Code (IaC) using Terraform allows for automated checks and consistent application of the rule across all Azure Kubernetes clusters, improving security and compliance posture without manual intervention.
Ensure that AKS use the Paid Sku for its SLA
Ensure that AKS use the Paid Sku for its SLA
- This policy ensures that the Azure Kubernetes Service (AKS) complies with the service level agreement (SLA) that guarantees operational availability, which is crucial for the continuous and fault-tolerant running of your applications.
- Using a paid SKU helps to maintain a high performance, availability, and reliability of AKS resources, reducing the potential impacts of downtime and providing a predictable level of service.
- Non-compliance with this policy could lead to service disruptions due to limited or inadequate resources allocation in free SKU, jeopardizing critical business operations that rely on the AKS.
- The policy is implemented via the Infrastructure as Code (IaC) tool Terraform, providing automation and version tracking capabilities, which aid in policy enforceability, reproducibility, and achieving overall infrastructure security.
Ensure AKS cluster upgrade channel is chosen
Ensure AKS cluster upgrade channel is chosen
- Choosing AKS cluster upgrade channel ensures that the system remains updated with the latest security patches and stable feature enhancements automatically, reducing potential vulnerabilities and inadequacies due to outdated versions.
- By setting up an upgrade channel, the manual effort and downtime associated with applying upgrades and patches are greatly reduced, leading to improved operational efficiency.
- Dedicated upgrade channels can mitigate the risk of potential business disruptions caused due to unpredicted bugs or system issues introduced by new software versions by allowing validation and testing before rollout.
- The policy could also help entities comply with certain data security and privacy standards that demand businesses to keep their systems updated for ensuring maximum data protection against new types of cyber threats.
Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters
Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters
- Autorotation of Secrets Store CSI Driver secrets for AKS clusters helps improve the security posture of AKS clusters by preventing the prolonged use of a single secret, thus mitigating the risk of secret compromise. Secrets, such as credentials and keys, could pose security vulnerabilities if compromised.
- Implementing autorotation policy through Infrastructure as Code (IaC) with Terraform for the ‘azurerm_kubernetes_cluster’ resource ensures a standardized and automated approach to security, reducing human errors in managing secrets.
- If secrets are not rotated regularly, an individual who has gained illicit access could continue to have access indefinitely. This practice limits the window of opportunity for a malicious actor to exploit a compromised secret.
- Continuous autorotation of secrets is a best practice that aligns with compliance standards and regulations, such as PCI DSS and ISO 27001, reducing the risk of non-compliance penalties and reputational damage.
Ensure API management uses at least TLS 1.2
Ensure API management uses at least TLS 1.2
- This policy ensures that the API management system is utilizing a secure method of transmitting data, specifically TLS 1.2, minimizing the risk of data being intercepted during transmission.
- Enforcing the use of at least TLS 1.2 significantly reduces the API’s vulnerability to various common security threats such as ‘man-in-the-middle’ attacks, replay attacks, or eavesdropping by unauthorized individuals.
- If a lower version of TLS is used, it can lead to potential compliance issues with various security standards and regulations that prescribes the use of secure data transmission protocols, potentially leading to legal implications.
- Implementing this particular policy through Infrastructure as Code (IaC) tool like Terraform ensures consistency and repeatability, effectively minimizing human error usually associated with manual configurations.
Ensure API management public access is disabled
Ensure API management public access is disabled
- Disabling public access to API management ensures that unauthorized users cannot access or manipulate the APIs. This increases security by preventing potential data breaches and unauthorized operations.
- By keeping the API management private, only users with necessary permissions can access or modify the APIs, thereby maintaining the integrity of the system, data and processes.
- This policy strengthens the governance of data by controlling who can use, manage and access the APIs, thus reducing the risks associated with data misuse, loss or theft.
- Implementing this policy using Infrastructure as Code (IaC) using Terraform makes it easy to enforce, replicate across different environments, and integrate into CI/CD pipelines for continuous compliance.
Ensure Web PubSub uses a SKU with an SLA
Ensure Web PubSub uses a SKU with an SLA
- Ensuring Web PubSub uses a SKU with an SLA guarantees a certain level of service uptime and performance, reducing the risk of disruptions to services that could impact end-users or business operations.
- This policy contributes to compliance with standards and regulations that may require certain service level agreements, helping to mitigate legal and financial risks.
- It safeguards the business operations against the potential revenue loss and reputation damage that may arise due to prolonged unavailability or performance issues of the web services.
- The use of Infrastructure as Code (IaC) tool Terraform to enforce this policy ensures consistency and repeatability in the deployment process, reducing human errors and improving operational efficiency.
Ensure Web PubSub uses managed identities to access Azure resources
Ensure Web PubSub uses managed identities to access Azure resources
- Ensuring Web PubSub uses managed identities for Azure resources improves security by assigning a specific, role-based identity to each resource, reducing the risk of unauthorized access and enabling granular control over resource permissions.
- Using managed identities simplifies the process of managing credentials. It eliminates the necessity for developers to handle and store security keys, thereby reducing human error in this critical security process.
- By enabling this policy, it also helps in keeping audit logs and system monitoring consistent, as every operation on a resource can be traced back to a distinct managed identity, contributing to transparency and in-depth forensic capabilities.
- The use of managed identities, as dictated by this policy, facilitates secure interactions between Azure services and resources, ensuring that these communications are authenticated and authorized, and thus are less susceptible to attacks, leaks or breaches.
Ensure Windows VM enables automatic updates
Ensure Windows VM enables automatic updates
- Enabling automatic updates on Windows VM ensures that the system is always up-to-date with the latest security updates and patches, reducing the risk of potential security threats.
- Automatic updates can prevent the exploitation of known vulnerabilities in the system, as the patches fixing them are installed as soon as they are released, minimising the window of opportunity for attackers.
- Utilizing a Windows VM without automatic updates may result in non-compliance with security standards and regulations, potentially leading to legal and financial repercussions.
- Assuming automatic updates are not enabled, the operator (azurerm_windows_virtual_machine, azurerm_windows_virtual_machine_scale_set) would have to manually keep track of and apply updates, leading to significant administrative overhead and the risk of human error.
Ensure linux VM enables SSH with keys for secure communication
Ensure linux VM enables SSH with keys for secure communication
- The policy is crucial for ensuring secure communication between users and the Linux virtual machine, as it relies on SSH keys, which are generally more secure and harder to brute force than password-based authentication.
- Implementing this policy reduces the risk of unauthorized access because SSH keys use a private-public key pair, where the private key remains solely with the user and never transmitted over the network.
- This policy helps in achieving a consistent security posture by utilizing Infrastructure-as-Code practice, making it easier to track, audit and enforce key-based authentication on all Linux virtual machines in an automated manner.
- Failure to implement this rule on ‘azurerm_linux_virtual_machine’ and ‘azurerm_linux_virtual_machine_scale_set’ entities can leave the infrastructure vulnerable to potential cyber threats and attacks, thereby compromising the integrity, confidentiality, and availability of resources.
Ensure VM agent is installed
Ensure VM agent is installed
- Ensuring the VM agent is installed is crucial for managing, configuring, and automating tasks on Azure virtual machines. Without it, these tasks become more challenging and labor-intensive.
- Having a VM agent installed allows for seamless interaction with the Azure fabric controller, hence enhancing the overall operational productivity of the Azure environment.
- Implementing this policy ensures a consistent setup across all VM instances. For instance, the VM agent is necessary to run extensions which provide post-deployment configuration and automation.
- Non-compliance with this policy increases the potential for human error and exposes the infrastructure to potential security vulnerabilities, since the lack of automation and configuration management can lead to inconsistencies and oversights in the secure setup of virtual machines.
Ensure that data explorer uses Sku with an SLA
Ensure that data explorer uses Sku with an SLA
- Ensuring that Data Explorer uses Sku with an SLA ensures there are predetermined rules and standards for system reliability and uptime, providing a guarantee of system availability and performance for applications using the Azure Data Explorer service.
- This policy, when correctly enforced, aids in protecting businesses from substantial losses that could arise from system downtime or insufficient performance, as a Service Level Agreement (SLA) generally comes with provisions for compensation in the event of non-compliance.
- The rule helps in enhancing overall customer confidence and satisfaction as it assures that services will be available in accordance with the terms set out in the Service Level Agreement, thus bolstering the trust between the service provider and the users.
- As defined in the Terraform script, this policy ensures that Azure Data Explorer clusters (azurerm_kusto_cluster) are effectively managed and monitored, which in turn helps in identifying any agreement violations, thereby enabling corrective measures in a timely manner.
Ensure that data explorer/Kusto uses managed identities to access Azure resources securely.
Ensure that data explorer/Kusto uses managed identities to access Azure resources securely.
- Ensuring that Data Explorer/Kusto uses managed identities for accessing Azure resources contributes to the secure infrastructure by eliminating the need to store and manage credentials or keys that can be potentially compromised.
- Using managed identities for Data Explorer/Kusto access reduces the risk of unauthorized access or data breach, given the fact that the identities are automatically managed by Azure, making them more difficult to compromise.
- The policy helps meet the principle of least privilege by giving Data Explorer/Kusto only the necessary permissions to access Azure resources and nothing more, ensuring a low security risk.
- Adhering to this policy ensures that the Terraform-deployed Azure resources comply with best security practices and regulations, making the resources reliable and audit-ready.
Ensure that VNET has at least 2 connected DNS Endpoints
Ensure that VNET has at least 2 connected DNS Endpoints
- Ensuring at least two DNS Endpoints are connected to a VNET in Azure increases the availability and resilience of the DNS service. If one endpoint fails or experiences problems, the other can continue to resolve DNS queries, preventing downtime.
- Multiple DNS servers on a VNET increases the network’s fault tolerance towards DNS-specific attacks. If one DNS server is compromised, the other can still function and keep the network accessible.
- Using Infrastructure as Code (IaC) tool like Terraform for setting up two DNS endpoints facilitates automation, standardization, and version controlling in a DevOps environment. This can lead to more reliable and efficient infra set up.
- The policy applies specifically to the ‘azurerm_virtual_network’ and ‘azurerm_virtual_network_dns_servers’ resources, meaning it is explicitly designed for Azure’s unique architecture and resource types. Thus, it helps to achieve best practices while dealing with resource and DNS management in Azure environments.
Ensure that VNET uses local DNS addresses
Ensure that VNET uses local DNS addresses
- Ensuring that VNET uses local DNS addresses enhances security by reducing the risk of DNS leakage which potentially exposes internal network information to the outside world. This is crucial for sensitive applications or data hosted within the private network.
- Using a local DNS can provide faster DNS lookup times, improving application accessibility and responsiveness within the virtual network.
- Restricting DNS resolution to the local system ensures only authorized and authenticated traffic gets a valid DNS response, safeguarding against external threats and DNS-based attacks.
- This policy also enhances audit and compliance posture. By limiting DNS handling to local addresses and adhering to this policy, organizations can demonstrate trustworthy infrastructure management, meeting the requirements of data protection regulations.
Ensure 'local_auth_enabled' is set to 'False'
Ensure 'local_auth_enabled' is set to 'False'
- Disabling ‘local_auth_enabled’ helps to curb unauthorized local access to the ‘azurerm_app_configuration’ resource, thereby significantly reducing the risk of internal threats and promoting data security.
- The configuration aids in abiding by compliance regulations that require restriction of local authentication, adding credibility to the system’s security capability and trust among stakeholders.
- In cases where ‘local_auth_enabled’ is set to ‘True’, it becomes a potential risk factor for security breaches as it allows local users to bypass network security traps, making it crucial to have it set to ‘False’.
- The disabling of ‘local_auth_enabled’ forces users to undergo password and multi-factor authentication processes which adds a layer of security by confirming the authenticity of the user before granting access.
Ensure 'Public Access' is not Enabled for App configuration
Ensure 'Public Access' is not Enabled for App configuration
- Ensuring ‘Public Access’ is not enabled for App configuration helps protect sensitive information from unwanted exposure or unauthorized access as it restricts connectivity to the configuration only from within the private network.
- Disabling ‘Public Access’ minimizes the attack surface area for potential hackers by preventing a direct attack on the application configuration exposed on public networks.
- The policy helps organizations stay in compliance with several industry regulations and standards related to data privacy and security, which often require strict controls over access points visible to the public.
- Implementing this rule with Infrastructure as Code (IaC) using Terraform allows automated and consistent enforcement of this security standard across multiple Azure app configurations, thus ensuring uniform security posture.
Ensure App configuration encryption block is set.
Ensure App configuration encryption block is set.
- This policy ensures that the configuration data of an application stored in Azure App Configuration is secure, by maintaining that an encryption block is set. This block adds an additional layer of security by encrypting sensitive data and only authorizing access to entities that can decrypt it.
- Neglecting to implement this policy could expose sensitive configuration data to unauthorized users or potential threat actors. This could lead to data breaches and unauthorized access to important information, possibly compromising the application and associated system’s security.
- By following the policy of ensuring that an App configuration encryption block is set, it aids in compliance with regulatory standards and data protection laws which require businesses to take prudent measures to protect sensitive data, reducing the risk of legal penalties.
- Using Infrastructure as Code (IaC) approach with Terraform for implementation allows for automated and consistent deployment recommendations to protect against potential configuration errors, helping to ensure the reliability and reproducibility of infrastructure changes.
Ensure App configuration purge protection is enabled
Ensure App configuration purge protection is enabled
- Enabling App configuration purge protection ensures that important configuration data is not permanently lost due to accidental or intentional deletion, thus safeguarding the app’s functionality and stability.
- This feature provides an extra layer of security against potential cyber attacks that can lead to configuration data compromise and manipulation, therefore increasing the overall resilience of the application.
- With purge protection enabled, even if data is deleted, it is retained for a specific period allowing recovery. This functionality can prove critical in incident management and in minimizing the downtime of an application.
- Implementation with Infrastructure as Code (IaC) tool like Terraform, as mentioned in the provided resource link, provides automated and consistent application of this security policy across different environments, ensuring uniformity and reducing the risk of human errors.
Ensure App configuration Sku is standard
Ensure App configuration Sku is standard
- Ensuring the App configuration SKU is set to standard is crucial to guarantee optimal performance and resource availability. Standard SKU offers more quota limits and is crucial for apps that require high throughput.
- The standard SKU for Azurerm app configuration provides key features such as managed identity, private link service, virtual network service endpoints, and customer-controlled maintenance window, which are not available in the free tier, therefore enhancing the app’s security and control over its services.
- Compliance with this rule can save potential costs from a higher resource usage limit. Non-compliance may result in pay per use overage charges, which can increase overall project costs significantly.
- This policy also ensures that the applications are capable of handling large scale applications and can be integrated with other Azure services without any performance issues, thus improving the efficiency and resilience of the infrastructure.
Ensure that Azure Key Vault disables public network access
Ensure that Azure Key Vault disables public network access
- Ensuring Azure Key Vault disables public network access is crucial in preventing unauthorized access to sensitive data stored in the vault. If left open, malicious entities could potentially access secrets, keys, and certificates.
- The policy mitigates risks associated with data breaches and leaks that could happen due to uncontrolled access. It assists in maintaining the privacy and integrity of the data while adhering to standard security practices.
- With Azure Key Vault disabling public network access, organizations can ensure that their keys are only accessible by the internal Azure services, enhancing network access control and overall security posture.
- Enabled through Terraform, this policy promotes Infrastructure as Code (IaC) principles, allowing for configuration consistency, ease of automation, and auditable security practices across multiple stages of application development and deployment.
Ensure that Storage blobs restrict public access
Ensure that Storage blobs restrict public access
- Ensuring that Storage blobs restrict public access is crucial because it prevents unauthorized users from accessing, manipulating, or deleting stored data, which can compromise the confidentiality, integrity, and availability of the information.
- This policy aims to protect sensitive personal or corporate data that may be stored in Azure storage blobs. Without it, the data may be exposed to possible exploitation, leading to breaches or loss of trust from clients or customers.
- Implementation of this policy via the IaC tool Terraform allows for consistent and automated enforcement of security measures in all relevant Azure storage accounts, increasing efficiency and reducing human error.
- Vigorous implementation of this policy can help organizations adhere to data protection regulations and standards, avoiding legal repercussions and penalties associated with non-compliance.
Ensure that Managed identity provider is enabled for Azure Event Grid Topic
Ensure that Managed identity provider is enabled for Azure Event Grid Topic
- Enabling Managed Identity provider for Azure Event Grid Topic strengthens security by providing an Azure service identity in Azure AD. This service identity is used to access other resources as necessary, reducing the need for potentially insecure credentials management.
- Without this policy, users or applications may have to manually handle access credentials to Azure Event Grid Topics, introducing the risk of credentials exposure, unauthorized access, or mismanagement.
- Implementing this security policy simplifies management overhead, as Azure automatically manages the identity lifecycle, creating and deleting as necessary, relieving the entities from handling these tasks.
- As the implementation of this policy can be managed through Infrastructure as Code (IaC) service Terraform, consistent security configurations can be ensured across different development environments, reducing the risks of configuration errors.
Ensure that Azure Event Grid Topic local Authentication is disabled
Ensure that Azure Event Grid Topic local Authentication is disabled
- Disabling Azure Event Grid Topic local authentication prevents unauthorized entities from accessing and potentially manipulating event data. This is important as this data could include personal or sensitive business information that is not intended for public access.
- Keeping local authentication disabled in Azure Event Grid Topic reduces the risk of a data breach because an unauthorized entity has fewer ways to gain access to the sensitive data. This helps to maintain the integrity and confidentiality of the data.
- By ensuring Azure Event Grid Topic local Authentication is disabled, companies can ensure they comply with data protection regulations, such as the General Data Protection Regulation (GDPR) and California Consumer Privacy Act. Compliance with these laws can prevent fines, legal action, and loss of reputation.
- The policy also maintains infrastructural security as disabling local authentication makes it harder for a malicious entity to hijack the event grid to distribute malware or use it as part of a botnet. This restricts the vectors of attack on a system, making it more secure.
Ensure public network access is disabled for Azure Event Grid Topic
Ensure public network access is disabled for Azure Event Grid Topic
- This policy is important as it prevents unauthorized access to the Azure Event Grid Topic, thus safeguarding the data sent via these topics from potentially malicious external entities.
- Disabling public network access reduces the attack surface, as with public access enabled, the grid topics can be exposed to any user on the internet, not just those authorized in your security configuration.
- The policy helps to ensure compliance with data protection and privacy regulations, such as GDPR, that require companies to enact strong access controls around sensitive data.
- Applying this policy through Infrastructure as Code (IaC) using Terraform ensures a consistent setup across multiple environments, reducing human error and enhancing the overall security posture of these resources.
Ensure that Managed identity provider is enabled for Azure Event Grid Domain
Ensure that Managed identity provider is enabled for Azure Event Grid Domain
- Enabling Managed Identity Provider for Azure Event Grid Domain helps to secure the operations of Event Grid Domain by providing an identity for each application, preventing unauthorized access and protecting sensitive operations.
- The policy ensures that every operation performed within the Azure Event Grid Domain is associated with a managed identity, providing improved traceability and accountability by tracking who did what and when.
- Operating without a Managed identity provider could lead to a security risk as it opens up possibilities of unauthorized actions being performed within the Azure Event Grid Domain, which could lead to data theft, data corruption, or disruption of operations.
- Ensuring this policy is enforced consistently reduces the administrative overhead of managing individual permissions and keys, and promotes the use of least privilege access, further tightening the security around operations performed within the Azure Event Grid Domain.
Ensure that Azure Event Grid Domain local Authentication is disabled
Ensure that Azure Event Grid Domain local Authentication is disabled
- Disabling Azure Event Grid Domain local authentication is crucial in preventing unauthorized access. By requiring authentication from an external source, it reduces the possibility of anyone managing to bypass security measures and gain unauthorized access to the domain.
- Utilizing a centralized authority for authentication increases the overall security, as the authentication process isn’t scattered across multiple sources. This makes the system less vulnerable to attacks, and easier to manage and monitor.
- Keeping local authentication disabled ensures that an intruder who may have gained access to one part of the network cannot easily escalate permissions, limit their abilities to perform harmful actions, and prevent them from spreading in the system.
- The policy’s implementation ensures that security doesn’t rely on individual endpoints, and instead manages all the requests from a centralized system in the network. If this policy wasn’t in place, a single insecure endpoint could possibly expose the whole network to risk.
Ensure that SignalR uses a Paid Sku for its SLA
Ensure that SignalR uses a Paid Sku for its SLA
- Ensuring SignalR uses a paid SKU guarantees adherence to an SLA (Service Level Agreement), offering users a certain level of reliability, uptime and performance. This level of service may not be available with a free or lower cost SKU.
- The use of paid SKU in SignalR contributes to the infrastructure’s robustness and resilience, as paid SKUs generally offer more features such as backup options, autoscaling, and high availability, that can facilitate in maintaining the regular operation of the application services.
- By enforcing the use of paid SKUs in SignalR, it ensures that the infrastructure is compliant with specific security and business standards. Many organizations require strict compliance to such agreements, hence this policy helps in meeting those requirements.
- The policy will influence the cost management of the Azure infrastructure, as the use of paid SKUs in SignalR will increase the service costs. However, the boost in performance, availability and overall service quality tends to justify the higher cost.
Ensure the Azure CDN disables the HTTP endpoint
Ensure the Azure CDN disables the HTTP endpoint
- Disabling HTTP endpoints in Azure CDN is crucial for protecting sensitive data from interception as HTTP lacks encryption. By ensuring the use of HTTPS, data in transit becomes encrypted and secured against tampering, eavesdropping, or man-in-the-middle attacks.
- Since by default, Azure CDN allows HTTP traffic, explicit settings to disable HTTP endpoints through a proper infra security policy can ensure enhanced data privacy and security without the potential for administrator oversight.
- Using Terraform to enforce this policy ensures infrastructure as code (IaC) compliance. IaC allows for version control, collaboration, and automation in policy enforcement, which is critical for maintaining security controls at scale in a consistent, repeatable manner.
- This policy, by targeting the ‘azurerm_cdn_endpoint’ resource, ensures that each distributed edge node of the content delivery network has HTTP disabled. This means security is enforced at each data exchange point, providing a comprehensive protection for data in transit on Azure CDN.
Ensure the Azure CDN enables the HTTPS endpoint
Ensure the Azure CDN enables the HTTPS endpoint
- Enabling HTTPS on Azure CDN ensures secure data transfer over the network. This adds an additional layer of security to the data-in-transit, reducing the chance of sensitive data being intercepted or manipulated during the transfer process.
- Having HTTPS endpoints on Azure CDN also allows for secure delivery of web content. This protects the integrity of the data being communicated, making sure it remains intact and unaltered from sender to recipient.
- Non-compliance to this policy can expose an organization’s system to security risks such as data breaches, interception of data during transit, and unauthorized alteration of data, etc. which may eventually lead to legal, financial, or reputational repercussions.
- This policy is easily implemented using Infrastructure as Code (IaC), specifically Terraform, which allows for efficient management and enforcement of the policy across all Azure CDN endpoints within an organization. This automated approach reduces the chance of human error and ensures consistent application of secure settings.
Ensure that Azure Service Bus uses double encryption
Ensure that Azure Service Bus uses double encryption
- The policy of ensuring double encryption on Azure Service Bus is critical because it adds an additional layer of security. The data remains protected even if one layer gets breached, reducing the risk of data exposure substantially.
- This policy aids in compliance with many industry regulations and standards that mandate encryption of data at rest and in transit. It helps organizations meet compliance standards like GDPR, PCI DSS, and HIPAA by providing extra security for sensitive data transmitted via the Service Bus.
- Implementing double encryption on Azure Service Bus via Terraform ensures a consistent and automated application of security controls. It eliminates manual errors and improves the efficiency of the security setup.
- Not enforcing this policy could leave an organization vulnerable to attacks such as man-in-the-middle, where attackers could potentially intercept and decrypt the data. With double encryption, even if the outer layer encryption is broken, the attacker still has to break the inner encryption to access the sensitive data.
Ensure the Azure CDN endpoint is using the latest version of TLS encryption
Ensure the Azure CDN endpoint is using the latest version of TLS encryption
- Ensuring the Azure CDN endpoint is using the latest version of TLS encryption is critical for maintaining a secure transfer of data between the client and the server. The use of the latest TLS version protects against interception and unauthorized access of traffic between these two points.
- By adhering to this policy, organizations can mitigate the risk of being targeted by cyberattacks such as man-in-the-middle (MiTM) attacks, where attackers could potentially decrypt, read or modify the data being transmitted if an older, compromised version of TLS was used.
- This policy promotes adherence to industry best practices and compliance with various data security standards and regulations. Several mandates, like PCI-DSS and HIPAA, require the use of the most secure, up-to-date transport layer security.
- Non-compliance to this policy could lead to reputational damage and loss of customer trust in the event of a security breach due to use of outdated encryption protocols. Thus, maintaining the latest version of TLS for Azure CDN endpoints contributes to business continuity and brand trust.
Ensure that Azure Service Bus uses a customer-managed key to encrypt data
Ensure that Azure Service Bus uses a customer-managed key to encrypt data
- This policy enhances the security of Azure Service Bus data by enforcing the use of customer-managed keys (CMK) for encryption. This provides a layer of security wherein only the customer has access to the decryption keys.
- The policy gains additional control over key management, including key creation, rotation, and deletion. This ensures that key management lifecycle is solely in the hands of the organization, thus reducing unauthorized access to the data.
- Making use of this policy renders the data useless to any unauthorized entities, as without the customer-managed key, the data remains encrypted and unreadable.
- Non-compliance to this policy can lead to potential data breaches, wherein sensitive information on Azure Service Bus could be deciphered by unauthorized entities, causing substantial harm to the business or organization.
Ensure that Managed identity provider is enabled for Azure Service Bus
Ensure that Managed identity provider is enabled for Azure Service Bus
- Enabling Managed identity provider for Azure Service Bus enhances security by preventing unauthorized access. It allows the Azure services to interact with other Azure resources using identities, thereby eliminating the need for credentials within the code.
- It reduces the likelihood of human errors, such as hard-coding credentials in your app’s code, which can pose a considerable security risk if exposed or mishandled. Instead, identities are automatically managed by Azure.
- With the Managed identity provider enabled, access tokens are manageable, adding another layer of security. Azure takes care of refreshing the tokens, reducing the possibility of it being exploited or mishandled.
- Verifying the implementation of this policy via the Terraform script mentioned in the resource link ensures adherence to security best practices, and makes auditing easier. The associated Python code is utilized to check whether the Managed identity provider is indeed enabled for the Azure Service Bus.
Ensure Azure Service Bus Local Authentication is disabled
Ensure Azure Service Bus Local Authentication is disabled
- Disabling Azure Service Bus Local Authentication ensures that only Azure Active Directory (AAD) is used to authenticate the end users, which removes the risk of unauthorized access through locally stored credentials and enhances the overall security posture.
- Enforcing this policy reduces the vulnerability of a data breach as AAD provides multifactor authentication, conditional access, and detection of suspicious activities.
- Adhering to this policy also complies with many regulatory frameworks as it mandates the use of secure authentication mechanisms, safeguarding sensitive data from unauthorized access.
- Implementing this through Infrastructure as Code (IaC) using Terraform simplifies auditing and compliance checking, promoting consistent application of security policy across environments.
Ensure 'public network access enabled' is set to 'False' for Azure Service Bus
Ensure 'public network access enabled' is set to 'False' for Azure Service Bus
- Ensuring ‘public network access enabled’ is set to ‘False’ for Azure Service Bus enhances the security of your resources by preventing unauthorized access from the public internet, reducing the potential attack surface.
- This security policy can help to protect sensitive data in transit across the Service Bus from being intercepted, preventing data leaks or exposure that could lead to regulatory compliance issues.
- Implementing this policy through Infrastructure as Code (IaC) using Terraform allows for consistent, repeatable deployments across multiple environments, ensuring that all instances of Azure Service Bus are secure by default.
- Non-compliance to this policy could expose your Azure Service Bus to various forms of cyberattacks such as DDoS attacks, data breaches, or unauthorized data modifications. The ‘public network access enabled’ set to ‘False’ policy mitigates these risks.
Ensure Azure Service Bus is using the latest version of TLS encryption
Ensure Azure Service Bus is using the latest version of TLS encryption
- This policy is crucial as it ensures that the Azure Service Bus, which is responsible for connecting different services across and between applications, maintains a secure communication channel by utilizing the most up-to-date version of TLS encryption. It thus helps in protecting data from potential eavesdropping or tampering.
- Abiding by this policy enhances data integrity and confidentiality by mitigating vulnerability exploitation risks that older TLS versions might be more susceptible to, thereby protecting sensitive information from being accessed illegitimately.
- With the policy in effect, it also ensures compliance with industry security standards, such as the Payment Card Industry Data Security Standard (PCI DSS), which requires the use of secure versions of TLS for any organization processing credit card transactions.
- Implementing this policy effectively means fewer potential security gaps and weaknesses in the infrastructure, promoting a healthily robust, and reliable system. It therefore indirectly aids in boosting consumer trust, preserving business reputation, and reducing liability.
Ensure that Storage Accounts use replication
Ensure that Storage Accounts use replication
- This policy ensures data reliability and availability by creating copies of your data at multiple physical locations. If one location fails or experiences issues, your data remains accessible from other locations.
- In an event of regional failure, if the Storage Accounts use replication policy is not enabled, all data could be lost because the data does not exist anywhere else. The implementation of this policy dramatically reduces the risk of data loss.
- Investing in replication ensures that an application remains operational during these types of escalations. If a primary site becomes unavailable, applications can continue running from a redundant site with less downtime.
- Following the policy of using replication also enhances the disaster recovery capabilities. It ensures that the business would be up and running quickly after disruptive incidents such as natural disasters, power outages, or system failures. This not only protects the business continuity but also improves user trust and reputation.
Ensure Azure Cognitive Search service uses managed identities to access Azure resources
Ensure Azure Cognitive Search service uses managed identities to access Azure resources
- This policy ensures that Azure Cognitive Search service utilizes managed identities for authenticating with Azure services, eliminating the need for storing and managing credentials manually, thus reducing the chance of unauthorised access and potential security breaches.
- The policy facilitates least privilege access by granting specific Azure resources access to the Azure Cognitive Search service, thereby minimizing the exposure and potential abuse of privileged accounts.
- The policy enables auditable access control to Azure resources, making it possible to easily track and monitor all access requests and actions by the Azure Cognitive Search service, thereby enhancing transparency and accountability.
- The policy supports IaC practices via Terraform configuration, offering predictable, repeatable deployments while minimizing human error, thereby improving overall infrastructure security and reliability.
Ensure that Azure Cognitive Search maintains SLA for index updates
Ensure that Azure Cognitive Search maintains SLA for index updates
- Ensuring Azure Cognitive Search maintains SLA for index updates is vital as it guarantees that search index updates are made within the agreed timeframe, enhancing the overall performance and user experience of the hosted applications.
- Compliance with the policy can lower the risk of potential business interruption and revenue loss due to delay in updates operation if the SLA is not adhered to.
- Following this policy can provide clear expectations and accountability for Azure services, as breaches in update schedules can be quickly identified and resolved, minimizing the potential impact on business operations.
- Monitoring and meeting the SLA for index updates can assist in identifying performance issues and bottlenecks early, facilitating timely troubleshooting and maintaining the stability and reliability of the azurerm_search_service.
Ensure that Azure Cognitive Search maintains SLA for search index queries
Ensure that Azure Cognitive Search maintains SLA for search index queries
- This policy ensures the availability and reliability of search index queries in Azure Cognitive Search. A failure to maintain a Service Level Agreement (SLA) may lead to breakdowns in functionality and hinder user experience, affecting customer satisfaction and trust.
- Implementing this policy provides continuous monitoring of the Azure Cognitive Search service’s performance, which is crucial to detect potential issues early and mitigate risks. This protects data accuracy and integrity and supports the ongoing efficiency of business operations.
- By using Infrastructure as Code (IaC) tool like Terraform, this policy automates the deployment and maintenance of Azure Cognitive Search, reducing manual errors, and enhancing the security posture of the organization.
- This policy directly impacts ‘azurerm_search_service’ entities, ensuring they adhere to the stipulated SLA. It impacts the consistency and speed of search results, potentially affecting any applications or services that depend on Azure Cognitive Search.
Ensure Azure Cognitive Search service allowed IPS does not give public Access
Ensure Azure Cognitive Search service allowed IPS does not give public Access
- This policy is important to prevent unauthorized access to the Azure Cognitive Search service, as it restricts public access by only allowing specific IP addresses to connect, thereby enhancing the security of the infrastructure.
- It significantly reduces the risk of cyber attacks such as Distributed Denial of Service (DDoS) and data breaches as the inbound traffic is limited to trusted and known IP addresses.
- It helps to maintain the confidentiality, integrity, and availability of data in the Azure Cognitive Search service by reducing the exposure of the service to potential threats on the internet.
- Noncompliance with this policy could lead to inclusion of the Azure Cognitive Search service in scanning and exploitation by potential attackers, which could lead to loss of sensitive data or disruption of service.
Ensure App Service plan suitable for production use
Ensure App Service plan suitable for production use
- Ensuring an App Service plan suitable for production usage helps in maintaining a high availability of services by choosing production-grade service plans that support load-balancing and auto-scaling features.
- Production grade service plans often guarantee a certain SLA (Service Level Agreement) and provide redundancy and automatic failover capabilities to enhance reliability, which is crucial in a production environment.
- By utilizing non-production service plans, applications can be left exposed to risks like inadequate performance or unexpected downtime due to resource constraints, potentially disrupting business operations.
- This policy, if implemented correctly, can significantly reduce maintenance costs by ensuring that applications are hosted on properly scaled and priced service plans, avoiding over-provisioning or under-provisioning resources.
Ensure App Service has a minimum number of instances for failover
Ensure App Service has a minimum number of instances for failover
- This policy ensures that there is always a backup available in case of a failure in the App Service. Having a minimum number of instances increases the reliability and availability of the service, preventing complete downtime and maintaining business continuity.
- Applying this policy avoids the risk of a single point of failure. If one instance fails, other instances can continue to ensure service availability which is vital for keeping business operations stable and mitigating the impact of potential failures.
- Adherence to this policy improves the service’s capacity to handle high loads or traffic spikes. Having multiple instances running can distribute network load, allowing for more simultaneous connections and improving the user experience.
- The policy enhances the overall application resilience by ensuring the presence of failover instances. This increases system robustness and reduces the disruption associated with scheduled maintenance or unplanned incidents.
Ensure that App Service configures health check
Ensure that App Service configures health check
- Ensuring that App Service configures health checks enables the continuous monitoring of the applications, servers and resources, ensuring they are functioning correctly and optimally. Any anomalies that may hamper performance or cause downtime can be identified and rectified immediately.
- Without health check configuration, it is difficult to keep track of the operational state of applications. Health checks help provide insights into failures or performance bottlenecks which, in turn, allows for timely troubleshooting and maintaining application availability.
- This policy ensures that in the case of resource failure, health checks can provide the necessary alerts for immediate attention, reducing the potential negative impact on business operations.
- This policy applied through Infrastructure as Code (IaC) with Terraform, ensures the integration of security measures during the development stages itself for the entities like azurerm_app_service, azurerm_linux_web_app, azurerm_windows_web_app providing a smoother and safer deployment process.
Ensure App Service is set to be always on
Ensure App Service is set to be always on
- This policy guarantees continuous availability of applications to users by preventing the app service from idling out. This enhances user experience and is beneficial for applications that receive infrequent traffic but must remain responsive at all times.
- The ‘Always On’ setting ensures constant readiness of the Azure App Service, allowing it to process incoming requests with no delay, hence reducing potential service disruptions.
- Observing this policy can contribute to the timely performance of scheduled tasks or background operations that rely on the application’s consistent functioning.
- Non-compliant implementation could lead to increased startup latency and possible timeouts for services depending on the Azure App Service, negatively impacting the infrastructure’s overall efficiency and responsiveness.
Ensure API management backend uses https
Ensure API management backend uses https
- Ensuring API management backend uses https is crucial for data integrity and confidentiality; HTTPS offers encryption in transit, protecting sensitive information from potential interception by unauthorized parties.
- Non-compliance with this policy could lead to unauthorized access to data processed by the API, including potentially sensitive user information, thereby increasing system vulnerability.
- Implementing this policy allows for compliance with regulatory standards and best practices for data protection, which may be a requisite for operating in certain industries or regions.
- Using Terraform to enforce https usage in the API management backend automates the process and ensures consistency across the infrastructure, thus reducing the risk of human error.
Ensure DenyIntelMode is set to Deny for Azure Firewalls
Ensure DenyIntelMode is set to Deny for Azure Firewalls
- The policy ensures that Azure Firewalls are set to deny traffic from known malicious IP addresses and domains, thereby enhancing the security of resources protected by the firewall.
- It helps prevent potential security breaches or cyber attacks by automatically blocking identified threats, which helps in securing sensitive data and maintaining business operations.
- It enforces a proactive approach to security by scanning for threats in real time and denying them access before they attempt to exploit any vulnerabilities in the system.
- Compliance with this policy will help organizations meet their regulatory requirements and auditing standards relating to cybersecurity, and avoid penalties resulting from non-compliance.
Ensure Azure Application gateways listener that allow connection requests over HTTP
Ensure Azure Application gateways listener that allow connection requests over HTTP
- This policy ensures that all connection requests to Azure Application gateways listeners are allowed over HTTP. This is essential for guaranteeing secure data transmission between the user and the server, preventing attackers from intercepting and manipulating data in transit.
- Enforcement of this rule mitigates risks associated with unencrypted communication such as data breach due to packet sniffing, man-in-the-middle attacks, and issues related to data integrity. This is because HTTP is clear-text based, making data transmitted over it easily intercepted and readable.
- The policy is especially important in compliance with data protection standards such as the Payment Card Industry Data Security Standard (PCI-DSS) and General Data Protection Regulation (GDPR), which require encryption of sensitive data during transmission. Non-compliance might result in hefty fines and legal action.
- Implementation of this policy using Infrastructure as Code (IaC) with Terraform enhances automation, reproducibility, and version control, promoting the efficiency and accuracy of security rule deployment across the application gateway resources in Azure.
Ensure Application Gateway defines secure protocols for in transit communication
Ensure Application Gateway defines secure protocols for in transit communication
- This policy ensures that the application gateway, which is the communication link between different applications, uses secure protocols. This significantly reduces the risk of data getting compromised during transmission, thereby ensuring the privacy and integrity of the data.
- With the adoption of the policy, businesses can avoid potential data security breaches and network attacks that are potentially catastrophic, protecting both their financial health and reputation.
- Compliance with this policy ensures that the infrastructure aligns with industry standards and regulations for security and privacy, such as GDPR, HIPAA, and PCI-DSS, which demand secure protocols for transmission of sensitive information.
- The policy, implemented via Infrastructure as Code (IaC) using Terraform, allows for automating and standardizing security configurations, leading to a significant reduction in configuration errors and an increase in deployment speed and efficiency.
Ensure Firewall defines a firewall policy
Ensure Firewall defines a firewall policy
- This policy ensures that a firewall policy is well-defined in Azure Firewall. Defined policies are crucial as they ultimately decide the actions a system will take against unauthorized access, helping to protect against potential cybersecurity threats.
- Implementing this policy via Terraform aids in maintaining consistent and repeatable designs. This is paramount in rapidly deploying infrastructure, ensuring that every deployment adheres to the defined security protocols.
- Without a defined firewall policy, the azurerm_firewall could allow harmful network traffic to traverse through it unintentionally, thereby risking the security of the entity. The policy is therefore necessary to mitigate potential attacks and breaches.
- The policy impacts the entire security posture of the Azure resource. It streamlines the firewall rules and protocols and ensures a consistent auditing system for potential breaches, maintaining best practices of cybersecurity within the infrastructure.
Ensure Firewall policy has IDPS mode as deny
Ensure Firewall policy has IDPS mode as deny
- Ensuring Firewall policy has IDPS (Intrusion Detection and Prevention System) mode set as deny helps safeguard the infrastructure by actively blocking suspected intrusion attempts, instead of simply detecting and alerting.
- The usage of this rule can help prevent unauthorized access to sensitive data and protect against potential security threats, which is particularly beneficial when dealing with confidential or proprietary information.
- Implementing this policy using Infrastructure as Code (IaC) with Terraform allows for repeatable, consistent security configurations across multiple firewalls in Azure, reducing the risk of human error and enhancing security compliance.
- Not adhering to this policy can result in potential breaches or attacks on the infrastructure, leading to downtime, data loss, increased response costs, and reputational damage.
Ensure that Azure Function App public network access is disabled
Ensure that Azure Function App public network access is disabled
- The policy helps protect the Azure Function App from potential security threats by blocking public network access, thereby limiting exposure to attacks like DDoS, man-in-the-middle and intrusion attempts.
- Turning off public network access helps ensure that sensitive information and processes contained in the Azure Function App remain confidential and are not inadvertently exposed to unauthorized users, thus increasing data privacy and integrity.
- The policy ensures regulatory compliance in scenarios where data privacy laws or industry regulations require certain data to be isolated from public access, avoiding legal and financial penalties.
- This policy helps in compartmentalizing the network by creating a clear boundary between internal and external network access, which simplifies network management and aids in traffic monitoring.
Ensure that Azure Web App public network access is disabled
Ensure that Azure Web App public network access is disabled
- This policy ensures that Azure Web Apps are not directly accessible over the public network, significantly reducing the risk of unauthorized access, data breaches, and cyber attacks targeted at exploiting common web vulnerabilities.
- Disabling public network access promotes compliance to data privacy regulations and security standards by minimizing exposure of sensitive data that might be transported, processed, or stored in the web apps in question.
- By employing Infrastructure as Code (IaC) setting via Terraform, the enforcement of this policy can be automated, thus reducing the chance of human error and maintaining consistency across all instances of azurerm_linux_web_app and azurerm_windows_web_app.
- The policy leads to enforcement of good practices in network architecture by prompting entities to establish appropriate protective measures like VPNs or private endpoints, thus maintaining the principle of least privilege, where resources are only available to systems and users that absolutely need access.
Ensure Event Hub Namespace uses at least TLS 1.2
Ensure Event Hub Namespace uses at least TLS 1.2
- The policy ensures that all data transmission between the Event Hub Namespace and the clients are encrypted with TLS 1.2, which is currently the most secure version of the protocol.
- It offers protection from interceptions and attacks such as man-in-the-middle, thereby maintaining the confidentiality and integrity of the data being transmitted.
- Compliance with this policy is crucial to meet industry-standard security certifications such as PCI-DSS, HIPAA, and GDPR, which mandate the use of TLS 1.2 or higher for data transmission.
- A failure to follow this policy can potentially expose sensitive information in transit, making an organization vulnerable to data theft, which could lead to business, reputational, and legal impacts.
Ensure that the Ledger feature is enabled on database that requires cryptographic proof and nonrepudiation of data integrity
Ensure that the Ledger feature is enabled on database that requires cryptographic proof and nonrepudiation of data integrity
- The Ledger feature on a database enables an immutable and verifiable log of all transactions, which is crucial for maintaining data integrity and providing cryptographic proof of transactions, making it extremely important for databases that require these features.
- By ensuring the Ledger feature is enabled, the policy helps to create an unchangeable record of all data changes, which can be critical in the event of a security breach or for forensic investigation, thereby enhancing the overall security of data in the azurerm_mssql_database resource.
- The policy can help organizations meet regulatory compliance requirements related to data integrity and nonrepudiation, such as GDPR, HIPAA, and SOX, which mandate accurate tracking and history of data modifications.
- Through Infrastructure as Code (IaC) using Terraform, the policy ensures the automated and consistent deployment of the Ledger feature across databases, aiding in the prevention of human errors that could compromise the system’s security.
Ensure the App Service Plan is zone redundant
Ensure the App Service Plan is zone redundant
- Ensuring the App Service Plan is zone redundant reduces the risk of application failure as it prevents single point of failure, enhancing reliability and availability of the application.
- Zone redundancy allows applications to continue running even if one Azure availability zone goes down. This is critical for maintaining service continuity in geographically distributed cloud environments.
- Implementing this policy through Infrastructure as Code (IaC) using Terraform, as indicated in the provided resource link, promotes efficient and scalable infrastructure management, ensuring all requirements are consistent and repeatable.
- If azurerm_service_plan does not follow this policy, it could potentially lead to disruption of the service and loss of data, which could in turn negatively affect business operations and customer trust.
Ensure ephemeral disks are used for OS disks
Ensure ephemeral disks are used for OS disks
- This policy emphasizes using ephemeral disks for OS disks, which can provide faster boot and reset times. This significantly reduces the downtime in the case of virtual machine restarts, leading to increased efficiency and productivity.
- Ephemeral disks are directly attached to the virtual machine, effectively reducing possible latency and risk of unavailability, enhancing the performance and availability of ‘azurerm_kubernetes_cluster’.
- The enforcement of this policy ensures that no persistent data is stored on the OS disk, thereby reducing the risk of sensitive information being compromised in the case of a security breach or inadvertent exposure.
- This security policy supports Infrastructure as Code (IaC), specifically Terraform, allowing efficient DevOps practices, automating and codifying configurations which can be audited and version-controlled, enhancing overall information security compliance and governance.
Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources
Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources
- This policy ensures that sensitive data at rest remains secure by requiring encryption of temporary disks, caches, and data flows between compute and storage resources in AKS clusters. This prevents unauthorized access and potential exfiltration of your data.
- By enforcing encryption, this policy significantly reduces the risk of data breaches, providing assurance to clients and stakeholders about the security measures in place for data protection.
- The policy also ensures compliance with industry best practices and regulatory standards like GDPR which require data to be encrypted, thereby preventing the organization from potential legal complications and non-compliance penalties.
- Implementing this policy using Infrastructure as Code tool like Terraform allows for automated enforcement and reduces the likelihood of human error, enhancing the overall security posture of Azure Resources – in this case, ‘azurerm_kubernetes_cluster’ and ‘azurerm_kubernetes_cluster_node_pool’.
Ensure the Azure Event Hub Namespace is zone redundant
Ensure the Azure Event Hub Namespace is zone redundant
- Ensuring Azure Event Hub Namespace is zone redundant increases reliability and availability by replicating data across multiple zones. This acts as a safeguard against zone-level failures impacting the data.
- Zone redundancy significantly improves disaster recovery scenarios by maintaining service continuity even if one zone is impacted. This prevents any disruption to the system’s regular functioning.
- This policy indirectly contributes to customer trust, as data integrity and reliability are key factors for maintaining user confidence in the system. Having a zone redundancy in place leads to increased robustness of the data handling system.
- Without zone redundancy, an outage in a single zone could lead to a complete system failure. Zone redundancy mitigates the chances of a single point of failure, which is critical for systems handling sensitive or crucial data.
Ensure the Azure SQL Database Namespace is zone redundant
Ensure the Azure SQL Database Namespace is zone redundant
- Ensuring the Azure SQL Database Namespace is zone redundant enhances the database availability and avoids downtime. If one Azure region fails due to unexpected disasters, the SQL Database service will continue running from a different zone.
- Implementing zone redundant configuration in Azure SQL Database will provide automatic and seamless failover during planned or unplanned maintenance without data loss, ensuring business continuity.
- Enabling zone redundancy for Azure SQL database increases data durability. In the event of Zone failure, it ensures all committed transactions are durable and facilitate the recovery process.
- By making an Azure SQL Database Namespace zone redundant using Terraform, infrastructure code can be crafted to uniformly and automatically apply this requirement across many databases within multiple Azure environments, ensuring consistent application of this important resilience feature.
Standard Replication should be enabled
Standard Replication should be enabled
- Implementing the Standard Replication for azurerm_redis_cache in Terraform enhances data durability by creating copies of data across different locations. This not only ensures data security but also improves the availability of the data.
- The policy of enabling standard replication helps to protect against data loss during system failures or disasters. With multiple replications in place, productivity and business continuity can be maintained despite these unexpected occurrences.
- The Terraform script, RedisCacheStandardReplicationEnabled.py, illustrates the mechanism to enable standard replication in Azure. This can serve as a valuable reference for developers or enterprises seeking a secure infrastructure.
- Without standard replication enabled, data redundancy is compromised which can result in potential data loss, making it a critical security policy for any organization dealing with sensitive or important data.
Ensure App Service Environment is zone redundant
Ensure App Service Environment is zone redundant
- Ensuring App Service Environment is zone redundant increases application uptime and availability, as it enables automatic failover during outages, thereby maintaining uninterrupted services and minimizing downtime.
- This policy improves resilience as it allows an Azure service to continue operating even if one or more of its data centers within the same region become unavailable due to failures, natural disasters, or system maintenance.
- Using Zone redundant configurations with terraform helps in disaster recovery. In case of failure in one location (availability zone), the application can continue its operation in another availability zone, thus enhancing the reliability.
- Implementation of this policy helps in effective load balancing across zones, ensuring resources are distributed evenly, thereby optimizing usage and cost efficiency.
Ensure that only critical system pods run on system nodes
Ensure that only critical system pods run on system nodes
- This policy ensures resource efficiency by limiting the load on system nodes solely to critical system pods, preventing non-critical processes from consuming valuable system resources like CPU and memory.
- It enhances system resilience and availability because if a non-critical pod fails or causes an issue on the node, it won’t impact the critical system pods running on that system node.
- It improves security by reducing the attack surface — if non-critical pods are compromised, drastically decreasing the chance that a potential attacker could harm critical system functionality.
- Through strict adherence to this policy, it improves system manageability with a more organized node deployment strategy, where roles and responsibilities of each node are clearly defined.
Ensure Azure Container Registry (ACR) is zone redundant
Ensure Azure Container Registry (ACR) is zone redundant
- Ensuring Azure Container Registry (ACR) is zone redundant improves the resilience and continuity of the digital services offered by the organization, as having a zone redundancy means that the ACR service will still be accessible when one Azure region experiences outages.
- With zone redundancy enabled, the container images are replicated across multiple data centers within an Azure region. This allows for high availability, thus reducing the risk of data loss and service downtime.
- The policy ensures that the infrastructure is highly available and resilient to AZ failures. This is because when services are spread across different data zones, resources in one failed zone can be migrated to a different zone.
- Enforcing this policy means that the organization can also reduce the latency of the services that depend on Azure Container Registry. Zone redundancy ensures operations of ACR are fast as the traffic to and from the ACR service will likely be routed to the nearest available zone.
Ensure that Azure Defender for cloud is set to On for Resource Manager
Ensure that Azure Defender for cloud is set to On for Resource Manager
- Ensuring that Azure Defender for Cloud is set to ‘On’ for Resource Manager provides live threat protection and alerts for the resources managed in Azure. This actively contributes to an enhanced security posture by enabling detection and quick responses against potential security threats.
- This policy assists in meeting compliance requirements for data security. Regulatory bodies often require proactive threat detection and mitigation processes in place, failing which can lead to penalties or reputation damage.
- The Azure Defender provides actionable security recommendations and prioritized workload-specific security alerts. This helps organizations to mitigate security risks timely before they can exploit the system vulnerabilities.
- This policy could potentially help in reducing costs long term. By detecting threats early and taking quick action, it helps to prevent possible financial losses stemming from data breaches or system downtime.
Ensure that Azure container environment variables are configured with secure values only
Ensure that Azure container environment variables are configured with secure values only
- This policy helps prevent potential security breaches by ensuring that sensitive information such as passwords or tokens, required by Azure containers, are not exposed through environment variables. Protected environment variables are less likely to be accessed or intercepted by unauthorized parties.
- It ensures compliance with industry and data protection standards by enforcing secure configurations. This could be a central requirement in achieving certifications like SOC 2, PCI DSS, or HIPAA which can boost the credibility and trustworthiness of an organization.
- This policy can mitigate risks related to misconfiguration, one of the most common reasons for cloud-based vulnerabilities. Implementing this policy means it’s less likely for inadvertent errors to lead to significant security incidents.
- By ensuring only secure values are used for Azure container environment variables, the policy helps maintain the integrity of the application environment itself. It prevents unauthorised changes or inconsistencies which could lead to software bugs, application failures, or even service downtime.
Ensure storage for critical data are encrypted with Customer Managed Key
Ensure storage for critical data are encrypted with Customer Managed Key
- This policy helps protect sensitive information by requiring that any critical data stored in the system be encrypted using a customer-managed key, enhancing data security by ensuring only authorized individuals can access and decode the encryption.
- It provides owners with greater control and accountability over their data while utilizing the ‘azurerm_storage_account’ infrastructure, enabling them to secure their data according to their organizational requirements and policies.
- The policy helps in compliance with data protection regulations and guidelines, which mandate encryption of sensitive data. Non-compliance could lead to legal consequences and reputational damage.
- The use of Infrastructure-as-Code (IaC) Terraform to implement this policy ensures a standardized and automated approach to integrating security measures into infrastructure deployment, improving efficiency, reducing room for human error, and making the process more repeatable and scalable.
Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account
Ensure that Vulnerability Assessment (VA) is enabled on a SQL server by setting a Storage Account
- Enabling Vulnerability Assessment (VA) on a SQL server enhances the security of the system by identifying and flagging any potential security issues or threats that may compromise the security measures.
- By linking the SQL server to a storage account, security logs from the VA can be securely stored and accessed for in-depth analysis, thus ensuring that all data relating to potential vulnerabilities are saved and can be audited effectively.
- Using Terraform’s Infrastructure as Code (IaC), the process of enabling VA in the storage account can be automated and customized according to the security requirements, thereby increasing efficiency and precision of the implementation.
- The policy impacts entities such as azurerm_mssql_server_security_alert_policy and azurerm_sql_server by enforcing a consistent security measure across these resources, increasing the overall security of the systems in which they operate.
Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server
Ensure that VA setting Periodic Recurring Scans is enabled on a SQL server
- Enabling Periodic Recurring Scans on a SQL server increases security by identifying vulnerabilities in the database through regular checks, helping mitigate potential threats ahead of time.
- This policy protects the integrity of the company’s data, as an unprotected SQL server can be exploited by hackers to gain access to sensitive information or install malicious software.
- It enables IT and security teams to promptly fix any discovered vulnerabilities and reduce periods of exposure, thus significantly reducing the cost and impact of security breaches.
- By using Terraform, an Infrastructure as Code (IaC) tool, to implement this policy, it ensures repeatability and consistency in the security configuration across multiple SQL servers.
Ensure Azure SQL server ADS VA Send scan reports to is configured
Ensure Azure SQL server ADS VA Send scan reports to is configured
- Ensuring Azure SQL Server Advanced Data Security (ADS) is configured to send Vulnerability Assessment (VA) scan reports promotes transparency of server condition by providing visibility into potential security vulnerabilities, thereby allowing timely patching and security improvements.
- The policy’s implementation via Infrastructure as Code (IaC) tool - Terraform, allows for automated and consistent deployment across multiple servers or environments, which reduces the risk of configuration errors or oversight that could leave systems vulnerable.
- With this policy, it eases the challenge of compliance with various cybersecurity regulations and standards which require evidence of regular vulnerability assessments and proactive steps towards security enhancement.
- Non-compliance with this policy could result in unidentified security risks or threats, which could lead to data breaches or loss, damaging an organization’s credibility and incurring potential legal and financial ramifications.
Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server
Ensure that VA setting 'Also send email notifications to admins and subscription owners' is set for a SQL server
- This policy ensures that administrative personnel and subscription owners are directly informed about any potential vulnerabilities or alerts related to the SQL server. By knowing about these issues immediately, those responsible can act faster to address the problem.
- By setting this VA (Vulnerability Assessment) value, SQL administrators are maximizing communication and transparency regarding security events. It reduces the risk of serious security incidents by ensuring everyone involved is aware of the situation.
- It helps organizations to comply with data protection standards and regulations, particularly those that require the involvement of administrators and subscription owners in incident reporting. Failure to comply with such regulations could lead to penalties or reputational damage.
- Terraform’s Infrastructure as Code (IaC) approach means that this policy, once applied, ensures consistency across all SQL servers. This process reduces human error and streamlines security management by automatically notifying the right people about any vulnerability assessments or alerts.
Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled
- This policy minimizes the risk of unauthorized access to the PostgreSQL Database Server from other Azure services, thus strengthening the security posture by limiting the exposure of the database to only trusted sources.
- By implementing this policy in your Terraform configuration, compliance with security best practices and regulatory standards is ensured, which might be required in certain industries dealing with sensitive data.
- If the ‘Allow access to Azure services’ setting is enabled, it potentially grants access to any Azure service. This could mean any authenticated user within Azure can gain access to the database, increasing the likelihood of data breaches.
- A violation of this rule could lead to potential security threats like SQL injection attacks, or data alterations by unauthorized users. Disabling access from Azure services helps to mitigate these risks by adding another layer of defense.
Ensure that Azure Active Directory Admin is configured
Ensure that Azure Active Directory Admin is configured
- Ensuring that Azure Active Directory Admin is configured helps manage and control access to Azure SQL database services, ensuring only authorized entities have the ability to access, manage, or modify the azurerm_sql_server resources.
- This policy can provide an important layer of security by defining who can perform administrative tasks on the Azure Active Directory, thereby reducing the risk of unauthorized or unintentional changes leading to potential vulnerabilities or data breaches.
- A properly configured Azure Active Directory Admin offers auditing and reporting capabilities, providing visibility into sign-in activities, changes made, and other actions executed by admins, increasing traceability and accountability.
- By setting up Azure Active Directory Admin, organizations can leverage features such as multi-factor authentication (MFA) and conditional access policies, further enhancing the security of the SQL servers and protecting sensitive data from unauthorized access or theft.
Ensure the storage container storing the activity logs is not publicly accessible
Ensure the storage container storing the activity logs is not publicly accessible
- Ensuring the storage container storing the activity logs is not publicly accessible helps to protect sensitive data. Log information can contain details about the system operations, transactions, and user activities, thus revealing internal infrastructure details, flaws and vulnerabilities to potential attackers.
- Implementing this policy can help in maintaining compliance with data protection regulations. Security standards like GDPR, HIPAA, and PCI DSS require organizations to implement necessary safeguards to protect sensitive information, which includes access control measures like this policy.
- A breach of this policy could potentially expose a historical record of all actions performed within the Azure resources mentioned. This can provide a roadmap for attackers to identify and exploit weaknesses in the system or manipulate the information within.
- It can prevent unauthorized alteration or deletion of activity logs. If these logs are publicly accessible, it may invite malevolent users to manipulate or erase evidence of malicious activity, making it difficult for the organization to track security incidents or achieve accountability.
Ensure Virtual Machines are utilizing Managed Disks
Ensure Virtual Machines are utilizing Managed Disks
- Ensuring Virtual Machines utilize Managed Disks is crucial for maintaining data durability and high availability since managed disks handle storage replication automatically.
- Use of Managed Disks reduces the management overhead for administrators as they do not have to orchestrate storage account limits.
- Managed Disks are inherently secure and provide native support for Azure Disk Encryption, ensuring that your data is protected at rest.
- Compliance with this policy also allows for easier scalability of applications since managed disks can be easily increased in size without any downtime.
Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines
Ensure that Microsoft Antimalware is configured to automatically updates for Virtual Machines
- Ensuring that Microsoft Antimalware is configured to automatically update for Virtual Machines enhances security by providing the latest features and vulnerability patches promptly, thus minimizing the window of opportunity for attackers to exploit the system.
- Automatic updates remove the need for manual intervention, reducing the risk of human error or oversight that could leave the system vulnerable if updates are not installed promptly.
- With the infrastructure currently using Terraform, this policy ensures that the Azure Virtual Machine resources and extensions are consistently provisioned with the latest virus definitions and Antimalware engine, contributing to more consistent and reliable security measures.
- The policy supports best practices for managing antimalware in a cloud environment, as per the Microsoft Azure Security Benchmark, thus potentially aiding in compliance with various industry and regulatory standards.
Ensure that Azure Data Explorer encryption at rest uses a customer-managed key
Ensure that Azure Data Explorer encryption at rest uses a customer-managed key
- This policy ensures that the data stored in Azure Data Explorer is encrypted at rest using a customer-managed key, thereby strengthening data security by giving full control over the key management to the customer.
- It reduces the risk of unauthorized data access as the encryption key is handled by the customer and not by Microsoft Azure, so an accidental or intentional data breach from the service provider’s end can be ruled out.
- The use of a customer-managed key for data encryption facilitates better security audits, as the owner can track key usage and monitor all the activities related to the encryption key.
- Non-compliance with this policy could lead to potential sensitive data exposure, violations of industry regulations or standards like GDPR or HIPAA, which could result in reputational damage and heavy financial penalties.
Ensure that virtual machines are backed up using Azure Backup
Ensure that virtual machines are backed up using Azure Backup
- Ensuring that virtual machines are backed up using Azure Backup is important because it guarantees data security. In the case of accidental deletions, modifications, or system failures, data can easily be restored, minimizing downtime and potential losses.
- This policy can help to maintain software and data consistency across different environments. By employing Azure Backup, there is a unified system in place that ensures every VM is following the same backup routine and storing in the same manner, simplifying operations and reducing the risk of miscommunication or error.
- Implementing this policy with Azure Backup ensures compliance with certain regulatory standards that require data to be retrievable and secured. This can assist businesses in avoiding penalties associated with non-compliance.
- Enforcing this policy will lead to cost-saving in the long run. If a catastrophe or loss of data occurs, the financial impact of recovery would be substantial compared to the cost of adopting Azure backup and implementing the policy.
Ensure that sql servers enables data security policy
Ensure that sql servers enables data security policy
- Enabling data security policy on SQL servers helps protect valuable business data from potential security breaches or data theft. This aligns with best practices for securing databases and preserving business integrity.
- Having a security alert policy in place allows for the timely detection of malicious activities, anomaly behavior or configuration changes that could compromise the security of the SQL servers.
- From a regulatory compliance perspective, many data protection laws require companies to have measures in place to protect the integrity and confidentiality of the data they handle. This policy aids in meeting such requirements.
- The policy can be easily implemented and enforced with Infrastructure as Code (IaC) tool such as Terraform, simplifying security management across multiple servers and reducing potential human error in manual configuration.
Ensure that Unattached disks are encrypted
Ensure that Unattached disks are encrypted
- Encrypting unattached disks helps ensure that the sensitive data stored on these disks remains confidential, even if the disks are moved, copied, or disposed of incorrectly. This can prevent unauthorized access to this data.
- Implementing this policy via Terraform allows infrastructure to be defined as code, which can help automate the application of the policy across all suitable Azure resources, leading to more efficient and consistent enforcement.
- Following this policy helps organizations comply with data protection regulations that require encryption of data at rest, such as GDPR or HIPAA, potentially avoiding hefty fines for non-compliance.
- Applying encryption to azurerm_managed_disk and azurerm_virtual_machine entities can safeguard system and application data stored on these resources against potential vulnerabilities or security breaches that could lead to data exposure or loss.
Ensure that Azure data factories are encrypted with a customer-managed key
Ensure that Azure data factories are encrypted with a customer-managed key
- This policy provides an extra layer of protection for Azure data factories by enabling customer-managed keys for encryption rather than relying solely on Azure’s platform-managed keys. It increases security by reducing the risk of unauthorized data access.
- Utilizing customer-managed keys provides control over key management activities, including when and how to retire and rotate these keys. This level of control ensures best practices for key management are being followed and maximizes security for sensitive data.
- It mitigates the risk of a data breach. If Azure’s managed keys are compromised, then all data factories using those keys are vulnerable. However, with customer-managed keys, even if Azure’s keys are compromised, the encrypted data in a customer’s data factories remains secure.
- Implementing this policy helps organizations meet regulatory and compliance requirements. Certain regulations and standards require organizations to manage their own encryption keys for protecting sensitive data. This policy supports compliance with those regulations.
Ensure that MySQL server enables customer-managed key for encryption
Ensure that MySQL server enables customer-managed key for encryption
- Ensuring that MySQL server enables customer-managed key for encryption provides the administrative control over the data security by allowing them to manage their own encryption keys. This reduces dependence on the service provider’s encryption and enhances database security.
- This policy ensures that data is protected in transit and at rest while also complying with regulatory and industry standards for data security. This is particularly important for enterprises that handle sensitive data.
- Enforcing this policy can mitigate risks associated with potential data breaches. If the encryption key is compromised, data cannot be deciphered without the corresponding customer-managed decryption key.
- Deploying this policy via Infrastructure as Code (IaC) tool like Terraform, allows for consistent, repeatable and automated security configurations across multiple MySQL servers reducing the chances of human error.
Ensure that PostgreSQL server enables customer-managed key for encryption
Ensure that PostgreSQL server enables customer-managed key for encryption
- Enabling customer-managed key for encryption in the PostgreSQL server enhances data security by allowing the customer to control the encryption and decryption keys, keeping sensitive data concealed even from the service provider.
- This policy reduces the risk of unauthorized access and data breaches by providing an extra layer of security. Even if intruders manage to breach the server, they would not be able to decipher the encrypted data without the unique key.
- This policy helps to meet compliance requirements for data protection and privacy regulations, including GDPR or HIPAA, due to its provision for additional data security measures.
- Implementing this policy using Infrastructure as Code (IaC) tool Terraform allows for consistent replication of secure configurations across multiple PostgreSQL servers and provides ease in tracking and auditing these configurations which aids in ensuring continuous compliance.
Ensure that Azure Synapse workspaces have no IP firewall rules attached
Ensure that Azure Synapse workspaces have no IP firewall rules attached
- The policy ensures that no restrictions are placed on the IP addresses that can access Azure Synapse Workspaces, allowing unrestricted access from any location or network. This increases the flexibility of access which can be vital for globally distributed teams.
- The implementation of this policy can pose security risks as it opens the potential for unauthorized access, potentially leading to data breaches, data loss and other security incidents related to Azure Synapse services.
- Without IP firewall rules, security monitoring can be more challenging as there would not be a definitive perimeter for investigations, possibly leading to more resource-intensive monitoring processes to ensure the safety of data within the Azure Synapse environment.
- Compliance to specific data protection standards might require the attachment of IP firewall rules to Azure Synapse workspaces which could conflict with this policy, thus, compliance initiatives have to take this into account to avoid non-compliant configurations.
Ensure Storage logging is enabled for Table service for read requests
Ensure Storage logging is enabled for Table service for read requests
- Enabling Storage logging for Table service for read requests provides a detailed audit trail of all read operations happening in your storage environment. This detailed log can help you trace any unauthorized access or suspicious read patterns for diagnostics or security purposes.
- The policy helps ensure regulatory compliance as many industry standards and regulations, such as GDPR and HIPAA, require stringent data access and activity logging. Therefore, enabling Table service logging for read requests helps you meet these regulations.
- With this policy, any read requests on the Table service can be analyzed in real time or retrospectively. This could help to identify and rectify any performance issues or bottlenecks, improving service efficiency and user experience.
- Logs generated from read requests can be used in predictive analytics or Machine-Learning models. This can provide insights into usage patterns, peak load times, and user behaviors, which can further inform decision-making, capacity planning, and strategic initiatives.
Ensure Storage logging is enabled for Blob service for read requests
Ensure Storage logging is enabled for Blob service for read requests
- Enabling Storage logging for the Blob service helps to maintain a record of all read requests, allowing for appropriate access tracking and anomaly detection through analysing unexpected or unauthorized read access patterns.
- This policy aids in ensuring compliance with organizational security policies and various regulatory standards that mandate logging of all data access activities.
- It can provide crucial insights during a security incident investigation, by offering specific details like IP addresses, timestamps, request URIs, user agents, etc., associated with each read request.
- In cases of any data leakage or breach, the logs can prove instrumental in determining the what, when, and how of the situation, thus facilitating effective incident response and mitigation strategies.
Ensure that Cognitive Services enables customer-managed key for encryption
Ensure that Cognitive Services enables customer-managed key for encryption
- This policy ensures customer-managed keys are used for encryption in Azure’s Cognitive Services, providing greater control over data security by allowing customers to manage their own cryptographic keys and contribute to data privacy regulations compliance.
- Since encryption helps to protect the data at rest, enabling customer-managed keys adds an additional layer of security by ensuring that only the customer has access to the keys to decrypt the data, reducing potential vulnerabilities such as key mismanagement by third parties.
- Should a key get compromised, the customer has direct control to revoke or change the key promptly, therefore reducing the risks and potential damage associated with data breaches.
- Implementing this policy through the infrastructure code in Terraform allows for consistent application of the policy across all cognitive service accounts, ensuring compliance and reducing the risk of human error in manual configuration.
Ensure Azure spring cloud is configured with Virtual network (Vnet)
Ensure Azure spring cloud is configured with Virtual network (Vnet)
- This policy ensures that Azure Spring Cloud Services are deployed within a Virtual Network (Vnet), providing an additional layer of security by allowing controlled access and network isolation, reducing the risk of external threats.
- Configuring Azure Spring Cloud with a Vnet allows for better control over IP address management, enabling routing policies to be implemented, which can provide precise control over application traffic flow and reducing the risk of data leaks.
- By enforcing this policy, organizations can apply network security policies consistent with on-premises infrastructure, facilitating hybrid cloud implementations and making it easier to ensure complete compliance with security guidelines.
- The policy is also crucial for building a highly secure ecosystem in Azure, as Vnets can be linked with other Azure resources such as Subnets, Network Security Groups and Route Tables, offering more seamless integration, and hence, better control over the bigger pictorial view of infrastructural layout.
Ensure Azure automation account does NOT have overly permissive network access
Ensure Azure automation account does NOT have overly permissive network access
- This policy is important because overly permissive network access can expose an Azure automation account to potential malicious activities, including unauthorized access, data breaches, or distributed denial of service attacks.
- The policy helps meet the principle of least privilege, where an entity is given the minimum levels of access necessary to complete its tasks. This reduces potential attack surface and mitigates risk of exploitation.
- Limited network access reduces the likelihood of internal threats as it minimizes the avenues an insider with malicious intent can exploit. This enhances the overall security and integrity of the infrastructure assets managed by the automation account.
- Implementing this policy supports compliance with security standards and regulations that mandate strict access controls. It aids organizations meeting the requirements of frameworks like ISO 27001, PCI DSS or the GDPR.
Ensure Azure SQL database Transparent Data Encryption (TDE) is enabled
Ensure Azure SQL database Transparent Data Encryption (TDE) is enabled
- Enabling Azure SQL database Transparent Data Encryption (TDE) protects data at rest by encrypting database files, preventing unauthorized access to the data by hackers or malicious entities if the physical media (such as drives or backup tapes) are stolen.
- Since TDE performs real-time I/O encryption and decryption of the database, log, and backup files, the implementation of this rule ensures the seamless and continuous accessibility of data for users and applications, without compromising data security.
- Non-compliance with this policy might lead to a potential data breach and loss of sensitive data, causing reputational damage and potential legal and financial penalties under data privacy laws and regulations.
- In infrastructure as code (IaC) using Terraform, this policy can be automated and uniformly enforced across multiple Azure SQL databases at the provisioning stage, reducing human error and increasing security efficiency.
Ensure Azure PostgreSQL Flexible server is not configured with overly permissive network access
Ensure Azure PostgreSQL Flexible server is not configured with overly permissive network access
- Overly permissive network access could allow unauthorized users to access, read, modify or delete sensitive data stored in Azure PostgreSQL Flexible server, compromising the integrity and confidentiality of the data.
- It could potentially allow attackers to exploit weaknesses and bypass security measures implemented in an organization’s network, leading to a broader system compromise or malicious activities such as data propagation and system disruption.
- It exposes the organization to compliance risks, for instance, organizations failing to protect customer data as per GDPR or HIPAA regulations may face substantial penalties and legal actions.
- Restricting permissive access helps in reducing the attack surface. Restricting the IP ranges that can access your server to known IP addresses provides an additional layer of security by limiting network access.
Ensure Azure AD authentication is enabled for Azure SQL (MSSQL)
Ensure Azure AD authentication is enabled for Azure SQL (MSSQL)
- Enabling Azure AD authentication for Azure SQL ensures that only authorized users and applications can access and manipulate data, providing an additional security layer to prevent unauthorized data access, potential data breaches and ensuring compliance with data privacy regulations.
- Azure AD authentication allows for centralized management of account credentials, making it easier to manage and monitor account activities across the organization thus enhancing overall database security and user accountability.
- The policy helps to ensure the use of multi-factor authentication, conditional access policies and other Azure AD security features when connecting to Azure SQL database, providing a comprehensive security system and reducing the risk of successful cybersecurity attacks.
- Non-compliance with this policy could leave the Azure SQL vulnerable to SQL injection attacks and other forms of attack, which could lead to data corruption, data loss, or unauthorized data exposure, hence severely impacting data integrity and security.
Ensure Container Instance is configured with managed identity
Ensure Container Instance is configured with managed identity
- This policy ensures that container instances in Azure use managed identities, providing an identity for applications to use when connecting to resources that support Azure Active Directory (AD) authentication, thereby improving the security of your infrastructure by reducing manual identity management.
- Through managed identity configuration, the need for storing sensitive information such as credentials in code is eliminated. This reduces the potential attack surface and risk of credentials being leaked or misused.
- By implementing this policy using Terraform, it enables the use of version control and collaborative development processes, allowing for accurate tracking of changes and better management of infra security.
- Non-compliance with this policy could lead to unauthorized access to resources, as well as potential violation of regulatory compliance standards that require secure identity management, thereby negatively impacting both the organization’s security and its compliance status.
Ensure AKS cluster has Azure CNI networking enabled
Ensure AKS cluster has Azure CNI networking enabled
- Using Azure Container Network Interface (CNI) networking for AKS clusters ensures that each Pod gets a unique IP address from the subnet. This eliminates the need for Network Address Translation (NAT) and provides easier and more predictable network connectivity for your applications.
- Enabling Azure CNI ensures that network isolation can be implemented on per-pod level. This for example allows for segmenting workloads within different pods of the same node or on different nodes from each other increasing the overall security landscape.
- Azure CNI networking supports integration with existing Azure virtual networks, network security groups, and user-defined routing, providing a seamless and integrated network experience, which enhances cluster availability and resilience.
- Failure in complying with this rule may lead to network communication complications between pods and services, making it important for preventing unexpected network behavior that can lead to service interruptions or broader security vulnerabilities.
Ensure Azure Container Registry (ACR) has HTTPS enabled for webhook
Ensure Azure Container Registry (ACR) has HTTPS enabled for webhook
- Ensuring Azure Container Registry (ACR) has HTTPS enabled for webhook is crucial for data privacy and preventing potential intercepting unauthorized access to your data. HTTPS encrypts the data transported through the network, reducing the risk of data leaks.
- This policy ensures that only registered and authorized users can access the ACR webhook, providing a secure communication channel between the client and server. This protects the information from being accessed or manipulated by malicious actors.
- Noncompliance with the policy may make the infrastructure vulnerable to ‘man-in-the-middle’ attacks wherein a third party could intercept unencrypted data, potentially leading to sensitive information compromise, such as access tokens or proprietary code.
- Implementing this policy can enhance overall security posture and ensure compliance with security standards and regulations, which require secure transmission of data over the internet.
Ensure VNET subnet is configured with a Network Security Group (NSG)
Ensure VNET subnet is configured with a Network Security Group (NSG)
- A Network Security Group attached to a VNET Subnet provides a vital layer of defense in depth by defining inbound and outbound security rules. Without NSG, the entire virtual network would be exposed to potential threats.
- Applying NSG to subnets can lead to better control of network traffic and prevents the accidental exposure of assets to the internet. This security measure aids in mitigating risks associated with unauthorized access and data breaches.
- This policy is crucial for implementing a zero-trust network model in Azure, where every internal and external network traffic is considered untrusted by default. An NSG configured subnet ensures that every communication must be verified before a data exchange occurs.
- The effective enforcement of this policy can contribute to regulatory compliance. Standards like ISO 27001, GDPR, and HIPAA demand secure configuration of network resources. Compliance can be compromised if NSG is not applied to subnet, exposing organizations to legal and fiscal penalties.
Ensure private endpoint is configured to key vault
Ensure private endpoint is configured to key vault
- This policy ensures that Azure Key Vault keys, secrets, and certificates are only accessed through a secure private connection, enhancing the security of these sensitive assets from unauthorized interceptions.
- Compliance with this policy minimizes the risk of data breaches, as traffic between the Azure Key Vault and your service doesn’t traverse over the public internet, reducing exposure to potential threats.
- The policy necessitates the use of private endpoint that isolates the data transfer. This ensures that the key vault data is not exposed or susceptible to DDoS attack, improving the overall infrastructure security.
- Increased transparency and traceability is another impact of this policy, as configuring a private endpoint allows for detailed logging and monitoring of data access and movement. This aids in audit procedures and helps in early detection of any misuse.
Ensure storage account is configured with private endpoint
Ensure storage account is configured with private endpoint
- This policy ensures that the storage account is only accessible within your private network, preventing unauthorized entities from accessing the data, hence enhancing the safety of your data.
- The policy further limits data exposure to potential cyber threats such as eavesdropping, data breaches, or man-in-the-middle attacks by ensuring only approved private endpoints can interact with the storage account.
- By strictly enforcing this policy, it enhances regulatory compliance. Certain data and industry regulations mandate that certain types of data be kept in private networks and only be accessed through secure private connections.
- In the context of Infrastructure as Code (IaC) using Terraform, the policy ensures that all storage account resources defined through Terraform scripts follow security best practices, reducing the risk of human error in configuration and providing a consistent, automated way to manage infrastructure.
Ensure Azure SQL server firewall is not overly permissive
Ensure Azure SQL server firewall is not overly permissive
- The policy helps to safeguard sensitive data stored in the Azure SQL server by preventing unauthorized access from IP addresses outside the specified range in the firewall rules. This ensures only approved IP addresses or ranges can access your SQL server.
- A less restrictive or overly permissive firewall on Azure SQL server increases the risk of potential cyber threats like SQL injections or data breaches. By enforcing this policy, the likelihood of these risks can significantly be reduced.
- Regularly auditing and limiting the SQL server firewall rules to only necessary and trusted IP ranges also helps organizations adhere to regulatory compliance standards related to data security.
- The policy applied with the help of Infrastructure as Code (IaC) practice can automate security configurations, reducing human intervention and thereby human error in server firewall setup, thereby improving overall security posture.
Ensure Azure recovery services vault is configured with managed identity
Ensure Azure recovery services vault is configured with managed identity
- Enabling managed identities for Azure Recovery Services Vault increases security by eliminating the need for developers to manage credentials. It provides an identity for applications to use when connecting to resources, reducing the risk of compromised keys or passwords.
- Managed identities help ensure compliance with security best practices and regulations. They automatically handle tasks such as secret rotation and secure storage, maintaining a high security standard even in complex environments.
- By configuring Azure Recovery Services Vault with managed identity, organizations can dramatically simplify auditing processes. Any access to the Recovery Services Vault is tied to a specific, centrally managed identity, making it easier to track and monitor access.
- Misconfiguration is a key concern in cloud environments, and not enabling managed identity on Azure Recovery Services Vault can expose the system to risks. Therefore, enforcing this policy is crucial to prevent potential data breaches or vulnerabilities.
Ensure Azure automation account is configured with managed identity
Ensure Azure automation account is configured with managed identity
- Using managed identities for Azure resources provides Azure services with an automatically managed identity in Azure AD, which can be used to authenticate and secure inter-service communication, thus providing secure access control and eliminating the need for storing and managing secret credentials in your apps.
- Applying this policy ensures access management for Azure resources is automated via Identity and Access Management (IAM), strengthening security by ensuring only authorized services and users can perform actions on your automation account.
- A managed identity protects against human errors such as accidentally checking code that contains sensitive data into a shared Git repository, which could potentially leave the system vulnerable to attacks.
- It helps to adhere to security best practices by minimizing the need for manual management of service credentials, potentially enhancing system security and reducing the chances of unauthorized access due to credentials exposure.
Ensure Azure MariaDB server is using latest TLS (1.2)
Ensure Azure MariaDB server is using latest TLS (1.2)
- Ensuring Azure MariaDB server uses the latest TLS (1.2) helps to secure the server by leveraging strong encryption. This encryption guards against data breaches by making it difficult for unauthorized third parties to intercept and interpret data during transfer.
- Utilizing the latest TLS reduces the server’s vulnerability to downgrade attacks, where an attacker might force connections to use older, less secure versions of TLS. Such attacks can expose sensitive information to the attacker.
- Compliance with various security standards and regulations, such as PCI-DSS, may require using the latest and most secure encryption protocols like TLS 1.2. Non-compliance may have legal and financial implications for the company.
- Older versions of TLS are known to have several exploitable vulnerabilities and using the latest version of TLS for MariaDB server reduces the risk associated with these vulnerabilities ensuring steady, secure and uninterrupted operation of the server.
Ensure soft-delete is enabled on Azure storage account
Ensure soft-delete is enabled on Azure storage account
- Enabling soft-delete ensures that when data is erroneously deleted or overwritten, it can be recovered in Azure storage account, thus safeguarding important data from potential loss.
- Having soft-delete enabled helps to maintain the data integrity of the storage account, as this feature retains all deleted data for a specified period of time, providing an extra layer of protection.
- Implementing soft-delete helps in compliance with various regulations and standards which require data to be restorable. This functionality can often be a requirement in audits.
- The use of Infrastructure as Code (IaC) tool like Terraform provides the ability to automate the process of enabling soft-delete in Azure storage account, improving the resource management efficiency.
Ensure Azure VM is not configured with public IP and serial console access
Ensure Azure VM is not configured with public IP and serial console access
- This policy ensures that Azure Virtual Machine (VM) instances are not exposed to the public internet, reducing the attack surface by limiting remote access of the VM and thereby enhancing security.
- Restricting serial console access prevents unauthorized individuals from gaining direct control over the system, providing an additional safeguards against malicious activity, and ensuring strict access control.
- The policy promotes best practices in managing network interfaces, so only necessary internal resources or predefined IP addresses can connect to azurerm_network_interface, helping to prevent possible breaches from external, potentially harmful sources.
- This rule can be enforced using Terraform, a popular Infrastructure as Code (IaC) tool, ensuring consistency and automating compliance across all instances of azurerm_linux_virtual_machine, azurerm_virtual_machine, and azurerm_windows_virtual_machine for better scalability and security management.
Ensure storage account is not configured with Shared Key authorization
Ensure storage account is not configured with Shared Key authorization
Ensure storage account is configured with SAS expiration policy
Ensure storage account is configured with SAS expiration policy
- Configuring a Storage Account with a Shared Access Signature (SAS) expiration policy ensures that the data access token expires after a specified period. This mitigates the risk of unauthorized data exposure if the token is accidentally leaked or stolen.
- Without an expiration policy, a stolen or leaked SAS can be misused to access confidential data indefinitely, leading to potential data breaches. This policy helps to limit the damage in such scenarios.
- By defining SAS expiration within the Terraform deployment configuration, you maintain infrastructure-as-code best practices. This consistency enables easy auditing of your environment and enhances overall security by ensuring expirations are not overlooked.
- Implementing this policy enhances compliance with data protection and privacy regulations that may demand specific data access controls. This policy can help organizations show due diligence in minimizing the potential exposure window of access tokens.
Ensure Azure PostgreSQL server is configured with private endpoint
Ensure Azure PostgreSQL server is configured with private endpoint
- Ensuring Azure PostgreSQL server is configured with a private endpoint enhances security by enabling secure and direct network connectivity between servers and customer virtual networks, thereby mitigating risk of data exposure to the public internet.
- This policy helps to reduce vulnerabilities caused by unauthorized access or attacks from the internet, as traffic between Azure services and PostgreSQL server transits solely within the Microsoft network.
- The application of this policy in Infrastructure as Code (IaC) with Terraform allows for efficient and scalable implementation, enabling security configurations to be version-controlled and automatically deployed, reducing human errors and inconsistencies.
- It ensures complicity with data governance and privacy standards that require certain sensitive data to not be exposed over the internet but to be securely contained within private networks.
Ensure Azure MariaDB server is configured with private endpoint
Ensure Azure MariaDB server is configured with private endpoint
- Ensuring Azure MariaDB server is configured with a private endpoint can significantly increase the security by eliminating exposure to the public internet, reducing the risk of malicious attacks such as DDoS or data breaches.
- By adopting this policy, communication between the MariaDB server and other services within the network will also be more secure since it all happens within Azure’s private network. This isolation can guard sensitive data against possible interceptor and impersonator.
- With Azure private endpoints, the traffic between your Azure resources and MariaDB server travels over Microsoft’s backbone network, providing reliability, low latency, and higher security.
- Leveraging Infrastructure as Code (IaC) tools like Terraform to implement this policy can ensure consistency and repeatability, minimizing the chances of configuration errors and speeding up the implementation process.
Ensure Azure MySQL server is configured with private endpoint
Ensure Azure MySQL server is configured with private endpoint
- Ensuring Azure MySQL server is configured with a private endpoint provides a secure and scalable way for your virtual network to privately connect to Azure services, preventing potential cyber threats or unauthorized access from the public internet.
- This policy promotes better data protection practice in line with compliance and privacy laws/regulations, as communication between your network and the service travels over the Microsoft backbone network and not the public Internet, reducing the chance of data leakage.
- Applying this policy in a terraform managed environment helps in maintaining consistency and automation in security configurations throughout the development cycle, reducing manual errors and effort.
- This policy minimizes the attack surface and potential risk exposure by restricting server communication to a particular VNet, ensuring only approved entities can interact with the Azure MySQL server, leading to a more controlled and secure environment.
Ensure Microsoft SQL server is configured with private endpoint
Ensure Microsoft SQL server is configured with private endpoint
- Ensuring Microsoft SQL server is configured with a private endpoint provides a more secure connection, reducing the risk of unauthorized access as the database server is not exposed to the public internet.
- By limiting traffic only from within the same network and blocking direct internet access, the policy mitigates potential attacks such as data breaches or DDoS attacks on the server.
- This configuration uses Azure’s private link service, which provides an extra layer of security between the SQL server and other virtual networks. It ensures only approved networks can connect, reducing the risk of malicious connections.
- If the policy is not implemented correctly it could lead to serious consequences such as data loss or leakage, service disruption, and non-compliance with security standards and regulations, impacting the overall trust and operational efficiency of the service.
Ensure that Azure Synapse Workspace vulnerability assessment is enabled
Ensure that Azure Synapse Workspace vulnerability assessment is enabled
- Enabling Azure Synapse Workspace vulnerability assessment helps identify, investigate, and remediate potential security threats in the data warehouse environment, thus enhancing data protection.
- It ensures automated scanning of Azure Synapse Workspace resources. If any vulnerability like SQL injection or other exploits is detected, this feature readily alerts the security administrators, enabling quicker response and prevention of potential breaches.
- The implementation of this policy reduces the risk of non-compliance with various standards and regulations such as GDPR, HIPAA, or PCI-DSS that demand robust vulnerability management, thereby protecting the organization from potential legal and financial penalties.
- Employing Infrastructure as Code (IaC) like Terraform to enforce the policy ensures uniformity and reproducibility across different environments, making it easier to manage and monitor security across multiple workspaces.
Ensure storage account is configured without blob anonymous access
Ensure storage account is configured without blob anonymous access
- Ensuring storage accounts are configured without blob anonymous access minimizes risks of unauthorized access to sensitive data stored in Azure blobs. Preventing anonymous access means that only authorized users or services can access blob data, enhancing security.
- This policy helps in maintaining compliance with security standards and regulations. Certain rules and standards, such as GDPR and HIPAA, emphasize limiting data access only to authorized individuals, and having anonymous access disabled aligns with such requirements.
- It aids in monitoring and auditing of data access. If the storage account allows anonymous access, it becomes difficult to track who accessed the data, the performed actions and when. However, when such access is disabled, each access leaves traceable details of the user or service, facilitating efficient auditing.
- Configuring storage accounts without anonymous access helps to prevent data breaches. Anonymous access can be exploited by cyber attackers to gain unauthorized access to critical data, possibly leading to disruptive cyber attacks.
Ensure container job uses a non latest version tag
Ensure container job uses a non latest version tag
- Using a non-latest version tag in container job ensures consistent and predictable behavior of the application across different environments, providing controlled software version dependency.
- The policy guards against automated updates through the ‘latest’ tag being applied to Azure Pipelines, which could potentially introduce bugs, alter functionality or result in compatibility issues.
- Tracking specific versions rather than using the ‘latest’ tag makes diagnosis and bug-fixing significantly easier, by quickly associating issues with specific software versions.
- This policy enforces best practices for infrastructure as code (IaC) by requiring version control, which results in an audit trail for changes, enhancing the overall security and reliability of the software development process.
Ensure container job uses a version digest
Ensure container job uses a version digest
- This policy ensures that a specific and immutable version of a container is used in a job, leading to consistent, predictable, and reproducible builds in Azure Pipelines. This predictability is key to maintaining reliable development and deployment workflows.
- The policy reduces the risk of security incidents as each container version has a unique digest and any changes to it, intended or malicious, result in a different digest. Therefore, using version digests can help prevent the use of compromised or manipulated containers.
- The enforcement of this policy promotes best practices for version control in DevOps, as it prevents the use of ‘latest’ tag in container deployment, which can inadvertently result in the use of untested or unstable versions of containers leading to potential execution errors.
- The policy also supports auditability and traceability as each deployed container can be traced back to a specific version. This can aid in incident response and investigations in case of a breach or failure.
Ensure set variable is not marked as a secret
Ensure set variable is not marked as a secret
- Ensuring a set variable is not marked as a secret helps in minimizing the risk of sensitive information leakage. Secret variables typically store sensitive data, which if exposed, can potentially lead to security breaches.
- Non-compliance with this policy can inadvertently allow unauthorized individuals to access crucial data, thus threatening the confidentiality and integrity of the infrastructure. By enforcing this rule, only authorized entities can manage, access and use secret variables.
- Marking a non-sensitive, set variable as a secret can unnecessarily complicate the management and usage of these variables. It can lead to increased overhead and complexities in debugging and development.
- Strict adherence to this policy ensures the principle of least privilege is followed, where only pertinent secrets are classified as such, thereby reducing unnecessary restrictions and streamlining the pipeline infrastructure functionality.
Detecting image usages in azure pipelines workflows
Detecting image usages in azure pipelines workflows
- This policy enables the monitoring and detection of images utilized in Azure Pipelines workflows, allowing for early discovery of inconsistent, obsolete or insecure image use, thereby enhancing security.
- Due to the ephemeral nature of containers, a compromised image used in a pipeline can indicate a significant security vulnerability, emphasizing the necessity of this rule for maintaining the integrity of deployment workflows.
- The ability to detect image usage in Azure Pipelines is crucial for ensuring compliance with organizational policies, industry best practices, and regulatory mandates relating to container security and software development.
- By enforcing this policy, organizations can increase their control over the release process, preventing unauthorized changes from disrupting the delivery pipeline and ensuring the reliability of deployed software.
Ensure no hard coded API token exist in the provider
Ensure no hard coded API token exist in the provider
- Hardcoded API tokens in the provider compromise the security of the infrastructure by providing an easy path for unauthorized access. By ensuring no hardcoded API tokens exist, this policy prevents potentially harmful security breaches.
- The policy helps in achieving continuous compliance by verifying that the provider configurations do not have hardcoded API tokens. This aligns with best practice guidance from security frameworks and compliance standards.
- By eliminating hardcoded tokens, this policy promotes the use of secure methods of token management such as claiming tokens dynamically through Identity Access Management (IAM) or environment variable, enhancing the overall security posture of the terraform managed infrastructure.
- A failure to adhere to this policy may result in the exposure of sensitive information to malicious actors, leading to data breaches, unauthorized changes, system disruption, and significant financial and reputational damage to the entity.
Merge requests should require at least 2 approvals
Merge requests should require at least 2 approvals
- This policy ensures that any change made to the codes through merge requests is reviewed and approved by at least two individuals, bringing more than one perspective to the review process and hence reducing the chances of errors or security vulnerabilities getting unnoticed.
- Implementing this policy lowers the risk of potentially harmful or poor-quality code being merged into the main codebase, thereby enhancing the security and integrity of applications or systems built with the code.
- Enforcing two approvals prevents instances of unauthorized and unreviewed changes to the production environment, thereby reducing the risk of insider threats and accidental disruptions.
- Its application increases responsibility and cross-team collaboration within an organization as more than one person is involved in approving code changes, enhancing compliance with the principle of least privilege and separation of duties in security management.
Ensure the pipeline image uses a non latest version tag
Ensure the pipeline image uses a non latest version tag
- Ensuring the pipeline image uses a non-latest version tag helps to maintain consistency and reliability of the software and system, as the ‘latest’ tag may bring unexpected changes that may disrupt normal operations.
- By using a specific version, developers have better control of the software environment and can have a predictable, stable and consistent behavior of applications.
- By specifically defining version tags, security vulnerabilities and bugs in newer, untested updates can be avoided, which otherwise could compromise the system.
- Using non-latest version tags makes it easier to manage pipeline rollbacks, diagnose issues, and troubleshoot since one would know precisely what version is being used in the pipeline.
Ensure the pipeline image version is referenced via hash not arbitrary tag.
Ensure the pipeline image version is referenced via hash not arbitrary tag.
- Ensuring the pipeline image version is referenced via hash not arbitrary tag helps maintain consistent software versions, as tags can be moved to different images while a hash will always reference the same image.
- This policy reduces potential attack vectors by eliminating the risk of policy deviation that arbitrary tags can introduce by referencing different images unpredictly, thereby strengthening infrastructure security.
- By requiring specific hashes instead of tags, the policy ensures a deterministic and unchangeable reference to a specific image, promoting traceability and auditability of the deployment process.
- This policy promotes reproducibility in the deployment process as referencing by hash guarantees the same image will be used every time, preventing unexpected errors or inconsistencies caused by varying versions or configurations.
Ensure mutable development orbs are not used.
Ensure mutable development orbs are not used.
- This policy helps in eliminating the usage of mutable development orbs in CircleCI pipelines which can be modified after they’re published, potentially introducing unforeseen issues or vulnerabilities into the implemented code.
- Ensuring that mutable development orbs are not used minimizes the risk of unauthorized changes being made, leading to stronger code integrity and reducing the potential for malicious activities or unintended alterations.
- This policy promotes the use of production orbs that are frozen at a specific semver, providing a stable and predictable behavior in the CircleCI pipelines. This predictability is crucial for maintenance, debugging, and overall code stability.
- By enforcing the usage of non-mutable orbs, the policy can ensure that all team members work with consistent tooling, thus ensuring reliable and repeatable build results, and enhancing the troubleshooting process during development.
Ensure unversioned volatile orbs are not used.
Ensure unversioned volatile orbs are not used.
- The policy prevents the risk of deploying untested or in-development code into production environments by enforcing the use of versioned orbs in CircleCI pipelines, bringing stability and predictability to the CI/CD process.
- Using unversioned volatile orbs can lead to unpredictable behaviors and outcomes in CircleCI pipelines, possibly causing service disruptions and affecting the overall application reliability.
- Enforcing this policy reduces exposure to potential security vulnerabilities in unversioned orbs, providing an added layer of security for applications and infrastructure built and deployed through CircleCI pipelines.
- This policy encourages good software development practices by enforcing the use of stable, tested, and versioned components in CI/CD pipelines, thus ensuring consistency and reliability of deployments across different environments.
Suspicious use of netcat with IP address
Suspicious use of netcat with IP address
- The policy helps in identifying and preventing potential security breaches by detecting malicious interactions with the network via netcat tool, providing an added layer of security in infrastructure by monitoring and controlling network traffic.
- Due to the ability of Netcat to read and write data across networks, suspicious usage can indicate potential cyber-attacks like reverse shell attacks, where an attacker might gain control over a system. The policy helps to detect these early, minimizing potential harm.
- By monitoring the usage of netcat, the policy ensures compliance with data regulations and governance standards, reducing risks associated with data leakage.
- The policy increases the reliability and robustness of the Github Actions infrastructure as it decreases the chance for outages and disruptions caused by cyber-attacks leveraging the netcat tool.
Ensure run commands are not vulnerable to shell injection
Ensure run commands are not vulnerable to shell injection
- The policy mitigates the risk of shell injection attacks, where an attacker can execute arbitrary commands on a server via the input to a vulnerable shell script, protecting critical system resources and data.
- It ensures the reliability of the jobs run on GitHub Actions by avoiding unanticipated behaviour and potential disruptions, thus maintaining system availability and reducing downtime.
- By preventing shell injection attacks, it protects the privacy and integrity of the data processed by the jobs, as such attacks can be used to expose sensitive data or modify it without authorisation.
- Implementation of this policy fosters security best practices in infrastructure-as-code development, reinforcing the overall security posture and compliance of the system.
Suspicious use of curl in run task
Suspicious use of curl in run task
- The policy ‘Suspicious use of curl in run task’ is crucial because it helps detect unusual or potentially harmful actions in scripting, particularly ones that involve the command-line tool curl. This tool is often employed by attackers to retrieve or send data, making its abnormal use a potential security issue.
- By scanning circleci pipeline data, this policy can identify script actions that may lead to data breaches or unauthorized system access. Identifying such actions early can prevent security incidents.
- The policy aids in maintaining a robust infrastructure as code (IaC) by checking for suspect command-line calls within scripted tasks. In turn, this ensures higher code quality and mitigates the risk of including potentially dangerous code.
- Continuous monitoring of curl usage under this policy can assist organizations to better manage their security posture. Timely detection of suspicious curl usage could narrow down the investigation scope during incident responses, aiding faster recovery, and reduction of potential damage.
Detecting image usages in circleci pipelines
Detecting image usages in circleci pipelines
- This policy is important because it identifies the usage of particular images in CircleCI pipelines. CircleCI is a continuous integration tool that automates the building, testing, and deployment of code. Identifying images used in these pipelines can help monitor and control the versions and types of software running in the production environment.
- The ability to detect image usage in CircleCI pipelines has significant security implications. If an outdated or insecure image is being used in a pipeline, this could potentially create vulnerabilities in the applications built using this pipeline. This policy helps to mitigate such security risks.
- Ensuring secure images are being used within CircleCI pipelines with this policy reduces chances of abuse or exploitation. If a malicious actor gains access to the pipeline and changes the images, it could lead to the insertion of malicious code or unauthorized data access. By checking image usage, any such suspicious changes can be detected promptly.
- Through continuous monitoring of image usage, this policy helps maintain compliance with industry-standard practices and regulations regarding application security and integrity. Compliance with such standards is crucial for maintaining customer trust and preventing negative regulatory repercussions.
Ensure the Spaces bucket has versioning enabled
Ensure the Spaces bucket has versioning enabled
- Enabling versioning on the Spaces bucket helps in maintaining different versions of an object in the same bucket. This ensures that all changes made to data can be tracked and reverted if needed, contributing to the overall data integrity and resilience of the digitalocean_spaces_bucket.
- This policy helps in maintaining the business continuity in case of any accidental deletions or modifications. If versioning is not enabled, irrecoverable data loss could occur, causing potential significant harm to business operations and brand reputation.
- Adhering to this policy simplifies the recovery process during a data breach or a cyber attack. Being able to revert to a previous version of the bucket allows for rapid recovery, minimizing the impact and downtime of your services.
- Compliance with this policy is key for audits and adhering to certain regulatory standards. Having full traceability of changes within the Spaces bucket can provide transparency, foster trust with stakeholders, and fulfill compliance requirements with regulations that mandate certain data retention and recovery measures.
Ensure the droplet specifies an SSH key
Ensure the droplet specifies an SSH key
- This policy is essential as it ensures that any interaction with the digitalocean_droplet resource can only be conducted using secure shell (SSH) keys, providing an encrypted, password-less authentication method.
- It helps ensure that only authorized individuals can access and make changes to the droplet, as the SSH key provides an additional layer of security beyond the traditional username-password combo.
- The policy aids in the prevention of unauthorized access or potential security breaches, which can lead to data theft, loss, or manipulation if the droplet contains sensitive data or hosts critical services.
- It supports infrastructure as code (IaC) best practices when using Terraform for digitalocean_droplet resource management, enabling consistent implementation of secure access controls across all instances.
Ensure the Spaces bucket is private
Ensure the Spaces bucket is private
- Keeping the Spaces bucket private helps prevent unauthorized access to sensitive data. If the bucket is public, anyone with the bucket’s URL can access its contents, potentially leading to data leaks or breaches.
- This policy mitigates the risk of data tampering. Once a bucket and its contents are publicly accessible, there is a greater risk of data modification or deletion by malicious entities.
- Compliance with data protection regulations often mandates that storage spaces for sensitive information be kept private. Failing to make your Spaces bucket private might put your organization in violation of laws like GDPR or CCPA.
- Implementing this infra security policy ensures that security controls align with Infrastructure as Code (IaC) practices. Ensuring this through tools like Terraform helps maintain consistency and traceability in security configurations across all your digital assets.
Ensure the firewall ingress is not wide open
Ensure the firewall ingress is not wide open
- Ensuring the firewall ingress is not wide open minimizes the potential attack vectors from malicious entities by preventing unrestricted access to all ports and services.
- In case of an open firewall ingress, sensitive data may be exploited or stolen, impacting both the integrity and confidentiality components of the system’s infosecurity.
- An unrestricted firewall ingress might increase the system’s vulnerability to DDoS attacks, consuming system resources unnecessarily and potentially causing downtime or degraded performance.
- A complete open firewall ingress is contrary to the principle of least privilege, and could lead to non-compliance penalties in industries where certain data protection standards are enforced, such as healthcare or finance.
Ensure port 22 is not exposed
Ensure port 22 is not exposed
- Ensuring that port 22 is not exposed prevents unauthorized remote access to systems or resources as port 22 is associated with Secure Shell (SSH), a protocol commonly used for secure remote login and command execution.
- Keeping port 22 unexposed reduces the overall attack surface of the system. It diminishes chances of brute force attacks or any other SSH-related attacks that could possibly lead to system compromise or data leak.
- By enforcing this policy, we limit potential vulnerabilities that can be exploited due to misconfigurations or weak security practices, ensuring that our docker-based applications follow best practices.
- The policy can help in demonstrating compliance with various regulatory and security standards that recommend or require minimization of exposed ports to only necessary ones. It can help uphold the company’s reputation for good security practices.
Ensure that HEALTHCHECK instructions have been added to container images
Ensure that HEALTHCHECK instructions have been added to container images
- Having HEALTHCHECK instructions in Docker container images allows automated systems to assess the health status of running applications, enabling quick detection and resolution of operational issues.
- The absence of a HEALTHCHECK instruction can make it difficult to identify when a service becomes unresponsive, which can lead to prolonged downtime and negative impacts on end users.
- Implementing the HEALTHCHECK command keeps the applications running within the Docker container in an expected state. If a service crashes, containers with a HEALTHCHECK will act to correct the issue automatically, improving system reliability.
- This policy, when implemented, increases the overall reliability and uptime of services, resulting in improved availability for users and potentially reducing the need for manual intervention from network administrators.
Ensure that a user for the container has been created
Ensure that a user for the container has been created
- Ensuring that a user for a Docker container has been created is critical for preventing unauthorized access, as running a Docker container without a specified user can lead to potential security vulnerabilities.
- This policy helps to enforce the principle of least privilege by ensuring that containers don’t have unnecessary root access, mitigating the impact of a potential breach or malicious activity within the container environment.
- Running containers with a specified user can ensure traceability and accountability, as each action can be tracked back to a unique user, contributing to an overall improved security posture.
- Failure to abide by this policy can lead to non-compliance with security standards and industry best practices, potentially putting sensitive data at risk and compromising the reputation of the organization.
Ensure that COPY is used instead of ADD in Dockerfiles
Ensure that COPY is used instead of ADD in Dockerfiles
- Using COPY ensures that only necessary files are imported into Docker containers. With ADD, there is a risk of accidentally importing unwanted files or directories that could risk your container’s security or inflate its size.
- COPY commands in Dockerfiles are more transparent and straightforward, reducing the complexity of Docker images. This augmentation of standardization helps minimize mistakes and improves maintainability across team members.
- The ADD command has additional functionalities like extracting local archive files into the Docker image that will not be used in most Dockerfile cases. These extra abilities make the images larger and slower to build and push, reducing efficiency in your development pipeline.
- If the ADD command is used in place of COPY, it increases the risk of injection attacks. For instance, an attacker could replace a .tar file that’s referenced in the ADD command, enabling them to implant malicious files into the image. Implementing a ‘COPY over ADD’ policy lessens this risk.
Ensure update instructions are not use alone in the Dockerfile
Ensure update instructions are not use alone in the Dockerfile
- This policy helps in improving the security of Docker images by ensuring that the ‘RUN apt-get update’ command is not used alone in the Dockerfile, protecting from missed updates due to Docker’s layer caching.
- It encourages best practices for Dockerfile creation by insisting commands that install packages should always accompany an update command. This reduces the likelihood of utilising outdated packages with known vulnerabilities within Docker images.
- Supporting reproducibility and consistency within Docker images, this policy builds in predictability which is key for maintaining a secure operating environment, ensuring that software behaves as expected every time it is executed.
- It directly affects the ‘RUN’ entity by ensuring every invocation is followed by an installation command, helping to reduce the attack surface within the containerised application, providing better resilience against potential hackers.
Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated)
Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated)
- Ensuring that LABEL maintainer is used over the deprecated MAINTAINER is important because it ensures the script remains compatible with future Dockerfile updates, as the older syntax may not be supported in future Docker versions.
- This policy helps to standardize the Dockerfile coding style and provide consistent metadata, which improves code maintainability and simplifies the process of managing multiple Dockerfiles across various projects.
- Following this policy allows developers to attach more metadata to Docker images in an organized manner, thus improving documentation and visibility into the Docker images’ creation and intended function.
- As the policy enforces the use of non-deprecated features and practices, it can help avoid possible security risks or functional issues due to the lack of support or updates for deprecated items.
Ensure the base image uses a non latest version tag
Ensure the base image uses a non latest version tag
- Using a specific non-latest version tag ensures the container behavior remains consistent across different environments, as the image will not update itself automatically to include possibly unstable latest updates.
- It aids in tracing and debugging issues, which becomes easier as you know the exact version your application is running on, thus narrowing down the potential sources of an error.
- Enforcing a specific version tag increases infrastructure security, as latest tags can include unvetted updates that may have potential vulnerabilities, or be targeted by attackers who know the typical weaknesses of new versions.
- The non-latest base image helps in maintaining application compatibility, as unexpected and uncontrolled updates with the latest tag may break dependencies or features in your application.
Ensure the last USER is not root
Ensure the last USER is not root
- The policy prevents potential security vulnerabilities by ensuring that the last user in a Dockerfile is not the root user. Given that Docker containers often have complete control of the host machine, running them as root, albeit inside a container, poses a significant security risk.
- If the last USER in a Dockerfile is root, the container runs with root permissions. This opens up possibilities for malicious activities such as modifying privileged system files, executing arbitrary system-level processes, and bypassing application-level access controls.
- This policy encourages the principle of least privilege, which minimizes the potential damage from a breach by giving users the minimum levels of access necessary to complete their tasks. When containers run as non-root, they don’t have permissions to conduct harmful activities beyond their scope of need.
- Implementing this policy can prevent unauthorized access and control of the host system, thus helping organizations enhance their system security, limit the impact of a breach, and protect their critical assets.
Ensure that APT isn't used
Ensure that APT isn't used
- Ensuring that Advanced Packaging Tool (APT) isn’t used helps to prevent security vulnerabilities from unverified packages or outdated versions, improving the overall security posture of the docker container.
- By not using APT, we reduce the risk of an attacker exploiting known bugs present in packages that are included in APT but haven’t been patched yet, thereby enhancing the resilience of the system against potential attacks.
- This policy helps to reduce container size by eliminating unnecessary packages and dependencies, this in turn improves the startup speed and runtime efficiency of the Docker container.
- Not permitting APT usage in Dockerfile forces developers to follow a more controlled and secure process using whitelisted resources, which can avoid potential issues stemming from unconstrained and unmonitored usage of open-source libraries.
Ensure that WORKDIR values are absolute paths
Ensure that WORKDIR values are absolute paths
- This policy ensures that WORKDIR values are absolute paths, enhancing workflow efficiency by eliminating confusion or errors caused by relative paths, which may change depending on the context.
- The policy guarantees consistent behavior across all systems. Absolute paths are unambiguous and work irrespective of the current working directory, which makes the dockerfile more portable and less prone to errors during deployment or dynamic workload management.
- It helps in maintaining security, as relative paths can potentially be manipulated to gain unauthorized access to unintended directories or files in the system, leading to possible data breaches or other security concerns.
- Implementing this policy also improves maintainability and troubleshooting. With absolute paths, logs are clearer, since they exactly specify where processes are running or where files are located, making it easier to identify and resolve any issues.
Ensure From Alias are unique for multistage builds.
Ensure From Alias are unique for multistage builds.
- Ensuring From Alias are unique for multistage builds prevents conflicts between different stages in the build process. This can help maintain the integrity of the final docker image.
- Uniqueness of From Alias in multistage builds allows each stage to be clearly defined and isolated, making it easier to debug and modify individual stages without affecting others.
- The policy helps in achieving efficient use of system resources, because unique aliases in multistage builds result in the reuse of common layers, thus saving storage space and reducing build time.
- The AliasIsUnique.py script in the provided resource link serves as an automated check for this policy, providing a quick and reliable way to enforce this important rule in infra security. Without this measure, manual oversight or errors could lead to infringing the policy.
Ensure that sudo isn't used
Ensure that sudo isn't used
- The policy ensures that all Dockerfile instructions run as a non-root user, limiting permissions and thereby minimizing the potential damage should an attack occur within the container.
- Ensuring sudo isn’t used within Dockerfiles adheres to the principle of least privilege, allowing only necessary access for users to complete their tasks, thereby reducing the attack surface.
- Not allowing sudo use in Dockerfiles can prevent attackers from gaining root privileges, maintaining the integrity of the system by preventing unauthorized changes to critical components or sensitive data.
- By following this rule, Docker containers would run with minimal privileges, reducing the risk of exploiting security vulnerabilities that can lead to unauthorized access to sensitive data or potentially permit further attacks on the host machine.
Ensure that certificate validation isn't disabled with curl
Ensure that certificate validation isn't disabled with curl
- Keeping certificate validation enabled with curl is crucial because it verifies whether the certificate of the server is trusted, preventing potential interference from unscrupulous attackers who may be trying to intercept or manipulate the data.
- Disabling certificate validation can result in Man-In-The-Middle (MITM) attacks, where an attacker may impersonate a server to intercept, read, or manipulate the sensitive data shared between the client and the server.
- The enforcement of this policy ensures the fundamental principle of trust in cryptographically secure communication, thereby ensuring that Docker containers interact with valid and trusted external services when running curl commands.
- This policy is critical to the overall infra security as it helps to maintain data integrity and confidentiality of the communications over unsecured networks, like the Internet, by thwarting any unauthorized access to data in transit.
Ensure that certificate validation isn't disabled with wget
Ensure that certificate validation isn't disabled with wget
- Disabling certificate validation with wget may open the door to potential security risks such as ‘Man-In-The-Middle’ attacks where an attacker could intercept and alter the communication between two parties without them noticing.
- Running wget without certificate validation could lead to the downloading and execution of malicious files from untrusted or compromised sources, which could compromise the integrity and confidentiality of the Docker container and any data it processes.
- This policy enforces good security hygiene by ensuring that Dockerfiles don’t conduct insecure data transfer practices, which is a fundamental principle of maintaining secure infrastructure.
- Compliance with this policy can prevent regulatory non-compliance penalties or breaches in industry standards, as these often require secure transmission and verification of data.
Ensure that certificate validation isn't disabled with the pip '--trusted-host' option
Ensure that certificate validation isn't disabled with the pip '--trusted-host' option
- Disabling the certificate validation with pip’s ‘—trusted-host’ option puts the entities at the risk of being exposed to insecure and untrusted hosts. This circumvents an important security measure that ensures that only trusted hosts are connected to.
- Launching software that bypasses this certificate validation can result into unauthorized access to the system files or data. This can lead to significant data breach, system failures or malfunction leading to loss of critical information.
- This policy helps to enforce the practice of running pip commands only in safe and trusted network environments. In a continuously integrated and deployed development environment, this practice is critical to maintain system stability and security.
- Not adhering to this policy can also increase the potential spread of malware and infected hosts in network. This can be exploited by attackers to harm or disrupt operations in the entire network system.
Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environmnet variable
Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environmnet variable
- This rule ensures that the security of communication between the Python-based Docker application and a HTTPS server isn’t compromised by disabling certificate validation, thereby preventing man-in-the-middle attacks.
- By enforcing this rule, the Docker application will always verify the identity of the HTTPS server it’s communicating with, confirming its authenticity and ensuring that sensitive data isn’t being sent to a malicious server.
- It reduces the risk of data exposure because when certificate validation is disabled, the Docker application will accept any certificate presented by the host, which can potentially allow attackers to decrypt seemingly secure HTTPS traffic.
- Non-compliance with this rule could result in the application being classified as not secure as per infosec and compliance standards, potentially reducing the trust users, clients or third-party auditors place in the application’s security measures.
Ensure that certificate validation isn't disabled with the NODE_TLS_REJECT_UNAUTHORIZED environmnet variable
Ensure that certificate validation isn't disabled with the NODE_TLS_REJECT_UNAUTHORIZED environmnet variable
Ensure that packages with untrusted or missing signatures are not used by apk via the '--allow-untrusted' option
Ensure that packages with untrusted or missing signatures are not used by apk via the '--allow-untrusted' option
- This policy is necessary to prevent installing potentially malicious software: If unsafe packages with no signatures are installed via ‘—allow-untrusted’ option, they may contain harmful or malicious code and can risk the security and integrity of the system.
- Enforcing the policy ensures all apk packets are from trusted sources, thus adding an extra layer of security as the packages’ source authenticity can be verified, reducing the chances of a security breach.
- The policy plays a crucial role in maintaining the reputation of the entity/system as allowing untrusted package installations can open a gateway for cyber threats, deteriorating trust among users or other stakeholders.
- In case this policy is not upheld, it could lead to legal and regulatory consequences: if personal or sensitive data is compromised due to installing unverified or unsigned packages, it may be seen as failing to meet data and privacy compliance mandates.
Ensure that packages with untrusted or missing signatures are not used by apt-get via the '--allow-unauthenticated' option
Ensure that packages with untrusted or missing signatures are not used by apt-get via the '--allow-unauthenticated' option
- Ensuring that packages with untrusted or missing signatures are not used by apt-get via the ‘—allow-unauthenticated’ option helps protect systems against the risk of installing malicious software unknowingly, which could potentially compromise the system’s integrity or confidentiality.
- This policy restricts the potential for dependency confusion attacks, where an attacker could trick the system into installing a malicious package by naming it after a legitimate but unsigned or poorly secured package.
- Preventing packages downloaded through ‘apt-get’ from being installed without authentication enables admins to maintain control over the kind of software that can be installed on the system, thereby reducing the potential attack surface.
- Implementation of this policy directly impacts the security posture of programs running inside Docker containers, as it helps ensure that only trusted and secure applications are being run, thus reducing the chances of security breaches and exposure of sensitive data.
Ensure that packages with untrusted or missing GPG signatures are not used by dnf, tdnf, or yum via the '--nogpgcheck' option
Ensure that packages with untrusted or missing GPG signatures are not used by dnf, tdnf, or yum via the '--nogpgcheck' option
- The policy helps protect the infrastructure by ensuring that updates or modifications are only made using packages which have been authenticated by trusted authorities, preventing the installation of compromised or malicious code from unverified packages.
- By disallowing the use of ‘—nogpgcheck’ option, the policy ensures that the infrastructure is not compromised by packages that lack a GPG signature, reaffirming the importance of signature validation for maintaining the security integrity of systems.
- The policy’s implementation through Infrastructure as Code (IaC) promotes reproducibility and reliability of security measures. It allows enforcing based on the code, ensuring that any changes made adhere to the required security standards, reducing the possibility of human error.
- Enforcing this policy enhances traceability as packages without GPG signatures could have been altered or can contain malicious content. Ensuring the verification of all packages used helps establish an audit trail, making it easier to track and rectify potential security incidents.
Ensure that packages with untrusted or missing signatures are not used by rpm via the '--nodigest', '--nosignature', '--noverify', or '--nofiledigest' options
Ensure that packages with untrusted or missing signatures are not used by rpm via the '--nodigest', '--nosignature', '--noverify', or '--nofiledigest' options
- The policy prevents the potential use of malicious or compromised packages within a computing ecosystem by ensuring that only trusted packages with valid signatures are utilized. This enhances system or application security by mitigating risks associated with unauthorized, compromised or maliciously modified software.
- By not allowing the use of ‘—nodigest’, ‘—nosignature’, ‘—noverify’, or ‘—nofiledigest’ options with rpm packages, it ensures the proper verification of package integrity, authorship and authenticity. This reduces the risk of installing broken or tampered software which could lead to system stability issues or data loss.
- This policy enforces package-level security which aids in maintaining the health and integrity of software dependencies. By ensuring all packages come from trusted sources and haven’t been modified in transit or storage, it promotes trust and reliability in the software supply chain.
- It minimizes the risk of cyberattacks due to weak or missing security in packages that could compromise the entire system or data access. This is especially critical for businesses that deal with sensitive or classified information where data leakage or system compromise can lead to heavy financial loss or reputational damage.
Ensure that the '--force-yes' option is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state
Ensure that the '--force-yes' option is not used, as it disables signature validation and allows packages to be downgraded which can leave the system in a broken or inconsistent state
- This policy ensures the integrity and authenticity of packages, as the ‘—force-yes’ option in the dockerfile would otherwise disable signature validation. This could let nefarious or malicious packages into the system, presenting a security risk.
- The rule prevents potential system instability or breakages by avoiding package downgrades. The ‘—force-yes’ option can allow packages to be downgraded, which might introduce errors or inconsistencies, affecting system performance and availability.
- Following this policy aids in maintaining system consistency and predictability by ensuring packages always have proper versions and are from trusted sources, reducing the risk of unpredictable behaviour in complex or critical software systems.
- Adopting this policy can prevent potential compliance issues by ensuring that software packages meet the necessary quality and security standards for use within company infrastructure, preventing potential legal or regulatory implications.
Ensure that certificate validation isn't disabled for npm via the 'NPM_CONFIG_STRICT_SSL' environmnet variable
Ensure that certificate validation isn't disabled for npm via the 'NPM_CONFIG_STRICT_SSL' environmnet variable
- Ensuring certificate validation for npm discourages insecure communications between your application and its dependencies. This helps protect sensitive data during transfer and mitigates risks associated with data interception and decryption.
- By enforcing certificate validation through the ‘NPM_CONFIG_STRICT_SSL’ environment variable, applications are less likely to fall prey to man-in-the-middle attacks, where unauthorized individuals could intercept, alter or spoof npm package installations.
- Disabling certificate validation could allow applications to install dependencies from untrusted or fraudulent sources. Having this policy in place prompts npm to verify the authenticity of the source, ensuring that the packages being installed are from reputable sources only.
- Implementing this policy maintains the integrity of your application’s npm dependencies. If validation is hijacked or disabled, an attacker could install malicious packages that could compromise your application, leading to potential data leakage, system harm, or unplanned downtimes.
Ensure that certificate validation isn't disabled for npm or yarn by setting the option strict-ssl to false
Ensure that certificate validation isn't disabled for npm or yarn by setting the option strict-ssl to false
- This policy ensures that npm or yarn, commonly used package managers, check the security certificates of the packages they install. Setting strict-ssl to false disables these checks, which can leave systems vulnerable to malicious packages.
- By enforcing certificate validation, this rule adds a layer of security that can prevent the execution of malicious code from uncertified packages, reducing the risk of malware infections or breaches.
- The policy guards against man-in-the-middle attacks, in which an attacker can intercept and potentially alter the packages being installed, by ensuring all packages are obtained directly from a trusted source.
- Certificates provide assurance that the code in packages has come from a known source and has not been tampered with. Therefore, disabling certificate validation could lead to installing packages of unknown and potentially harmful origin.
Ensure that certificate validation isn't disabled for git by setting the environment variable 'GIT_SSL_NO_VERIFY' to any value
Ensure that certificate validation isn't disabled for git by setting the environment variable 'GIT_SSL_NO_VERIFY' to any value
- Setting the ‘GIT_SSL_NO_VERIFY’ environment variable to any value disables certificate validation for git. This can lead to severe security issues, as it opens up the door for man-in-the-middle attacks, where attackers can intercept git traffic, potentially gaining access to sensitive code, credentials or other valuable data.
- This policy ensures that all traffic with git is authenticated and encrypted, adding an additional layer of security. It forces git to verify the SSL certificate of the git server, which proves that the server is who it says it is and prevents any unauthorized entity from intercepting the traffic.
- In terms of impact, if unchecked, this can potentially lead to exposure of sensitive information or unauthorized changes to code repositories. It’s important to enforce this policy not only for the protection of the organization’s proprietary code and information but also to prevent any malicious code from being introduced into the codebase.
- By making ‘GIT_SSL_NO_VERIFY’ a required field in the Dockerfile, this policy has the potential to prevent the deployment of Docker containers that don’t enforce SSL verification with git. This is a proactive measure to help catch and mitigate potential security vulnerabilities before they can be exploited.
Ensure that the yum and dnf package managers are not configured to disable SSL certificate validation via the 'sslverify' configuration option
Ensure that the yum and dnf package managers are not configured to disable SSL certificate validation via the 'sslverify' configuration option
- Enabling ‘sslverify’ in yum and dnf package managers is crucial to ensure that the packages you’re installing on your Docker image are secure and from a trusted source. If SSL certificate validation is disabled, it becomes easier for a malicious actor to carry out a successful man-in-the-middle attack, leading to the installation of altered or harmful packages.
- The policy helps prevent breaches. If SSL verification is disabled, malicious software in the form of altered or counterfeit packages can enter your system, creating vulnerabilities hackers can exploit, leading to breaches in security. A breach can lead to exposure of sensitive data, compromising the privacy and security of the organization and its customers.
- Compliance with industry-standard security best practices and regulations can also hinge on SSL verification. This policy ensures adherence to those best practices and reduces the likelihood of regulatory violations which may result in penalties or loss of reputation.
- The policy can greatly reduce the likelihood of downtime due to a security issue. Should a harmful package be installed due to SSL validation being disabled, a service or application may crash or behave unpredictably. Ensuring SSL validation helps maintain the stability and availability of services and applications.
Ensure that certificate validation isn't disabled with pip via the 'PIP_TRUSTED_HOST' environment variable
Ensure that certificate validation isn't disabled with pip via the 'PIP_TRUSTED_HOST' environment variable
- The policy ensures pip, the package installer for Python, validates certificates when installing packages. This inhibits installation of packages from untrusted sources, protecting against malicious code being unintentionally installed.
- This policy mitigates the risk of man-in-the-middle (MITM) attacks. If certificate validation is disabled, an attacker could intercept the data being transferred during package installation and inject harmful code.
- Enforcing this policy guarantees that the infrastructure remains compliant with security and regulatory standards about secure communications and control of software installation sources.
- This policy also reduces the attack surface for the infrastructure. A smaller attack surface can drastically reduce the chances of a security breach or malicious activity, thus saving on costs that could have been incurred due to a security incident.
Ensure that 'chpasswd' is not used to set or remove passwords
Ensure that 'chpasswd' is not used to set or remove passwords
- This policy mitigates the potential security risks by forbidding the use of ‘chpasswd’ in Dockerfiles, which can be exploited by unauthorized users to gain access by setting or removing passwords.
- It helps to maintain a consistent and secure method of managing passwords, by requiring the use of more secure methods for password management, instead of ‘chpasswd’ which can lead to plaintext passwords being added to the Docker image layers and subsequent version control systems.
- By implementing this policy, sensitive credentials are not left in the history of the Docker image or Dockerfile, reducing the potential attack surface for hackers and maintaining the overall security of the infrastructure.
- Ensuring ‘chpasswd’ is not used to set or remove passwords aids in adherence to best practices for Dockerfile security, which increases the security posture of the entire IaC (Infrastructure as Code).
Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters
Ensure Stackdriver Logging is set to Enabled on Kubernetes Engine Clusters
- Enabling Stackdriver Logging on Kubernetes Engine Clusters aids in collecting and storing logs from applications and services, hence facilitating comprehensive and accurate debugging and trouble-shooting for system administrators.
- This policy ensures accountability by tracking and recording user activity within the system thus enhancing the security posture by enabling identification of malicious activity or system misuse.
- Stackdriver Logging provides audit trails for compliance. Without these logs, it would be difficult to prove that the organization is following the procedures and controls it has in place to secure its infrastructure.
- Enabling Stackdriver Logging can also assist administrators in performance monitoring and optimization by recording and analyzing system behaviours, therefore improving overall system efficiency and user experience.
Ensure Google compute firewall ingress does not allow unrestricted ssh access
Ensure Google compute firewall ingress does not allow unrestricted ssh access
- The policy prevents unauthorized access by limiting SSH ingress to only declared IPs, instead of allowing from any source. This thwarts potential unwanted penetration attempts, thus increasing the security of the compute resources.
- Unrestricted SSH access can result in serious data breaches. Limiting SSH access restricts potential attackers from gaining control over the compute resources and accessing sensitive data.
- By enforcing this policy, the chances of internal sabotage are greatly reduced. Even if an internal user’s credentials are compromised, access from unknown, unapproved IPs will still be denied.
- Utilizing Terraform IaC allows the rule to be easily implemented and updated across all GoogleComputeFirewall resources in an infrastructure. This ensures consistency in network security across the entire operation.
Ensure Google compute firewall ingress does not allow unrestricted rdp access
Ensure Google compute firewall ingress does not allow unrestricted rdp access
- This policy helps deter potential unauthorized access and attacks that could exploit Remote Desktop Protocol (RDP) ports, reducing the risk of data breaches and system compromises.
- The enforcement ensures that firewall rules for ingress (incoming) traffic are kept restrictive. Keeping the RDP traffic limited to specific IP addresses or ranges can prevent exposure to attackers.
- Functionally, the policy prevents a common attack vector, by stopping malicious users from gaining access and potentially executing code on vital systems through generally open RDP ports.
- Non-compliance with this policy could lead to uncontrolled access to systems, thus possibly violating various regulatory compliance requirements related to systems and data protection.
Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
- Ensuring no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites improves the overall security posture by mitigating the risk of data breaches or cyber attacks, as weak cipher suites can be more easily cracked or exploited by malicious actors.
- This policy ensures that secure and up-to-date encryption algorithms are enforced during data transmission, thus maintaining the confidentiality and integrity of the data being communicated over the network.
- Using HTTPS or SSL load balancers that do not permit weak cipher suites enhances compliance with various standards and regulations that demand strong encryption measures to protect sensitive data, thus reducing the likelihood of non-compliance penalties.
- Adherence to this policy also strengthens the reputation of the organization by demonstrating a commitment to robust security practices, enhancing customer trust and potentially increasing business opportunities.
Ensure all Cloud SQL database instance requires all incoming connections to use SSL
Ensure all Cloud SQL database instance requires all incoming connections to use SSL
- Enforcing SSL for all incoming connections to a Cloud SQL database instance ensures data privacy by encrypting data during transmission, preventing unauthorized disclosure of information that could result from eavesdropping or tampering the traffic.
- Requiring SSL connections mitigates the risk of man-in-the-middle attacks. Since the policy enforces that data can only be transferred using encrypted connections, attackers cannot intercept the data, altering them, or injecting harmful data.
- Implementing this policy encourages good security practices by ensuring that all users and applications interacting with the Google Cloud SQL database explicitly trust the server’s identity. This prevents connections to rogue or malicious database servers presenting false credentials.
- It enhances compliance with security standards and regulations like PCI DSS and GDPR, which often require data-in-transit encryption. Noncompliance might lead to penalties, affecting the reputation and bottom line of the company.
Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters
Ensure Legacy Authorization is set to Disabled on Kubernetes Engine Clusters
Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters
Ensure Stackdriver Monitoring is set to Enabled on Kubernetes Engine Clusters
- Enables continuous monitoring of Google Kubernetes Engine (GKE) clusters, allowing for immediate identification and response to potential security threats, performance issues, or malicious activity.
- Ensures conformance with best practices and regulatory compliance standards for cloud infrastructure security, which often require real-time visibility into system performance and security status.
- Enhances debugging and troubleshooting of issues in the Kubernetes clusters by providing a record of system logs, metrics, and application events.
- Allows for predictive analysis of system behaviour based on historical performance data, facilitating proactive measures to prevent potential system failures or security breaches.
Ensure 'Automatic node repair' is enabled for Kubernetes Clusters
Ensure 'Automatic node repair' is enabled for Kubernetes Clusters
- Enabling ‘Automatic node repair’ for Kubernetes Clusters enhances the stability and reliability of the clusters. If any node fails health checks over a certain time window, it will automatically be repaired hence reducing downtime, preventing potential disruptions to applications running on the nodes, and ensuring seamless operations.
- This policy helps organizations strike a balance between cost and availability. With automation of repairs via this feature, there is a reduction in the need for constant active monitoring of the nodes and associated costs - while maintaining high availability of the nodes.
- Automatic node repair also increases security as it ensures any corrupted node can be fixed without manual intervention, reducing the exposure time to potential security threats that take advantage of system vulnerabilities in the corrupted nodes.
- The policy agrees with best practices for Infrastructure as Code (IaC) using Terraform in creating self-healing infrastructure. It simplifies automated resource deployment and configuration management, thus reducing the likelihood of human error and increasing operational efficiency.
Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters
Ensure 'Automatic node upgrade' is enabled for Kubernetes Clusters
- Enabling ‘Automatic node upgrade’ for Kubernetes Clusters ensures that the running nodes are always updated with the latest security features and patches, which reduces the chances of a security breach due to an exploit in older versions.
- This policy minimizes the chances of running into compatibility issues between different components of the cluster, as upgrades carried out would be uniform and managed centrally.
- ‘Automatic node upgrade’ is crucial for maintaining the stability of applications running on Kubernetes Clusters as it helps prevent issues that may arise from outdated configurations or software.
- When enabled, this policy eliminates the manual overhead of maintaining and monitoring the upgrade process, potentially reducing human error and improving the efficiency of infrastructure management.
Ensure that Cloud SQL database Instances are not open to the world
Ensure that Cloud SQL database Instances are not open to the world
- Ensuring that Cloud SQL database instances are not open to the world helps to prevent unauthorized access to sensitive data stored in these databases, thus mitigating the risk of data breaches.
- This policy has a significant impact on minimizing the attack surface area for hackers, as only specified IPs and networks will have access to the database, limiting the potential for exploitation.
- Implementing this policy through Infrastructure as Code, using Terraform in this case, allows organizations to automate and control the configurations of their Cloud SQL database instances, streamlining security protocols.
- Violations of this policy can be easily tracked and reported via a Python script in the provided resource link, allowing swift action to rectify potential vulnerabilities and maintain the standards of infra security policies.
Ensure Network Policy is enabled on Kubernetes Engine Clusters
Ensure Network Policy is enabled on Kubernetes Engine Clusters
- Enabling Network Policy on Kubernetes Engine Clusters ensures that every service within the cluster is properly isolated, preventing lateral movement attacks. This leads to increased infrastructure security, safeguarding the systems facilities from unauthorized breaches.
- The policy directly impacts the google_container_cluster entity, specifying rules about how pods communicate with each other and other network endpoints, and hence governs flow of traffic to and from the entity. This guarantees control and management of network traffic for appropriate security levels.
- By using Terraform with the implementation link provided, the infra security policy can be programmatically and consistently enforced, reducing human errors and reducing the security vulnerabilities in infrastructure as code deployments.
- A robust network policy as ensured by this rule greatly minimizes risk of intrusion, data leaks, or malware attacks within a Kubernetes Engine Cluster, providing a secure environment for application hosting and development.
Ensure client certificate authentication to Kubernetes Engine Clusters is disabled
Ensure client certificate authentication to Kubernetes Engine Clusters is disabled
- Enforcing this policy ensures that all communication between Kubernetes Engine Clusters is authenticated solely using modern, more secure methods such as token-based authentication, reducing the risk of unauthorized access through outdated or insecure protocols.
- Client certificate authentication, if enabled, could pose a risk of certificate misuse if the private key is compromised, leading to unauthorized access to the Kubernetes Engine Clusters. Therefore, disabling it improves the overall security posture of the infrastructure.
- The policy impacts how developers and administrators interact with the Kubernetes Engine Clusters, as they need to authenticate using secure methods, leading to better compliance with industry-wide security standards and best practices.
- In the era of Infrastructure as Code (IaC) where Terraform scripts are used to automate deployment and configuration, ensuring that these scripts don’t support client certificate authentication for Kubernetes Engine Clusters can prevent potential security vulnerabilities during the configuration and deployment phases.
Ensure all Cloud SQL database instance have backup configuration enabled
Ensure all Cloud SQL database instance have backup configuration enabled
- Enabling backup configuration in Cloud SQL database instances ensures data resiliency by taking regular automated snapshots of your data, minimizing the risk of data loss in case of accidental deletion, corruption, or other unforeseen events.
- Having a backup configuration in place allows for easier recovery of the system in case of a disaster and ensures business continuity, which can be critical in maintaining operations and financial stability.
- Non-compliance with this policy could potentially be in violation of various regulatory and compliance requirements, such as GDPR, where data protection and recovery capabilities are mandated, potentially resulting in fines and sanctions.
- Data backups serve as an essential layer of security in defending against cyber attacks, such as ransomware, which could encrypt or delete data. Having regular backups ensures you can restore your database to a point before the attack occurred, minimizing disruption and data loss.
Ensure that BigQuery datasets are not anonymously or publicly accessible
Ensure that BigQuery datasets are not anonymously or publicly accessible
- This policy greatly reduces the risk of unauthorized access to sensitive data stored in BigQuery datasets by ensuring accessibility is limited.
- By controlling accessibility, it prevents potential data breaches which can lead to financial and reputational damage to the organization.
- The policy aids in meeting compliance with various laws and regulations about data security and privacy, such as GDPR and HIPAA.
- Implementing this policy via Terraform IaC automates the process and ensures a consistent configuration across all BigQuery datasets, eliminating the possibility of human error.
Ensure that DNSSEC is enabled for Cloud DNS
Ensure that DNSSEC is enabled for Cloud DNS
- Enabling DNSSEC for Cloud DNS increases server security by adding a layer of authenticity verification to DNS responses, which helps to protect against common cyber attacks like DNS spoofing and cache poisoning.
- Implementing this policy contributes to maintaining the integrity of your network infrastructure, ensuring that data transferred within your cloud environment is routed correctly and reducing the risk of data leaks or disruptions to service.
- Using the provided IaC Terraform link, you can efficiently implement and manage your DNSSEC enablement across google_dns_managed_zone entities, promoting robust security resource management within the Google Cloud environment.
- Failing to adhere to this policy could lead to unauthorized domain control due to manipulated DNS responses, potentially allowing malicious attacks and server breaches that could result in significant data loss, financial implications, and damage to company reputation.
Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC
Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC
- The policy ensures that DNSSEC doesn’t use RSASHA1 for zone-signing and key-signing keys, enhancing robustness against threats as this algorithm is less secure and vulnerable to collision attacks, resulting in spoofing and cache poisoning.
- Compliance with this policy aligns with best practices for the security of Cloud DNS DNSSEC by encouraging the use of stronger cryptographic algorithms such as RSASHA256 or RSASHA512.
- By not using RSASHA1 for zone-signing and key-signing keys, companies prevent potential data breaches, enhancing integrity of their DNS records and building trust among users or customers as it minimizes the risk of DNS spoofing.
- This policy has the potential to reduce operational costs over time as prevention of DNS related cyber attacks can avoid expensive system recovery and investigation tasks.
Ensure GKE Control Plane is not public
Ensure GKE Control Plane is not public
- Ensuring GKE Control Plane is not public is important because it restricts unauthorized access from outside entities thus minimizing potential security risks and threats.
- Observing this policy directly impacts the security of Kubernetes operations, as the Control Plane is the main point of administration in a Kubernetes cluster. If exposed publicly, it may lead to compromise of the infrastructure.
- The application of this policy via Terraform ensures Infrastructure as Code (IaC) practices, allowing for automation, consistency, and reproducibility in deployment thereby enhancing the overall security management process.
- It specifically affects the ‘google_container_cluster’ resources, meaning this rule is significant for the security of the Google Kubernetes Engine container clusters and subsequently the applications running within them.
Ensure master authorized networks is set to enabled in GKE clusters
Ensure master authorized networks is set to enabled in GKE clusters
Ensure Kubernetes Clusters are configured with Labels
Ensure Kubernetes Clusters are configured with Labels
- Implementing labels on Kubernetes clusters enables better management and organization of cluster resources. This makes it easy to group related resources for tasks such as batch operations, configuration updates, or visual inspection.
- Using labels drastically improves security monitoring by allowing for quick identification and sorting of different resource types. This can aid in faster threat detection and remediation in the event of a security incident.
- Labels in Kubernetes clusters contribute to cost management strategies. By using labels to categorize resources by function, project or team, you can easily monitor and allocate infrastructure costs accordingly.
- Applying labels to Kubernetes clusters can improve automation and orchestration. Labels can be used to define selection criteria for tasks such as scheduling, replication, and upgrades. This increases the efficiency of automated processes and reduces the risk of manual errors.
Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image
Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image
- Using Container-Optimized OS (cos) for Kubernetes Engine Clusters Node image ensures a lightweight, fast, secure, and reliable operating environment for executing containerized tasks. This can result in improved performance of the cluster and better utilization of resources.
- The Container-Optimized OS has built-in support for Docker and Kubernetes making it compatible with Google Container Engine, reducing setup and installation hassles and ensuring smooth operations.
- This policy is crucial for managing security risks. Container-Optimized OS includes several security features, such as automatic updates to the latest security patches and a read-only file system to ward off potential threats, ensuring the nodes are protected and secure.
- Ensuring the use of Container-Optimized OS can simplify operations and maintenance. Automated updates and image signing capabilities of Cos eliminate the need for manual patching and software management, leading to lower operational overheads.
Ensure Kubernetes Cluster is created with Alias IP ranges enabled
Ensure Kubernetes Cluster is created with Alias IP ranges enabled
- Enabling Alias IP ranges in Kubernetes Cluster enhances network security by allowing the pods to have their own IP addresses which reduces the chance of IP conflicts. This could lead to improved efficiency and reduced downtime.
- With Alias IP ranges enabled, it is easier to apply firewall rules and security policies specifically to certain pods, leading to a finer control over the network security and reducing the potential impact of a compromised pod on the entire cluster.
- Alias IP ranges allow for direct path forwarding which improves connectivity speed between Google Cloud services and the Kubernetes pods. This can potentially improve the performance of applications running in the pods.
- The usage of Infrastructure as Code (IaC) tool Terraform to ensure this rule is implemented, makes it easier to consistently apply this policy across multiple clusters. This leads to scalable, repeatable and automated implementation of this key security provision.
Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters
Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters
- Enabling the PodSecurityPolicy controller on Kubernetes Engine Clusters provides fine-grained authorization of pod creation and updates, ensuring only authorized users can perform certain operations. This contributes to maintaining the overall integrity and security of the system.
- This policy minimizes the risk of potential threats, such as privilege escalation attacks, by enforcing specific security contexts for each pod. It ensures that pods cannot have more privileges than they need to perform their function, thus minimizing their exposure to potential attacks.
- Implementing this policy through Infrastructure as Code (IaC) tool such as Terraform promotes consistent, repeatable deployments, eliminating the possibility of human error in configuration, and strengthening the security stature of the deployment.
- Non-compliance to this policy may lead to unauthorized access to the Kubernetes Engine Clusters and potentially to any application running on them, leading to data breaches, service disruption, and ensuring the PodSecurityPolicy controller is enabled is thus crucial for regulatory compliance and data protection.
Ensure Kubernetes Cluster is created with Private cluster enabled
Ensure Kubernetes Cluster is created with Private cluster enabled
- Enabling private cluster in Kubernetes ensures that the nodes have internal IP addresses only, enhancing the security by not exposing them to the public internet, shielding them from DDoS attacks, and potential vulnerabilities which can be exploited.
- Implementing this policy via Infrastructure as Code (IaC) tool like Terraform enables efficient and reproducible code execution within Kubernetes clusters, facilitating seamless and secure infrastructure deployments and reducing the chances of human error during manual configuration.
- By enforcing this policy specifically for the google_container_cluster resource, it adds an extra layer of protection to data and applications running on Google Kubernetes Engine by leveraging Google’s private network architecture, thereby preventing unauthorized access.
- Not enabling private cluster could expose sensitive information due to potential misconfiguration or neglect, leading to regulatory violations, and reputational loss. Hence, adherence to this policy is crucial for maintaining overall data privacy and potential legal and financial repercussions.
Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network
Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network
- This policy ensures that all network traffic entering and exiting the subnets in a Virtual Private Cloud network is monitored, recorded, and stored for future analysis, providing key visibility for network operations and security teams.
- Enabling VPC Flow Logs can help identify security vulnerabilities, like unauthorized data access or suspicious patterns of behavior, thus improving the overall security posture of the system.
- This policy further assists in troubleshooting connectivity and performance issues within the VPC, which can improve network optimization and enable efficient problem resolution.
- Compliance with this policy is crucial for meeting various regulatory and industry standards related to data privacy and cybersecurity, safeguarding the organization from potential legal and financial repercussions.
Ensure that the default network does not exist in a project
Ensure that the default network does not exist in a project
- Preventing the existence of a default network helps to minimize potential access points for unauthorized users, contributing to a more secure infrastructure.
- It encourages a more granular and customized approach to setting up network configurations, allowing for network settings to be tailored to the specific needs and security requirements of the project.
- Removing default networks reduces the risk of inadvertent security vulnerabilities that can come with pre-configured settings that may not align with the security demands of the project.
- Following this policy can lead to improved organization and manageability of the network resources in the Google projects, as it dispenses with unnecessary or redundant networking elements.
Ensure that Cloud Storage bucket is not anonymously or publicly accessible
Ensure that Cloud Storage bucket is not anonymously or publicly accessible
- This policy prevents unauthorized access to sensitive data stored on Google Cloud Storage by ensuring that data stored in buckets cannot be accessed by anonymous or public users.
- It mitigates the risk of operational disruption and data loss, as only authorized users can modify, delete, or potentially tamper with the data in the restricted buckets.
- It ensures compliance to data privacy regulations by limiting data access only to legitimate users, which reduces the risk of unintentional data breaches and subsequent regulatory fines.
- The adherence to this policy reduces the surface area for potential cyber-attacks and exploits by eliminating public or anonymous access to the stored content, hence keeping your overall cloud infrastructure more secure.
Ensure that Cloud Storage buckets have uniform bucket-level access enabled
Ensure that Cloud Storage buckets have uniform bucket-level access enabled
- Uniform bucket-level access is important as it simplifies access control management for Google Cloud Storage buckets by removing the need to manage individual object permissions. This helps in reducing the overhead and potential for errors in setting object-level permissions.
- This policy is crucial to prevent unauthorized access to data stored in Google Cloud buckets. By enabling uniform bucket-level access, permissions are set at the bucket level, ensuring all objects within a bucket inherit the same permissions, maintaining consistent security standards.
- The policy, implemented via Terraform as an infrastructure coding tool, is scalable and easily reproducible across multiple Google Cloud Storage buckets, ensuring security compliance across larger infrastructures and improved operational efficiency.
- Non-compliance to this rule can lead to serious security vulnerabilities, data breaches, violations of privacy regulations, loss of critical data and could negatively impact the reputation of the company, making it a crucial part of an organization’s cloud security policy.
Ensure that instances are not configured to use the default service account
Ensure that instances are not configured to use the default service account
- Instances using default service accounts have overly broad permissions, causing potential security risks by enabling unauthorized access to GCP resources.
- Restricting the use of default service accounts ensures that only designated privileged users or services can perform sensitive operations, thereby enhancing access control and security.
- Implementing the policy allows for more granular control over instance permissions, promoting principles of least privilege and limiting potential damage from compromised instances.
- Non-compliance with the policy could lead to regulatory penalties in industries with specific data governance rules, such as healthcare or finance, further stressing its importance.
Ensure that instances are not configured to use the default service account with full access to all Cloud APIs
Ensure that instances are not configured to use the default service account with full access to all Cloud APIs
- This security policy is important because using the default service account with full access can lead to potential misuse or abuse, as anyone with access to the instance would essentially have full control over all Cloud APIs.
- The policy ensures least privilege access, which is a key principle in cloud security. Not all applications or instances running on the compute instances need access to all Cloud APIs; therefore, they should only be granted the minimum permissions necessary to perform their function.
- It forces service account segregation and least privilege use, reducing the risk of service account keys being exposed and therefore limiting the potential blast radius if a key is lost or stolen.
- The violation of this policy could potentially expose sensitive data, risk modification of critical resources, or allow unauthorized actions, all of which could have immediate and severe consequences such as process disruption, compliance issues, increased costs or reputational damage.
Ensure 'Block Project-wide SSH keys' is enabled for VM instances
Ensure 'Block Project-wide SSH keys' is enabled for VM instances
- Enabling ‘Block Project-wide SSH keys’ for VM instances reduces the risk of unauthorized access since project-wide public SSH keys cannot be used to log in to instances, therefore providing an additional layer of security.
- It ensures that every access to VM instances is explicitly authorized on a per-instance basis, resulting in better management and tracking of who can access what resources, which is beneficial for audit and compliance purposes.
- By enforcing this policy, organizations can ensure adherence to the principle of least privilege, where every user is given the minimum levels of access necessary to complete their tasks, thereby limiting the potential damage from a compromised SSH key.
- It provides a check against accidental exposure of SSH keys at the project level which can lead to a single point of security failure, hence, it is an important measure towards protection against breaches or unauthorized data access.
Ensure oslogin is enabled for a Project
Ensure oslogin is enabled for a Project
- Enabling oslogin for a Project in Google Cloud Platform ensures that all SSH key management, authorization, and access to instances are taken care of by Google, thereby enhancing the security infrastructure by minimizing chances of unauthorized access.
- The infra security policy confirms the user identity from Google account, in addition to instance-level access, and hence, adds an extra layer of security. This, in turn, helps to proactively mitigate potential cyber attacks.
- The policy also helps with consistent IAM policies across a variety of instance types, eliminating discrepancies and misconfigurations, leading to a more secure and less error-prone infrastructure.
- By enforcing this rule with infrastructure as code (Terraform), automation and uniformity can be achieved, reducing the risk of human errors, saving manual efforts, and ensuring continuous compliance with best practices.
Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances)
Ensure that no instance in the project overrides the project setting for enabling OSLogin(OSLogin needs to be enabled in project metadata for all instances)
- This policy ensures that all instances within a project use the centralized OS Login setting, which simplifies and standardizes access control to the operating system of Google Cloud instances, enhancing security management efficiency.
- The policy helps to prevent possible security breaches resulting from individual VM instances being configured differently, which could potentially create vulnerabilities and add administrative complexity.
- By enforcing OS Login at the project level, every procedural action is auditable. This increases transparency, aids in identifying potential security issues, and simplifies the process of resolving and remediating such issues.
- Non-conformance to this policy could lead to unauthorized access if OS Login is inadvertently disabled on some instances, bypassing centralized access controls and potentially enabling malicious activities.
Ensure 'Enable connecting to serial ports' is not enabled for VM Instance
Ensure 'Enable connecting to serial ports' is not enabled for VM Instance
- Disabling ‘Enable connecting to serial ports’ on VM Instances reduces the attack surface for potential hackers, by preventing unwanted access and modification of data through serial ports.
- Serial ports in VM Instances are often overlooked during encryption practices, making them an easy target for breach. Disabling serial port connections increases the overall data protection enabling secure infrastructures.
- If ‘Enable connecting to serial ports’ is enabled, system logs and potentially sensitive data might be exposed, breaching data integrity and client confidentiality.
- Disabling serial ports reduces the complexity of compliance management. It aligns with industry best practices such as CIS and ISO 27001, which recommend minimizing open communication paths to secure sensitive data.
Ensure that IP forwarding is not enabled on Instances
Ensure that IP forwarding is not enabled on Instances
- Ensuring that IP forwarding is not enabled on instances increases security by limiting the ability of a potential malicious actor to use the instances as a gateway to access other systems or networks, reducing the risk of unauthorized data access or extraction.
- This policy contributes to optimal infrastructure performance as it prevents unexpected network traffic burdens which may occur with IP forwarding, thereby maintaining speed and efficiency of operations within the infrastructure.
- By disabling IP forwarding, every instance in an infrastructure would be isolated from network traffic not explicitly intended for it, increasing the integrity and stability of the infrastructure and reducing the potential for accidental misconfigurations or network issues.
- Applying this policy specifically through IaC tools like Terraform helps maintain uniformity and consistency across all instances, supporting easily reproducible settings and simplifying network management efforts for administrators.
Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)
Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK)
- Encrypting Virtual Machine disks with Customer Supplied Encryption Keys (CSEK) ensures that even if the data on these disks is somehow accessed without permission, it would be unreadable and therefore useless to attackers. This layer of security protects the confidential data of an organization.
- Use of CSEK gives the organization the full control over encryption keys and encryption process. The organization doesn’t need to rely on default keys provided by cloud service provider. This enhances the security of critical Virtual Machines as the encryption keys are not shared or managed by any third party.
- It enhances data protection compliance. For organizations subject to data handling and protection regulations, encrypting VM disks with CSEK can be an important part of their compliance strategy.
- In the event of a data breach, the impact will be significantly reduced as the data exposed would be encrypted. This not only protects sensitive information, but also minimizes the potential damage to the organization’s reputation that can occur in the wake of a data leak.
Ensure Compute instances are launched with Shielded VM enabled
Ensure Compute instances are launched with Shielded VM enabled
- This policy ensures increased security for your compute instances by preventing unauthorized modifications to the boot and kernel. Shielded VMs come with advanced security features like secure boot, vTPM, and integrity monitoring, which confirm the integrity of your instances at every boot-up.
- As infrastructure code relies heavily on automation, any security vulnerabilities can be exploited at scale. By enforcing Shielded VM, the policy mitigates such risks by not allowing potentially harmful modifications and protecting against rootkits and bootkits.
- The enforcement of this policy guarantees a more reliable audit trail. With Shielded VM enabled, the use of virtual Trusted Platform Module (vTPM) ensures that all boots, VM hibernation, and snapshots are logged in Stackdriver Logging, making compliance easily comprehensible and verifiable.
- Since this policy specifically impacts google_compute_instance, google_compute_instance_from_template, and google_compute_instance_template entities, it directly enhances the security of Google Compute Engine, making Google Cloud environments more resistant to threats and unauthorized access.
Ensure that Compute instances do not have public IP addresses
Ensure that Compute instances do not have public IP addresses
- This policy effectively blocks unauthorized access to compute instances, reducing the risk of malicious attacks such as brute force and distributed denial-of-service (DDoS) which target directly reachable public IP addresses.
- It safeguards sensitive data stored in Compute instances as any potential data breach or unauthorized access could lead to exploitation which could be devastating for the organization’s reputation and incur financial losses.
- By enforcing this policy, organizations maintain compliance with various regulations and standards which mandate that internal resources should not be directly exposed to the internet, therefore aiding in legal and industry-specific compliance requirements fulfillment.
- It drives the use of secure VPNs or other proxy networks for access to these instances, promoting secure, internal network usage and reducing potential exposure points in the security infrastructure.
Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level
Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level
- This policy ensures that Identity and Access Management (IAM) users are not provided with potentially excessive permissions, such as the Service Account User or Service Account Token Creator roles, which increases the risk of access abuse with potentially destructive consequences on a project level.
- By enforcing this policy, you limit the potential of privilege escalation, a common attack where unauthorized users gain elevated access rights which can be used to compromise sensitive data or critical systems within the project.
- Limiting the roles of IAM users to specific necessary privileges follows the principle of least privilege, improving the overall security posture of the cloud environment and reducing the attack surface.
- Non-compliance with the policy can lead to security vulnerabilities like unauthorized resource utilization, data breach or loss, due to potentially unrestricted access to service accounts, impacting both the reputation and financial standing of the organization.
Ensure that Service Account has no Admin privileges
Ensure that Service Account has no Admin privileges
- Limiting admin privileges for Service Accounts reduces the potential risk of unauthorized access or misuse within a project, as having excessive permissions can lead to unauthorized changes or data breaches.
- Ensuring Service Accounts do not have admin privileges enables principle of least privilege (PoLP), allowing each component in the system only the permissions it needs to function properly, thereby minimizing damage from errors or breaches.
- The GoogleProjectAdminServiceAccount.py script in Terraform helps implement this policy by checking service account permissions, hence automated checks can ensure continuous compliance with this security policy.
- By applying the policy to the ‘google_project_iam_member’ resource type, it specifically targets and controls IAM permissions at the project level, thus maintaining granular control over account privileges.
Ensure KMS encryption keys are rotated within a period of 90 days
Ensure KMS encryption keys are rotated within a period of 90 days
- Regular rotation of KMS keys within 90 days ensures that encryption keys remain confidential and that any compromised encryption keys are quickly invalidated, thereby reducing the potential damage in case of a security breach.
- The policy encourages a strong security practice as periodic key rotations make cyberattacks more difficult by limiting the amount of data an unauthorized party can decrypt with a single key.
- It helps to comply with regulatory standards and best practices which mandate that encryption keys should be rotated regularly to mitigate risk.
- Infrastructure as Code (IaC) using Terraform allows automated enforcement of this policy, hence reducing human error and increasing the efficiency of managing key rotations for Google KMS encryption keys.
Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level
Ensure no roles that enable to impersonate and manage all service accounts are used at a folder level
- The policy prevents the misuse or compromise of service account privileges, averting the possibility of large-scale unauthorized access or manipulation of sensitive data, as roles that allow impersonation and management of all service accounts at the folder level are high-risk security vulnerabilities.
- It’s designed to enforce the principle of least privilege, allowing users or systems only the access they need to perform a task, reducing the potential surface area for malicious activities.
- By preventing broad role assignment at the folder level, the policy avoids cascading impacts where one compromised account could potentially affect multiple services or data housed within that folder.
- Maintaining this policy is essential for compliance with security best practices and regulations which, if violated, could lead to legal ramifications, or damage to the organization’s reputation.
Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level
Ensure no roles that enable to impersonate and manage all service accounts are used at an organization level
- The policy helps to limit excessive privileges within an organization, mitigating risks associated with misuse, accidental misconfiguration, or attacks. Roles that allow managing all service accounts could grant excessive permissions, increasing the risk of successful attacks or unintentional damages.
- Ensuring no roles that enable to impersonate and manage all service accounts prevents unauthorized and inappropriate access to sensitive data and capabilities, maintaining data security and privacy throughout the organization.
- By enforcing this policy, an organization can adhere to the principle of least privilege (PoLP), granting only necessary access rights to users needed for performing their tasks. This can help reduce the potential attack surface.
- It helps maintain an effective role-based access control (RBAC) model, which ensures clear access boundaries within the organization. This not only enhances organizational security but also facilitates auditing, allowing for easier detection of security breaches.
Ensure Default Service account is not used at a project level
Ensure Default Service account is not used at a project level
- Ensuring Default Service account is not used at a project level prevents unauthorized access to all the resources and services within the project. By limiting the use of service accounts to specific resources, you can apply the principle of least privilege and avoid potential data leaks or breaches.
- This policy reduces the risk of a single point of compromise. If for some reason, the default service account’s credentials were compromised, it could allow an attacker to manipulate or take control of every resource in the project, causing a cascading security issue.
- By enforcing the use of specific service accounts for individual resources or services instead of the default service account, you can maintain better track and accountability over who or what is accessing your resources, which facilitates better auditing and monitoring.
- This policy goes hand in hand with Infrastructure as Code (IaC) practices via Terraform, allowing for efficient and secure configuration management. By defining service accounts in code, you gain the ability to version, review, and automate the service account configuration, leading to more robust and repeatable builds.
Ensure default service account is not used at an organization level
Ensure default service account is not used at an organization level
- Ensuring the default service account is not used at an organization level helps in minimizing over-permissioned interactions, thus reducing potential attack surfaces and enhancing the security posture of your infrastructure.
- Utilizing separate and dedicated service accounts for different functionalities or services can help trace, audit, and control the access and activities more efficiently. This greatly aids in improving transparency and accountability within the organization.
- If the default service account is compromised, it could put your entire organization at risk due to its elevated privileges. Therefore, adhering to this policy minimizes the risk of broad exposure in case of a potential data breach or any other security incident.
- Implementing this policy aligns with the principle of least privilege (PoLP), a key security concept that recommends giving a user or service account the minimum levels of access necessary to perform its function. This assists in reducing the potential damage from unexpected errors or malicious activities.
Ensure Default Service account is not used at a folder level
Ensure Default Service account is not used at a folder level
- This policy ensures that high levels of access aren’t accidentally granted to a default service account, which could allow unauthorized personnel or malicious entities to tamper with critical data and applications stored in Google folders.
- It supports the principle of least privilege in security, which asserts that no user or service should be given more access or privileges than necessary, thus lowering the wideness of a potential attack surface.
- Implementing this policy through Infrastructure as Code (IaC) with Terraform allows for consistent and repeatable security processes, reducing manual error and simplifying enforcement across a large number of resources.
- Through this policy, actions and changes done by service accounts can be better accounted, monitored, and controlled, enhancing auditability and traceability of actions in the event of security incidents.
Ensure roles do not impersonate or manage Service Accounts used at project level
Ensure roles do not impersonate or manage Service Accounts used at project level
- This policy is important because it prevents roles from having excessive permissions that could lead to misuse or unauthorized access to Service Accounts at the project level, enhancing the overall security of the infrastructure.
- Preventing roles from impersonating or managing Service Accounts reduces the risk of compromise from an internal or external actor, as they would be unable to gain unauthorized access through role impersonation.
- The policy ensures that there is a fine-grained access control which upholds the principle of least privilege, meaning roles have the least permissions required to perform their functions, reducing the potential impact of compromises.
- Utilizing such a policy significantly strengthens the auditing trail by limiting unexpected behaviors tied to specific roles and makes it easier to manage and troubleshoot IAM-related issues, enhancing operational efficiency.
Ensure MySQL database 'local_infile' flag is set to 'off'
Ensure MySQL database 'local_infile' flag is set to 'off'
- The policy is critical because if the ‘local_infile’ setting is enabled, there is a potential risk of file reading from the server hosting the database, which can concede unauthorized access to sensitive data.
- Ensuring that the ‘local_infile’ flag is set to ‘off’ limits the risk of any malicious activity from compromising the integrity and confidentiality of data stored in the MySQL database.
- By enforcing this policy via Infrastructure as Code (IaC) tool - Terraform, automated compliance can be achieved, eliminating the need for manual intervention, which can be error-prone.
- This policy primarily applies to ‘google_sql_database_instance’ entity in Google Cloud Platform, helping in maintaining robust security configurations for MySQL database instances on the platform, thus strengthening the overall security posture of applications.
Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on'
Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on'
- Ensuring that the ‘log_checkpoints’ flag is turned on for a PostgreSQL database helps to monitor and track all changes that occur at each checkpoint. This increases the visibility over actions taken in the database.
- Having a log of the checkpoint data is crucial for audits. It provides a history of all transactions and activities within the database, which could prove invaluable in the case of an audit or during investigations into irregular activities.
- Since the log_checkpoints flag allows the archive recovery process to skip over unnecessary data, enabling it can improve recovery speed. This can reduce downtime during disaster recovery operations, maintaining system availability and data integrity.
- The policy applies specifically to google_sql_database_instance entities, meaning it has a direct impact on the security of databases hosted within Google Cloud Platform. Applying it correctly can help protect these databases and maintain adherence to best practices for infrastructure security.
Ensure PostgreSQL database 'log_connections' flag is set to 'on'
Ensure PostgreSQL database 'log_connections' flag is set to 'on'
- Ensuring the ‘log_connections’ flag is set to ‘on’ in PostgreSQL databases helps log every attempt of connection or disconnection, providing detailed audit trails which are crucial for security.
- This policy aids in real-time monitoring and identifying any unauthorized or unusual attempts to connect to the database, allowing immediate response to potential security threats.
- It aids in compliance with various security standards and regulations that mandate tracking and logging of access to sensitive data, thus avoiding potential non-compliance penalties.
- It can also prove beneficial during forensic analysis in case of a security incident as it provides detailed context on whoever attempted to connect to the database and when.
Ensure PostgreSQL database 'log_disconnections' flag is set to 'on'
Ensure PostgreSQL database 'log_disconnections' flag is set to 'on'
- Ensuring the PostgreSQL ‘log_disconnections’ flag is set to ‘on’ will enable detailed logging of all database disconnections, which can help identify and diagnose issues related to unexpected or unauthorized disconnections.
- The implementation of this policy ensures a higher degree of database server security, as it can be used to trace back potential security breaches or attacks utilizing unusual database disconnections.
- The policy, automated through IaC using Terraform, makes it easy to implement this security measure across multiple database instances with consistency, reducing the risk of human error in manual configurations.
- In context to ‘google_sql_database_instance’, it helps in compliance to security best practices specific to Google Cloud by ensuring the presence of this flag in all instances, thus promoting a more secure and resilient Google Cloud infrastructure.
Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on'
Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on'
- This policy is important as it helps in monitoring the database’s health by identifying any potential resource contention. Whenever a report of a transaction waiting longer than deadlock_timeout to acquire a lock, the PostgreSQL database with ‘log_lock_waits’ flag set to ‘on’ will log this incident.
- Implementing this policy aids in the detection of database performance issues. Since PostgreSQL logs instances where a lock is held by a transaction for longer than expected, database administrators can promptly investigate and mitigate such performance bottlenecks thus improving system efficiency.
- The policy promotes data security and integrity. In a scenario where multiple transactions are waiting for a lock due to a deadlock, if not detected and resolved in a timely manner could lead to data inconsistencies or loss. The ‘log_lock_waits’ flag makes deadlock detection easier and thus improves data integrity.
- By leveraging ‘log_lock_waits’, database administrators can carry out pattern analysis over a period of time to identify recurring issues and put preventive measures in place. This proactive approach could potentially increase database availability and overall application performance.
Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value
Ensure PostgreSQL database 'log_min_messages' flag is set to a valid value
- This policy ensures PostgreSQL’s ‘log_min_messages’ flag is set to a valid value, enabling the database to sufficiently log the minimum level of message severity that will be reported, which is crucial for effective security auditing and incident response.
- Setting the ‘log_min_messages’ flag ensures that even less critical messages like info, debug and warning are logged appropriately, which aids in identifying potential security threats and data breaches early, thus ensuring the robustness of the database infrastructure.
- By mandating this policy in Terraform configurations for ‘google_sql_database_instance’, it enforces standardized logging practices across all instances, providing consistent and reliable log data that simplifies log analysis, troubleshooting and detection of anomalous activities.
- If ‘log_min_messages’ is not appropriately set, it could lead to insufficient logging which might make it difficult to diagnose problems or anomalies. This policy thus plays a critical role in maintaining a resilient and secure database environment in Google Cloud Platform.
Ensure PostgreSQL database 'log_temp_files flag is set to '0'
Ensure PostgreSQL database 'log_temp_files flag is set to '0'
- Setting the ‘log_temp_files’ flag to ‘0’ in PostgreSQL database helps in maintaining a log of all temporary files, including those of smaller sizes, thereby providing crucial information on files that could potentially prove harmful or malicious.
- This policy is vital for debugging and troubleshooting, as it allows for tracking of all the temporary files generated during a session, making it easier to identify any potential issues with application or database performance.
- Without this policy, organizations run the risk of untracked temporary files that could be consuming significant resources or contributing to security vulnerabilities, such as a temporary file that unintentionally stores sensitive data.
- Implementing this policy, and automating this compliance verification using Infrastructure as Code (IaC) solutions like Terraform, will allow teams to better handle potential issues in their Google SQL Database instances, enhancing overall system security and performance.
Ensure PostgreSQL database 'log_min_duration_statement' flag is set to '-1'
Ensure PostgreSQL database 'log_min_duration_statement' flag is set to '-1'
- Setting the ‘log_min_duration_statement’ flag to ‘-1’ in the PostgreSQL database prevents the logging of all SQL statements, thereby reducing unnecessary clutter and system overhead associated with extensive logging.
- This policy helps in securing the database as sensitive data present in SQL queries will not be logged, thus reducing the possibility of a data leak or exposure from log files, especially when logs are shared or exported unencrypted.
- By minimizing unnecessary logging, system performance can be improved as databases won’t be excessively occupied with writing logs, freeing up system resources and processing power for other critical operations.
- The policy when enforced, ensures compliance with best practices and standards for database logging. It ensures that the logging control is fine-tuned for avoiding unnecessary details while keeping system performance and security into consideration.
Ensure SQL database 'cross db ownership chaining' flag is set to 'off'
Ensure SQL database 'cross db ownership chaining' flag is set to 'off'
- This policy ensures that ‘cross db ownership chaining’ is disabled, preventing security issues that may result from operations being transferred from one database to another, potentially allowing unauthorized access to data.
- Setting the ‘cross db ownership chaining’ flag to ‘off’ minimizes the risk of SQL Injection attacks, where hackers may exploit ownership chaining to manipulate data in databases owned by the same owner but outside the original operation’s scope.
- This policy promotes least privilege principle by ensuring that a user who has been granted permissions on one database cannot leverage those permissions to access other databases, hence supporting good data governance and reducing the attack surface.
- By enforcing this policy via Infrastructure as Code (IaC) with tools like Terraform, organisations can ensure consistent application across all SQL database instances in Google Cloud, mitigating the risk of human error, and offering an auditable compliance trail.
Ensure SQL database 'contained database authentication' flag is set to 'off'
Ensure SQL database 'contained database authentication' flag is set to 'off'
- Setting the ‘contained database authentication’ flag to ‘off’ can help thwart attacks as SQL server authentication lets the database engine manage user IDs and passwords. In contrast, contained database users make it possible to authenticate users directly inside the database, which may lead to potential security threats if not properly managed.
- By ensuring the flag is set to off, the policy reduces the likelihood of security breaches as it restricts unauthorized users from obtaining direct access to the SQL database. This strategy promotes a defense-in-depth security posture, which is highly recommended in secure database management.
- If the ‘contained database authentication’ is switched to ‘on’, it can potentially bypass server-level firewall rules. Therefore, setting it to ‘off’ is essential to ensure the efficiency and effectiveness of firewall rules in a Google Cloud SQL database instance and avoid unintentional access.
- Enforcing this policy has compliance benefits as well. It helps organizations meet key requirements set out in various data protection and privacy standards such as GDPR, CCPA, or HIPAA that stress the importance of secure access management. This could prevent regulatory penalties and protect the organization’s reputation.
Ensure Cloud SQL database does not have public IP
Ensure Cloud SQL database does not have public IP
- This policy ensures that the Cloud SQL database instances are not accessible by any entity on the internet, a vital measure to protect sensitive data from potential cyber threats, unauthorized access or data breaches.
- Reducing the number of public-facing resources lessens the attack surface and the opportunities an attacker has to compromise a system.
- Implementing this policy would support a principle of least privilege (PoLP) security strategy where only the necessary IPs which need to access the database would be allowed access, limiting exposure to potential security risks.
- Terraform’s Infrastructure as Code (IaC) allows automation of this policy to ensure its consistent enforcement across all the google_sql_database_instance resources, improving the efficiency and reliability of the security process.
Enable VPC Flow Logs and Intranode Visibility
Enable VPC Flow Logs and Intranode Visibility
- Enabling VPC Flow Logs and Intranode Visibility is critical to maintaining a clear and thorough understanding of network traffic patterns within your Virtual Private Cloud (VPC) as it records all IP traffic going to and from the network interfaces in your VPC.
- This policy has a significant impact on security auditing and monitoring as the flow logs can be used to troubleshoot network-related issues, and track network traffic details, including the source and destination IP addresses, packet and byte counts, protocol numbers, and action taken (ACCEPT or REJECT).
- The policy directly impacts the visibility of activity within google_container_cluster entities. It ensures that all incoming and outgoing network traffic within these entities (including those between individual nodes within the cluster) is logged and monitored.
- Utilizing Infrastructure as Code (IaC) tool Terraform to enforce this policy ensures a consistent and reliable application of the rule across different environments and configurations, reducing human error and enhancing the security posture of the Google Kubernetes Engine (GKE) clusters.
Bucket should log access
Bucket should log access
- The policy ‘Bucket should log access’ provides critical insights into any actions performed on the given cloud storage buckets, which helps trace back any unauthorized or malicious activities, leading to potential security breaches.
- Without this policy applied, it would be more challenging to conduct forensic analysis after security incidents, as investigators could lack the essential digital evidence stored in these logs.
- Implementing this policy via Infrastructure-as-Code (IaC) tool like Terraform allows for seamless, efficient, and repeatable logging setup across multiple storage buckets, reducing the chances of human error and ensuring consistent security configuration.
- The policy also supports regulatory compliance requirements that necessitate audit trails and trackable user activities in systems dealing with sensitive or confidential information.
Bucket should not log to itself
Bucket should not log to itself
- Having a storage bucket log to itself can lead to an infinite loop condition where the act of logging generates more logs, potentially causing service disruption due to resource exhaustion.
- If a bucket is compromised and logs to itself, attackers could modify or delete the log data, making incident response and forensic investigations difficult.
- If a bucket logs to itself, any corrupted or erroneous data within the bucket can also impact the integrity and reliability of the logs, potentially leading to inaccurate or misleading log analysis results.
- This policy ensures that logging data is stored separately from the source bucket, enhancing the security and organizational practices, and ensuring that critical log data is not lost even if the original data or bucket is compromised.
Ensure clusters are created with Private Nodes
Ensure clusters are created with Private Nodes
- Ensuring that clusters are created with private nodes enhances the security by limiting the exposure of these nodes to the internet, reducing the risk of attacks from external malicious sources.
- This policy directly impacts cost efficiency by reducing the need for external IP addresses for each node in the cluster, as nodes in private clusters only need internal IP addresses.
- The policy contributes to compliance with many data protection regulations and standards, since the privacy of data is improved as nodes do not have direct exposure to the public internet.
- It also reduces the complexity of managing network access controls, as the traffic between the master and the nodes in the Kubernetes cluster does not leave the Google Cloud by default when configured with private nodes.
Manage Kubernetes RBAC users with Google Groups for GKE
Manage Kubernetes RBAC users with Google Groups for GKE
- Implementing the policy ensures Role-Based Access Control (RBAC) in Kubernetes, improving security by defining who can access which resources and what actions they can perform in the GKE programmatic environment.
- The policy enhances scalability of access control by grouping Google Cloud users in Google Groups for GKE, reducing the operational complexity of managing individual user permissions.
- It enables easier auditing and tracking of permissions across the organization as Google Groups used for RBAC can be monitored, providing enhanced visibility of user actions on the GKE environment.
- The policy, once implemented using Infrastructure as Code (IaC) tool like Terraform, helps in maintaining consistency in deploying RBAC for Google Kubernetes Engines across multiple environments.
Ensure use of Binary Authorization
Ensure use of Binary Authorization
Ensure Secure Boot for Shielded GKE Nodes is Enabled
Ensure Secure Boot for Shielded GKE Nodes is Enabled
- Enabling Secure Boot for Shielded GKE Nodes ensures that only verified and secure software can be executed during the boot process, minimizing the risk of running malicious software unknowingly in your ecosystem.
- This security policy reduces the attack surface, preventing attackers from modifying the boot process to inject malware or gain unauthorized control over the GKE nodes.
- Non-compliance with this policy can expose google_container_cluster and google_container_node_pool entities to infections at the root level, which would compromise the entire cluster, rendering all security measures useless.
- Utilizing Infrastructure as Code (IaC) through Terraform to enforce this policy guarantees uniform application of security standards across all environments, making management and remediation of security threats more efficient and coherent.
Ensure the GKE Metadata Server is Enabled
Ensure the GKE Metadata Server is Enabled
- Enabling the GKE Metadata Server provides an extra layer of security by preventing unauthorized metadata access, a common attack vector. This reduces the risk of credential theft and unauthorized resource access.
- This policy ensures adherence to best security practices and compliance with relevant regulations. Compliance failures could lead to penalties, legal consequences, and reputational damage.
- Particularly in the context of multi-tenant Kubernetes systems, enabling the GKE metadata server restricts users and workloads to only access metadata that they are supposed to, thereby avoiding potential information breaches or leakage of sensitive data.
- The policy directly impacts the google_container_cluster and google_container_node_pool entities, ensuring they are securely configured, thereby enhancing overall infrastructure stability and decreasing the potential for security loopholes and vulnerabilities.
Ensure the GKE Release Channel is set
Ensure the GKE Release Channel is set
- Setting the GKE Release Channel is vital as it determines the version and update frequency of your Google Kubernetes Engine (GKE), ensuring you are running a supported version with the latest security patches.
- Not configuring the GKE Release Channel may lead to using outdated or unsupported versions of GKE, potentially exposing the infrastructure to security vulnerabilities.
- The policy directly impacts Infrastructure as Code (IaC) using Terraform, helping to automate the process of setting the GKE Release Channel in a reliable and consistent manner.
- It ensures the adherence to best practices in managing the lifecycle of GKE clusters, which can reduce operational overhead, minimize the risk of human errors, and improve the security posture of the deployed resources.
Ensure Shielded GKE Nodes are Enabled
Ensure Shielded GKE Nodes are Enabled
- Enabling Shielded GKE Nodes ensures an enhanced level of security for container clusters by protecting against rootkits and bootkits, which could compromise your network’s security.
- Shielded GKE Nodes provide verifiable node identity and integrity, ensuring that the nodes that are part of the cluster are running the correct and approved software, reducing the risks of cyber-attacks.
- The policy benefits the google_container_cluster entity specifically, as it provides a higher level of trust in the nodes of the Google Kubernetes Engine (GKE) cluster, maintaining the fidelity of the workload.
- By implementing this policy using Infrastructure as Code (IAC) through Terraform, the method of enabling Shielded GKE Nodes becomes replicable, consistent and scalable, reducing the potential for human error and enhancing operational efficiency.
Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled
Ensure Integrity Monitoring for Shielded GKE Nodes is Enabled
- Enabling integrity monitoring for shielded GKE nodes ensures that the node’s boot parameters and kernel components are verified and remain uncompromised. This demonstrates compliance with key security controls and best practices for hardening your Kubernetes environment.
- With integrity monitoring on, any deviations from the baseline boot integrity can be flagged and investigated. This prevents unauthorized changes to critical system software that could potentially result in vulnerabilities.
- The monitoring policy helps maintain transparency and auditability of the system, with logged reports available for later analysis. This aids in incident response, root cause analysis, and can help meet regulatory requirements around data integrity and protection.
- The policy can be easily implemented using IaC tools like Terraform, providing a streamlined, scalable solution for maintaining security across multiple GKE nodes without needing to manually configure settings for each node individually.
Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
Ensure Cloud Armor prevents message lookup in Log4j2. See CVE-2021-44228 aka log4jshell
- This policy is essential as it mitigates the risk posed by CVE-2021-44228, also known as the Log4jShell vulnerability, which allows remote code execution by attackers, leading to potential data breach or system compromise.
- Cloud Armor, a defense service provided by Google Cloud, prevents message lookup through Log4j2, securing the logging libraries from being exploited thus safeguarding the integrity and confidentiality of the system and its data.
- Implementation through Infrastructure as Code (IaC) tool ‘Terraform’ allows developers and system administrators to automate the settings and reduce human error while protecting applications or microservices against the CVE-2021-44228 vulnerability.
- The rule ensures that the google_compute_security_policy entity follows this security measure, enhancing collective defense against cyber-attacks and contributing to improved security compliance in Google Cloud environments.
Ensure that private_ip_google_access is enabled for Subnet
Ensure that private_ip_google_access is enabled for Subnet
- Enabling ‘private_ip_google_access’ for Subnet serves to enhance information security by providing private access to Google APIs and services, avoiding exposure to public internet, thereby reducing the risks of data breaches.
- This rule is important as it limits direct interaction with Google services, thereby restricting unnecessary access and potential threats, and enhancing the data integrity and confidentiality.
- By enabling this rule, the network traffic between the VM instances and Google APIs doesn’t go through the internet, improving latency for on-premises users by keeping the traffic private, hence it contributes to the enhancement of network performance.
- This security policy is crucial as it renders the possibility of eavesdropping and data exploitation extremely difficult, hence reducing the risk of compromising sensitive information. This contributes significantly towards the organization’s efforts of regulatory compliance with data privacy standards.
Ensure Google compute firewall ingress does not allow unrestricted FTP access
Ensure Google compute firewall ingress does not allow unrestricted FTP access
- This policy prevents unauthorized individuals from gaining unrestricted access to sensitive information through File Transfer Protocol (FTP). If unrestricted FTP is enabled, it can create a potential entry point for data breach and malicious activities.
- By ensuring this policy, it helps to reduce unnecessary exposure and strengthening of the security posture within the Google compute environment. This in turn reduces the surface area for potential attacks and protects the organization’s resources from attackers.
- By using Terraform (an IaC tool), organizations can operationalize this security check as part of their infrastructure code deployment process. This allows the check to be conducted in an automated, repeatable, and scalable manner, improving operational efficiency and security compliance coverage.
- Non-compliance to this policy could result in violation of data protection laws and regulations, leading to monetary penalties and damage to an organization’s reputation. A breach could also disrupt business operations, causing financial loss and impacting customer trust.
Ensure that Private google access is enabled for IPV6
Ensure that Private google access is enabled for IPV6
- Enabling private Google Access for IPV6 ensures that the subnetwork traffic can access Google services without needing public IP addresses, which reduces the risk of outside attacks and enhances infrastructural security.
- This policy can avoid potential data transfer costs from your Virtual Private Cloud (VPC) network to Google APIs and services since the traffic won’t leave Google’s network, bringing potential cost savings.
- Not enabling private access to Google services for IPV6 may leave communications susceptible to interception and altercations, as data may have to travel over the public internet, compromising the integrity of exchanged data.
- Incorporating this policy as part of Infrastructure as Code (IaC) using Terraform allows for easy and consistent deployment across all network resources, minimizing human error and maintaining consistency.
Ensure Google compute firewall ingress does not allow on ftp port
Ensure Google compute firewall ingress does not allow on ftp port
- This policy prevents unauthorized data access and alteration by blocking the File Transfer Protocol (FTP) port, which is often targeted for cyber attacks due to its lack of built-in security features.
- By ensuring Google compute firewall ingress does not allow FTP port, sensitive data residing on Google Cloud Platform is safeguarded due to the reduced potential for breaches.
- Implementing this policy through Infrastructure as Code (IaC) tool Terraform, allows for consistency and repeatability, ensuring this security measure is uniformly applied across all appropriate entities.
- This policy pertains specifically to the google_compute_firewall resource. Proper implementation can aid an organization in meeting compliance requirements related to secure data transfer and firewall configurations.
Ensure Cloud storage has versioning enabled
Ensure Cloud storage has versioning enabled
- Versioning in Cloud storage is crucial to keep track of and manage all changes made to an object. This policy ensures that every version of an object in the storage is maintained, thereby facilitating immediate recovery in case of accidental deletions or alterations.
- The enforcement of this policy helps to increase data integrity and reliability, as retrieval of any previous version of a file becomes straightforward. This plays a significant role in preventing data loss and maintaining consistency in data operations.
- Without versioning, overwritten or deleted data could lead to irretrievable loss of important information. Enabling this policy not only aids in disaster recovery but also assists in audit management, as it keeps a detailed record of every change in the system.
- Implementing this policy via IaC with Terraform allows for consistency, repeatability, and transparency across infrastructure deployments. It provides infrastructure as code, thereby simplifying resource management, reducing human errors, and expediting the deployment process.
Ensure SQL database is using latest Major version
Ensure SQL database is using latest Major version
- Ensuring the SQL database uses the latest major version is crucial as updates often include crucial security enhancements and patches, reducing vulnerability to attacks.
- Adhering to this policy optimizes the SQL database performance and enhances its features, which can provide a tangible advantage in data handling and processing.
- Non-compliance with this policy can lead to potential data breaches if attackers exploit known weaknesses in outdated versions of SQL databases.
- Implementing this policy directly affects the google_sql_database_instance by ensuring it operates in the most secure, efficient, and feature-rich computing environment available.
Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK)
Ensure Big Query Tables are encrypted with Customer Supplied Encryption Keys (CSEK)
- This policy ensures that sensitive data stored in Big Query tables is completely secure by allowing the customer to have full control over the encryption keys, reducing the risk of unauthorized data access and manipulation.
- Encryption with CSEKs provides an additional layer of data protection which subsequently enhances compliance with various data security standards and regulations, important for businesses handling sensitive client information.
- It mitigates the risk of a potential breach as even if a malevolent entity gains access to the data, they would still need the CSEK to decrypt it, substantially increasing the difficulty and effort for potential data theft.
- Implementing this policy through Infrastructure as Code (IaC) with Terraform ensures consistent and error-free setup across various google_bigquery_table resources, streamlining security management and reducing the chances of configuration errors.
Ensure Big Query Datasets are encrypted with Customer Supplied Encryption Keys (CSEK)
Ensure Big Query Datasets are encrypted with Customer Supplied Encryption Keys (CSEK)
- This policy ensures that sensitive data stored in Big Query Datasets are encrypted with CSEK, thereby enhancing data security by encrypting private data and preventing unauthorized access.
- By enforcing this policy, it is ensured that the encryption keys are under the control of the customer rather than the cloud service provider, providing an additional layer of security and control over the data.
- It maintains compliance with data protection regulations and standards, which often require that data at rest be encrypted using keys that the data owner manages and controls.
- In case of a data breach, encrypted data with CSEK can provide an extra layer of protection, making it more difficult for attackers to access readable information, thereby mitigating potential damage.
Ensure KMS keys are protected from deletion
Ensure KMS keys are protected from deletion
- This policy ensures data security by preventing accidental or unauthorized deletion of KMS keys, which are integral to data encryption and decryption in Google Cloud.
- It helps in maintaining the integrity of encrypted data, as deleting a KMS key might result in permanent loss of access to the data it was used to encrypt, especially if there are no key backups.
- Implementing this policy reinforces compliance with industry and legal standards for data security and privacy, which often stipulate proper key management, including protection from deletion.
- By preventing destruction of the ‘google_kms_crypto_key’ resource using Terraform Infrastructure as Code (IaC), the policy supports reliable infrastructure management by avoiding disruption to services dependent on the KMS keys.
Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK)
Ensure PubSub Topics are encrypted with Customer Supplied Encryption Keys (CSEK)
- This policy ensures that data published to Google PubSub topics is encrypted using Customer Supplied Encryption Keys (CSEK), adding a robust layer of data protection by allowing consumers to manage their keys.
- Not complying with this policy could compromise data security, as default encryption methods might be weaker or less secure, making sensitive information more susceptible to unauthorized access or breaches.
- The use of CSEK for encryption allows clients to retain full control of their encryption keys, which is particularly important for meeting regulatory and compliance needs, thereby further protecting their information from any potential misuse.
- Implementing this policy through Infrastructure as Code (IaC) tool like Terraform promotes automation and repeatability, thereby reducing the risk of manual errors that could leave PubSub topics unencrypted. It helps in maintaining consistent security practices across all PubSub topics.
Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK)
Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK)
- This policy ensures enhanced security by allowing customers to manage their own keys for encrypting Artifact Registry Repositories. It gives customers full control over their data security and encryption settings, preventing unauthorized access or data breaches.
- Use of Customer Supplied Encryption Keys (CSEK) ensures that keys are not shared with Google, enhancing privacy and reducing the likelihood of a security compromise. Even if breaches occur within the service provider, the data remains secure with encryption keys only known to customers.
- The implementation of this policy via Terraform infrastructure as code (IaC) simplifies the encryption process, promoting ease-of-use for customers who might not have extensive expertise in encryption methodologies. It also allows for efficient key management across numerous repositories.
- Enforcing encryption of Artifact Registry Repositories with CSEK within google_artifact_registry_repository resource type reduces risks of sensitive data exposure, providing an added layer of protection for intellectual property, proprietary data, and other critical business information. This minimizes the potential impacts of data loss or theft, safeguarding business interests.
Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK)
Ensure Big Table Instances are encrypted with Customer Supplied Encryption Keys (CSEK)
- This policy ensures the security of data in BigTable instances by encrypting it using Customer Supplied Encryption Keys (CSEK), thereby preventing unauthorized access and protecting sensitive information.
- Implementing this policy reduces the dependence on Google to manage encryption and gives customers more control over their data. It ensures customers can manage their own security and encryption protocols.
- Non-compliance to this policy could lead to potential data breaches, as data could be exposed if the in-built Google encryption keys were compromised, thereby causing reputational damage and potential legal ramifications.
- This policy emphasizes on infrastructure as code (IaC) through the use of Terraform, promoting automation, consistency, and efficiency in operations, avoiding manual errors and enhancing security by establishing a well-defined configuration.
Ensure Cloud build workers are private
Ensure Cloud build workers are private
- Ensuring Cloud build workers are private is crucial for protecting sensitive data of your application, as it prevents unauthorized access and leakage of data during the build process.
- This policy helps to maintain the integrity of your build environment by ensuring that build logs, which can contain critical information such as passwords or encryption keys, are not exposed publicly.
- The policy, when implemented through Infrastructure as Code (IaC) tool such as Terraform, allows for automated checking and enforcement, reducing the probability of human error and increasing the consistency of security policy enforcement.
- If cloud build workers are public, it presents a significant risk of cyber-attacks, such as DDoS attacks or exploits of potential security vulnerabilities in the worker build environment. Therefore, keeping them private directly impacts the overall security posture of your cloud infrastructure.
Ensure Data fusion instances are private
Ensure Data fusion instances are private
- This policy ensures that Data fusion instances are not publicly accessible, preventing unauthorized access to sensitive data and potential data breaches.
- By enforcing this rule via Infrastructure as Code (IaC) with Terraform, automation minimizes human error during implementation, enhancing the overall security of your data.
- Compliance with this policy helps meet requirements of data privacy laws and regulations by limiting data exposure and accessibility only to authorized users.
- Misconfigured Data fusion instances can cause network congestion or performance issues; keeping them private ensures optimal performance, reliability and organization control over network traffic.
Ensure Google compute firewall ingress does not allow unrestricted mysql access
Ensure Google compute firewall ingress does not allow unrestricted mysql access
- Restricting unrestricted MySQL access through Google compute firewall excels in preventing potential unauthorized data access, manipulation, or deletion which could lead to significant data breaches and business disruptions.
- Implementing this policy ensures the security of databases by limiting access to only authorized IPs, thus significantly reducing the surface area for potential attacks like SQL injections or brute-force login attempts.
- The implementation of this policy reduces the risk of data exposure. If the firewall ingress allows unrestricted MySQL access, sensitive data in the databases could be exposed to threat actors over the internet.
- The adherence to this rule makes your infrastructure compliant with several data protection regulations and standards such as GDPR and SOC2, as these standards require limiting unnecessary access to data storage systems, like databases.
Ensure Vertex AI instances are private
Ensure Vertex AI instances are private
- This policy ensures that all Vertex AI instances are set to private, limiting the potential for unauthorized individuals to gain access to sensitive AI workloads and data.
- By ensuring that Vertex AI instances are private, the policy directly enhances the security posture of the AI and ML workflows, helping organizations to comply with regulations concerning data privacy and protection.
- If vertices are not set to private, sensitive data could be exposed, possibly leading to likely breaches that could have severe financial and reputational costs.
- Additionally, suppression of non-private instances can reduce potential threats such as denial of service attacks, brute force attacks or any unanticipated vulnerabilities, thereby bolstering the overall infra security of the system.
Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK)
Ensure data flow jobs are encrypted with Customer Supplied Encryption Keys (CSEK)
- This policy ensures the confidentiality of data processed by data flow jobs by requiring the use of Customer Supplied Encryption Keys (CSEK); this reduces the risk of data exposure or breaches during the data processing stage.
- By supplying and managing their own encryption keys, customers can increase the level of control they have over data protection, adding an extra layer of security against unauthorized access.
- Enforcing this policy via Infrastructure as Code (IaC) with Terraform ensures consistent, repeatable deployments of secure, encrypted data flow jobs across the company’s IT environment.
- Non-compliance with the policy can lead to potential regulatory penalties and reputational damages if sensitive data is compromised due to sub-standard encryption practices.
Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK)
Ensure Dataproc cluster is encrypted with Customer Supplied Encryption Keys (CSEK)
- Encrypting Dataproc cluster with Customer Supplied Encryption Keys (CSEK) heightens data security by enabling the customer to have control over encryption and decryption processes; businesses can therefore manage and monitor access to sensitive data more effectively.
- Without encryption, sensitive data processed and stored in Dataproc clusters is exposed and can be misused if accessed by unauthorized entities, potentially resulting in severe legal and financial repercussions for the business.
- CSEK provides an extra layer of security in case of vulnerabilities in Google’s native data protection, making it harder for potential intruders to gain access to sensitive data, thus mitigating the risks of data breaches and leaks.
- Methodically applying the policy via Infrastructure as Code (IaC) tool like Terraform ensures consistent application of the encryption throughout the entire infrastructure, diminishing the risk of human error and maintaining standardized security practices.
Ensure Vertex AI datasets uses a CMK (Customer Managed Key)
Ensure Vertex AI datasets uses a CMK (Customer Managed Key)
- Ensuring Vertex AI datasets utilize a Customer Managed Key (CMK) is important as it provides an extra layer of data security, enabling the customer to have direct control over the encryption and decryption keys.
- This policy reduces the risk of unauthorized data access, as the encryption keys are controlled by the customer, making it more difficult for potential attackers to access sensitive information stored in the Vertex AI datasets.
- Using a CMK instead of a system-provided key gives the customer more flexibility in key management practices, such as rotation, deletion, and recovery.
- Non-compliance with this policy could result in unencrypted or poorly encrypted data, increasing the vulnerability of the dataset to cyber threats and potentially breaching data protection regulations.
Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK)
Ensure Spanner Database is encrypted with Customer Supplied Encryption Keys (CSEK)
- This policy is important as it allows users to have complete control over their data encryption keys, ensuring that only authorized access is possible to the Spanner Database, increasing data security and reducing the risk of unauthorized access or data breaches.
- The use of Customer Supplied Encryption Keys (CSEK) enhances data protection mechanisms by providing an extra layer of security. If the keys are lost or compromised, Google will not be able to help in data recovery, ensuring that critical information remains only in the hands of the end-user.
- Implementing this policy also allows for greater auditability and compliance with industry-specific regulations that may mandate the use of customer-managed keys, maintaining the organization’s reputation and avoiding expensive lawsuits.
- The customer-supplied encryption process is automated using Terraform Infrastructure as Code (IaC), thereby reducing the chances of human error that could potentially lead to security gaps, making it highly reliable and efficient.
Ensure Dataflow jobs are private
Ensure Dataflow jobs are private
- Ensuring Dataflow jobs are private helps prevent unauthorized access and potential manipulation of sensitive data, thus enhancing data security.
- Private dataflow jobs limit exposure of critical data and application processes to unknown entities, reducing the risk of critical information leaks or system compromises.
- It ensures compliance with privacy standards and data protection regulations, minimizing legal and reputational risks associated with data breaches.
- Implementing this policy with Terraform automates infrastructural security, greatly reducing the possibility of human error that could inadvertently expose sensitive data.
Ensure Memorystore for Redis has AUTH enabled
Ensure Memorystore for Redis has AUTH enabled
- Ensuring Memorystore for Redis has AUTH enabled adds an extra layer of security to the system by requesting users to authenticate themselves before gaining access, thus significantly reduces the chance of unauthorized or malicious access to data.
- With AUTH enabled, the policy prevents possible data breaches or leakage which could occur if unauthorized users gained access to the Redis data. This helps maintain the confidentiality and integrity of the data stored in Redis.
- From a regulatory compliance perspective, organizations may be required to demonstrate that they have implemented adequate access control measures for their data storage systems. Enabling AUTH on Memorystore for Redis helps meet such compliance requirements.
- Failure to enable AUTH could leave the google_redis_instance open to potential exploitation via brute force or dictionary attacks. The policy of enabling AUTH significantly mitigates such risk by adding an authentication step.
Ensure Vertex AI Metadata Store uses a CMK (Customer Managed Key)
Ensure Vertex AI Metadata Store uses a CMK (Customer Managed Key)
- This policy ensures that the Vertex AI Metadata Store, a centralized repository for AI/ML metadata, is encrypted using a Customer Managed Key (CMK), providing an additional layer of security for stored data as the user has complete control over key management.
- In case of a security breach, data stored in unencrypted format can be accessed and misused by unauthorized parties. Encrypting metadata with a CMK can prevent unauthorized access and maintain data confidentiality.
- Encrypting Vertex AI Metadata Store with a CMK allows for enhanced compliance with data protection regulations and standards, as managing your own encryption keys demonstrates a proactive step toward securing on-platform data.
- Without this policy, the default encryption settings could result in less secure key management operations and can open the door for potential security vulnerabilities. Instituting the CMK policy provides an enterprise level control over the encryption and decryption of metadata.
Ensure Memorystore for Redis uses intransit encryption
Ensure Memorystore for Redis uses intransit encryption
- In-transit encryption of Memorystore for Redis helps protect sensitive data from being intercepted and read by unauthorized entities as it moves between the client and the server, thereby reducing the risk of data breaches.
- It ensures compliance with various industry regulations and standards about data security, such as GDPR, HIPAA, and PCI-DSS, avoiding potential penalties or reputational damage that can occur due to non-compliance.
- Google Redis instances without in-transit encryption enabled are vulnerable to data exposure, potentially revealing confidential information to attackers who may take advantage of an unsecured network connection.
- The application of this policy through Infrastructure as Code (IaC) using Terraform aids in achieving a more predictable and consistent security setup by programmatically ensuring in-transit encryption is enabled, reducing the likelihood of human error in the configuration process.
Ensure that Dataproc clusters are not anonymously or publicly accessible
Ensure that Dataproc clusters are not anonymously or publicly accessible
- This policy helps to mitigate potential data breaches by ensuring that only authenticated and authorized users can access Dataproc clusters, preventing unauthorized access from anonymous or public users, thereby enhancing the security of sensitive data processed and stored in these clusters.
- A Dataproc cluster that is publicly accessible can be vulnerable to various cyber threats such as data theft, DDoS attacks, and other malicious activities, thus this rule helps to significantly decrease the attack surface.
- Applying this policy facilitates the principle of least privilege which is a key IT security concept. This ensures that users access only what they need to perform their functions, thus reducing the potential internal threats.
- By leveraging Infrastructure as Code (IaC) tool such as Terraform, it allows developers and administrators to manage and enforce this policy more efficiently across multiple clusters, promote code reuse, and ensure consistency in infrastructure security configurations.
Ensure that Pub/Sub Topics are not anonymously or publicly accessible
Ensure that Pub/Sub Topics are not anonymously or publicly accessible
- This policy prevents unauthorized access to Pub/Sub Topics, ensuring that only authenticated and authorized entities can access the Topics. This mitigates the potential risk of data leaking or getting corrupted and enhances the overall security stance of the system.
- Enforcing this policy ensures that sensitive data transmitted through Pub/Sub Topics is not accessed by anonymous or public users. This is crucial in maintaining data integrity, confidentiality, and protecting the privacy of the data being shared.
- Implementing this policy helps organizations comply with data protection regulations and standards. Non-compliance with these regulations can lead to penalties, reputational damage, and loss of customer trust.
- By using Infrastructure as Code (IaC) tools like Terraform, this policy can be easily and consistently applied across multiple environments, ensuring uniformity in the security configuration, reducing human error, and increasing the scalability of the security posture.
Ensure that BigQuery Tables are not anonymously or publicly accessible
Ensure that BigQuery Tables are not anonymously or publicly accessible
- Ensuring that BigQuery Tables are not anonymously or publicly accessible helps prevent unauthorized data access, providing a vital step in data protection and confidentiality.
- It mitigates the risk of data breaches, as sensitive information contained within BigQuery tables could otherwise be exposed to malicious parties, possibly resulting in costly incidents for the organization.
- Implementing this policy helps to comply with various data privacy legislations like GDPR, HIPAA, where exposure of certain data to the public could result in severe financial penalties.
- Making use of the Terraform tool, the policy ensures infrastructural security on the cloud as it inherently aligns with the principle of least privilege, controlling who has what kind of access at the resource level itself.
Ensure that Artifact Registry repositories are not anonymously or publicly accessible
Ensure that Artifact Registry repositories are not anonymously or publicly accessible
- The policy prevents unauthorized access to sensitive digital artifacts, ensuring that only authenticated users or services can access the software libraries and binaries managed in the Artifact Registry repositories. This enhances the security of the applications and systems utilizing those resources.
- By ensuring Artifact Registry repositories are not publicly accessible, the policy reduces potential attack vectors. This minimally reduces the threat of malicious activities, such as alteration of the software packages or injection of malware.
- Any changes or modifications to the artifacts have to go through the proper pipeline, ensuring that the artifacts are consistent, reliable, and trustworthy. Unauthorized changes could lead to application errors, system crashes, or prolonged downtime which could financially impact the company.
- The policy effectively preserves the integrity and confidentiality of the software artifacts. This is essential to meet various compliance requirements and standards such as the General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), and the Payment Card Industry Data Security Standard (PCI DSS). Failure to comply could result in penalties and loss of customer trust.
Ensure that GCP Cloud Run services are not anonymously or publicly accessible
Ensure that GCP Cloud Run services are not anonymously or publicly accessible
- Ensuring GCP Cloud Run services are not anonymously or publicly accessible helps in protecting the resources and data from unauthorized access or potential cyber threats, thus, enhancing the overall security of the infrastructure.
- By enforcing this policy, only authenticated and authorized entities are able to interact with the Cloud Run services, ensuring that sensitive data isn’t exposed or compromised by unknown or untrusted entities.
- The implementation of this policy through Google’s Identity and Access Management (IAM) ensures that access control is properly maintained and managed, improving the service’s reliability and integrity.
- This policy also helps organizations in meeting compliance requirements associated with data protection and privacy regulations, by preventing public or anonymous access to GCP Cloud Run Services.
Ensure Dataproc Clusters do not have public IPs
Ensure Dataproc Clusters do not have public IPs
- This policy ensures that your Dataproc clusters are not exposed to the public internet, reducing the risk of unauthorized access or malicious attacks on your data processing resources, thereby enhancing the overall infrastructure security.
- Enabling Dataproc clusters to have public IPs could lead to data leakage or allowance of potential exploitable vulnerabilities, due to potential insecure configurations or unpatched systems. This policy mitigates this risk.
- By restricting the allocation of public IPs to Dataproc clusters, this policy enforces a good practice of infrastructure as code (IaC) using Terraform in managing network resources, which leads to better visibility, consistent network configurations, and easier auditing.
- Adhering to this policy not only aligns with best practices of Google Cloud Platform (GCP) but can also help organizations to be compliant with various data protection standards or regulations that restrict the exposure of critical data processing resources to the internet.
Ensure Datafusion has stack driver logging enabled
Ensure Datafusion has stack driver logging enabled
- Enabling Stackdriver logging for Datafusion ensures the collection, storage, and analysis of potentially critical system event data, resulting in enhanced visibility into system operations and helps in maintaining overall infrastructure security.
- It aids in detecting suspicious activities and security breaches within the Datafusion by providing real-time log analytics, which helps in immediate response and mitigates potential damages.
- This logging mechanism also ensures compliance with various regulatory standards, which demand specific logging and audit trails, reducing the risk of non-compliance penalties.
- The Terraform link provided allows for the efficient implementation of this policy, using Infrastructure as Code (IaC) methodologies, resulting in easily replicable and scalable security configurations across different google_data_fusion_instances.
Ensure Datafusion has stack driver monitoring enabled
Ensure Datafusion has stack driver monitoring enabled
- Enabling Stackdriver monitoring for Datafusion helps in tracking the performance, uptime, and overall health of the Datafusion instances, making it easier for administrators to identify any performance issues or disruptions in service.
- With Stackdriver monitoring enabled, you can set up alerts based on specific conditions in Datafusion instances, facilitating prompt response to potential vulnerabilities, threats or malfunctions.
- Without monitoring, there would be no visibility into the operations of Datafusion, which might lead to undetected security vulnerabilities or breaches, hence negatively affecting the reliability and credibility of the service.
- Automated Infrastructure as Code (IaC) checks, like the one linked for Terraform, can help enforce this policy consistently across all Datafusion instances leading to better compliance, less human error, and overall stronger security posture.
Ensure Google compute firewall ingress does not allow unrestricted http port 80 access
Ensure Google compute firewall ingress does not allow unrestricted http port 80 access
- This policy is important as it restricts open access through http port 80 on the firewall, reducing the potential attack surface for those who might want to exploit vulnerabilities or gain unauthorized access.
- It has a direct impact on the overall security of Google Compute instances, given that unrestricted ingress access on port 80 could allow malicious hackers to conduct attacks such as DDoS, Man-in-the-Middle, or other forms of cyber threats.
- Adhering to this policy bolsters defense in-depth practices by applying the principle of least privilege at the network level — only approved entities would get access, and only as much as necessary.
- Implementing the restrictions using IaC tool such as Terraform ensures a consistent and repeatable approach to security configuration, and reduces the likelihood of security errors which may occur due to manual configurations.
Cloud functions should not be public
Cloud functions should not be public
- The policy ensures that cloud functions, which contain sensitive logic concerning the backend processing of an application, are not exposed to the public internet, thus reducing the likelihood of unauthorized access and potential malicious activity.
- By limiting the accessibility of cloud functions, the policy significantly reduces the surface area for cyber attacks like Distributed Denial of Service (DDoS) or code injection, which could disrupt the service or compromise the data security.
- Particularly for the resources like google_cloudfunctions2_function_iam_binding and google_cloudfunctions_function_iam_member, restricting public access inhibits anyone from modifying the role binding and potentially gaining advanced privileges, further enhancing the security posture of the system.
- By enforcing this policy through Infrastructure as Code (IaC) tool like Terraform, organizations can ensure a consistent enforcement across all cloud functions and can easily audit and rectify any non-compliance, thus streamlining the security management across their cloud environment.
Ensure hostnames are logged for GCP PostgreSQL databases
Ensure hostnames are logged for GCP PostgreSQL databases
- Logging hostnames for GCP PostgreSQL databases is crucial in identifying the sources of database traffic, improving traceability of actions, and making it easier to troubleshoot problems related to various hosts interacting with the database.
- Enforcing this policy enforces accountability among users of the database, as all actions can be traced back to their origin, reducing the likelihood of unauthorized or negligent actions being carried out without consequences.
- In a security breach scenario, logs that contain hostname information are instrumental for forensic investigations - they provide valuable information about the origin of attacks and help in identifying patterns that could prevent future breaches.
- As this policy is implemented using Infrastructure as Code (IaC) tool - Terraform, it ensures consistency and speed in rollout across multiple databases, reducing human error and providing better visibility into the infrastructure setup.
Ensure the GCP PostgreSQL database log levels are set to ERROR or lower
Ensure the GCP PostgreSQL database log levels are set to ERROR or lower
- Setting the GCP PostgreSQL database log levels to ERROR or lower ensures that only significant issues that could impact the database’s functionality are logged. This helps in maintaining a cleaner and more manageable log system by eliminating insignificant and potentially confusing information.
- If the log level is set higher than ERROR, the number of logged events can drastically increase, which may lead to difficulties in identifying legitimate issues and potential security threats amongst the abundance of log entries. This policy helps to sift out the noise and highlight just the necessary information.
- By limiting the log levels to ERROR or lower, organizations can enhance their system monitoring and troubleshooting capabilities as they focus their efforts on resolving critical problems that have been identified and logged. This can lead to improved system performance and stability.
- Adherence to this policy is key for compliance purposes. Various regulations and compliance norms demand appropriate logging of database activities. Under-logging or over-logging can both lead to non-compliance situations, thus making the setting of log levels to ERROR or lower an important aspect of regulatory adherence.
Ensure pgAudit is enabled for your GCP PostgreSQL database
Ensure pgAudit is enabled for your GCP PostgreSQL database
- Enabling pgAudit allows for detailed session and/or object audit logging in GCP PostgreSQL database, holding users accountable for their actions in the database.
- This policy helps to ensure data integrity by offering traceability of changes, deletions, and access to the data stored in the PostgreSQL database.
- Compliance with data protection standards (such as GDPR, HIPAA) often requires detailed audit logs; making pgAudit an essential feature to have enabled for businesses dealing with sensitive data.
- Monitoring user activity by enabling pgAudit enhances the detection of potential security threats and allows for timely remediation, improving the overall security posture.
Ensure GCP PostgreSQL logs SQL statements
Ensure GCP PostgreSQL logs SQL statements
- Logging SQL statements in Google Cloud Platform (GCP) PostgreSQL allows administrators to keep a detailed record of all SQL queries executed. This can be useful in identifying problematic queries, troubleshooting database issues, and conducting forensic analysis in case of security breaches.
- This policy support maintains accountability by tracking the actions of individual database users. If an unusual or harmful activity is found, it can be easily traced back to the individual or the process responsible.
- Detecting performance issues or optimizing database operations also become simple with the implementation of this policy as admins can analyze the logs for SQL inefficiencies, long-running queries, or resource-intensive operations.
- The policy also enhances the organization’s compliance posture by ensuring logging capabilities inline with various regulatory standards which demand strict audit logs relating to access, changes, and transactions conducted in the database system.
Esnure KMS policy should not allow public access
Esnure KMS policy should not allow public access
- Ensuring that KMS policy does not allow public access secures your sensitive data by preventing unauthorized users from gaining access to, or tampering with, your encryption keys.
- Restricting KMS policy public access to only authorized entities, such as google_kms_crypto_key_iam_binding, google_kms_crypto_key_iam_member, and google_kms_crypto_key_iam_policy, allows for the necessary control and flexibility in managing who can use or manage your keys.
- A public KMS policy can lead to potential internal or external security breaches, where malicious actors are able to decrypt sensitive information or manipulate encrypted data.
- Using Infrastructure as Code (IaC) tool like Terraform, in combination with scripts like GoogleKMSKeyIsPublic.py, allows for automated enforcement of this policy, thus reducing the risk of human error and strengthening the overall security posture.
Ensure IAM policy should not define public access
Ensure IAM policy should not define public access
- Ensuring IAM policy does not define public access helps in protecting sensitive resources and data from unauthorized external access, increasing the overall security posture of the system.
- Implementing this policy reduces the risk of data breaches and ensures IT compliance, as public access can lead to accidental exposure of sensitive data and identity theft.
- Using terraform to implement this policy allows for efficient and automated deployment across all google_iam_policy entities, reducing the manual management workload for security teams.
- Violation of this policy could lead to potential non-compliance with privacy laws and regulations such as the GDPR and CCPA, which mandate specific standards for data security and confidentiality.
Ensure public access prevention is enforced on Cloud Storage bucket
Ensure public access prevention is enforced on Cloud Storage bucket
- Enforcing public access prevention on Cloud Storage buckets guards sensitive data from unauthorized external access, preserving the integrity, confidentiality, and availability of the stored information.
- This policy helps companies adhere to data protection regulations and standards such as GDPR, CCPA, and ISO 27001, which mandate that businesses take appropriate measures to prevent unauthorized access to personal data.
- It reduces potential attack vectors for cyber threats such as ransomware or DDoS attacks. By limiting public access, it reduces the avenues through which external entities could compromise the integrity of systems or data.
- The policy facilitates monitoring and management of data access. When public access is prevented, it’s easier to track and control who and what can interact with the stored data, improving accountability in the event of a data breach.
Ensure basic roles are not used at organization level.
Ensure basic roles are not used at organization level.
- Ensuring basic roles are not used at the organization level helps in implementing the principle of least privilege, which asserts that a user should have the minimal levels of access that they require to perform their tasks, reducing the potential attack surface for intruders or malicious activity.
- It helps in mitigating the risks of access rights aggregation over time, which can occur when users are assigned basic roles that allow broad permissions, potentially leading to unauthorized access or manipulation of sensitive data.
- This policy checks against assigning overly permissive roles that cut across the entire organization, thereby preventing a single point of failure, as a compromise of a single user’s credentials with such broad permissions could lead to a full-scale breach.
- By avoiding the use of basic roles at an organizational level, organizations can better define and enforce role-specific access protocols, which enhance accountability as it would be easier to trace actions to individual users, hence supporting incident resolution and forensics in case of a breach.
Ensure basic roles are not used at folder level.
Ensure basic roles are not used at folder level.
- The policy aims to prevent the assignment of basic roles at the folder level, ensuring a higher and more granular level of access control. This reduces the risk of unauthorized access and potential security breaches.
- By not using basic roles at the folder level, the policy allows for a more comprehensive and nuanced configuration of user permissions, enhancing the system’s overall security by preventing users from gaining access beyond their respective scope of necessity.
- By enforcing this policy, it more effectively upholds the principle of least privilege, where individuals or processes are given the minimal levels of access or permissions necessary to perform their functions. This again minimizes the risk of accidental or intentional tampering, data loss, or other forms of cyber-attacks.
- Ensuring basic roles are not used at the folder level aids in streamlining the management and trackability of user permissions, making it easier to monitor and adjust security controls when necessary.
Ensure basic roles are not used at project level.
Ensure basic roles are not used at project level.
- The policy of avoiding basic roles at project level is crucial because basic roles have overly broad permissions, which increases the risk of unauthorized access or changes.
- This policy ensures robust fine-grained access control, enabling permissions to be assigned and controlled at a more granular level, thus reducing the chances of privilege escalation.
- By avoiding the use of basic roles, projects can be better protected from potential security vulnerabilities, improving the overall security posture and compliance of the infrastructure.
- The policy greatly supports the principle of least privilege, ensuring that every user, application, or service has no more permissions than necessary to perform its function, significantly reducing the potential surface area for attacks.
Ensure IAM workload identity pool provider is restricted
Ensure IAM workload identity pool provider is restricted
- Ensuring IAM workload identity pool provider is restricted mitigates the risk of unauthorized access as it narrows down the number of identities that can authenticate your resources, limiting potential security breaches.
- This policy specifically applies to Terraform-managed infrastructure, ensuring your IaC conforms to critical security best practices and maintaining trust in your automation processes.
- Implementation of this policy through the provided Python script effectively automates the security checks on your Google IAM workload identity pools, increasing the efficiency of your security implementation process.
- Non-compliance with this policy might infringe regulatory requirements or internal security protocols which might result in financial penalties or the compromising of sensitive data respectively.
Ensure Spanner Database has deletion protection enabled
Ensure Spanner Database has deletion protection enabled
- Enabling deletion protection on Spanner Database decreases the risk of accidental data loss by preventing unintentional deletion of critical databases, thereby helping maintain data integrity and safeguarding business continuity.
- Without deletion protection, malicious actors who may manage to gain access to the system could potentially delete vital databases, leading to irreparable data loss and disruption in business operations.
- This security best practice aligns directly with Infrastructure as Code (IaC) principles, specifically using Terraform. This rule reinforces the application of consistent and repeatable configurations across infrastructure, reducing errors, and enhancing security controls.
- Applying the SpannerDatabaseDeletionProtection.py during Terraform deployments ensures consistent enforcement of this rule across all entities of ‘google_spanner_database’, thus standardizing the security policy across all Spanner databases, reducing the possibility of inconsistency-related vulnerabilities.
Ensure Spanner Database has drop protection enabled
Ensure Spanner Database has drop protection enabled
- Ensuring Spanner Database has drop protection enabled prevents accidental deletion of the database, which can lead to loss of critical data, disrupt business operations and potentially violate compliance standards.
- This rule ensures business continuity as it prevents interruption to services that rely on the data stored in the Spanner Database, which may result from an accidental deletion.
- As per the IaC Terraform, implementing this policy through the linked Python script allows for the scaling of cloud security efforts, by automating the task for every instance of google_spanner_database in the infrastructure.
- Enforcing this policy increases the resilience of the infrastructure to both internal and external threats, guarding against malicious attempts and unintentional human errors leading to deletion of Spanner Databases.
Ensure BigQuery tables have deletion protection enabled
Ensure BigQuery tables have deletion protection enabled
- Enabling BigQuery tables deletion protection prevents accidental deletion of data, aiding in maintaining data integrity and avoiding potential impact on business operations if important data is lost.
- This policy can help organizations comply with data protection regulations, as some laws require certain data to be retained for set periods of time. Unauthorized deletion could result in legal penalties.
- The implementation of this rule via Infrastructure as Code (IaC) tool Terraform allows consistent policy enforcement across all BigQuery tables, reducing human errors and ensuring uniform security measures.
- Protecting the deletion of BigQuery tables increases IT security, as it takes an additional deliberate action to remove data. This may prevent malicious activities or damages from internal or external threats.
Ensure Big Table Instances have deletion protection enabled
Ensure Big Table Instances have deletion protection enabled
- Enabling deletion protection on Big Table Instances helps prevent accidental or unauthorized deletion of key data resources, ensuring the availability and integrity of data for business continuity.
- Without this policy, there could be significant risks including irreversible data loss, which in turn could lead to business disruptions or inability to meet regulatory compliance.
- The policy, implemented via Infrastructure as Code (IaC) using Terraform, allows for consistent enforcement across all Big Table Instances, thus reducing the potential for human errors and inconsistencies.
- It directly impacts the ‘google_bigtable_instance’ resource by adding an extra layer of security, minimizing the potential for cyber-security threats or data breaches that can exploit unprotected resources.
GKE Don't Use NodePools in the Cluster configuration
GKE Don't Use NodePools in the Cluster configuration
- The GKE Don’t Use NodePools policy reduces the risk of potential security breaches by limiting the exposure of nodes’ data within the cluster, making the infrastructure more secure.
- This policy simplifies the management of nodes leading to better configuration control and thus improved security, since less configuration implies fewer doors left open for malicious activities.
- The policy helps in enhancing the overall resilience factor of the google container cluster, by preventing any potential operational issues that might be caused by managing multiple node pools in a GKE cluster.
- Implementation of the rule through Infrastructure-as-Code (IaC) tool like Terraform ensures automation and standardization of security configurations, leading to better, more predictable security outcomes, and reducing any room for human error.
Ensure GKE clusters are not running using the Compute Engine default service account
Ensure GKE clusters are not running using the Compute Engine default service account
- This policy prevents the risk of unauthorized resource access, as the Compute Engine default service account has broad access across Google Cloud APIs, potentially exposing sensitive data or allowing for undesired modifications.
- The enforcement of this policy helps organizations adhere to the principle of least privilege by ensuring that the GKE clusters only have the minimum necessary permissions, reducing the potential attack surface from both internal and external threats.
- Running GKE clusters with a non-default service account enhances traceability and accountability as it allows for each service to be associated with a specific authorized entity, improving event logging and auditing capabilities.
- By ensuring GKE clusters are not running using the default service account, it mitigates the possibility of a breached or compromised default account impacting GKE clusters operations, thereby enhancing infrastructure security and reliability.
Ensure legacy networks do not exist for a project
Ensure legacy networks do not exist for a project
- Ensuring legacy networks do not exist for a project is critical as they often lack the security features and upgrades found in modern networks. This creates vulnerabilities that can be exploited, potentially leading to data breaches or other security incidents.
- Legacy networks may not be compatible with newer technologies or systems. This can hinder the integration of new tools and applications into the infrastructure and cause operational inefficiencies.
- Legacy networks typically have less granular control and visibility, making it harder to manage, monitor, and identify potential threats which can lead to increased risk.
- Implementing this policy using Infrastructure as Code (IaC) using Terraform on Google Cloud Platform can standardize the network infrastructure across different environments, reducing manual oversight and decreasing the chances of human error leading to security risks.
Ensure that there are only GCP-managed service account keys for each service account
Ensure that there are only GCP-managed service account keys for each service account
- Enforcing this policy ensures integrity and security as GCP-managed service account keys are automatically rotated, reducing the risk of keys being compromised and used for unauthorized access.
- As GCP-managed keys can’t be downloaded, it provides added assurance against key theft and mishandling, further strengthening the security of your service accounts.
- GCP-managed keys also simplifies the process of key management auditing, as all keys are centrally managed and controlled, eliminating the need to track individual keys across multiple accounts.
- Non-compliance to this rule can lead to vulnerabilities such as unauthorized data access or modification, disruption of critical operations, and damaging data breaches due to insecurely stored or managed keys.
Ensure that retention policies on log buckets are configured using Bucket Lock
Ensure that retention policies on log buckets are configured using Bucket Lock
- Enforcing retention policies on log buckets using Bucket Lock helps to prevent accidental or malicious deletion of logs, enhancing the safety and integrity of the data.
- This policy ensures that critical log data is immutably stored and available for a predefined timeframe, which is essential for auditing, understanding system behavior, and investigating security incidents.
- It promotes compliance with regulations like GDPR and HIPAA, which often require certain data, like logs, to be kept for a specific amount of time.
- Automating the enforcement of this policy using Terraform scripts makes it a standardized security practice, reducing human error, and ensuring a consistent application across all logging sinks in the Google Cloud Platform.
Ensure that Cloud Audit Logging is configured properly across all services and all users from a project
Ensure that Cloud Audit Logging is configured properly across all services and all users from a project
- This policy ensures that every activity within the project, from all services and users, is logged and properly monitored, thereby providing a comprehensive retrospective view of activities and helping to maintain transparency, accountability, and security.
- It facilitates quicker and more efficient identification, analysis, and remediation of potential security issues or policy violations, thereby reducing the risk and potential impact of security incidents.
- Through Cloud Audit Logging, sensitive information or data breaches can be detected sooner, which can significantly minimise the damage caused by such events and help in regulatory compliance needs.
- The policy also comes with specific configurations for Google Cloud Projects, which provides more control over what types of logs should be kept, thus saving resources by avoiding unnecessary or less useful logging.
Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible
Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible
- Ensuring that Cloud KMS cryptokeys are not publicly accessible helps in preventing unauthorized decryption of data stored in Google Cloud products, thereby increasing the overall data security.
- This policy is crucial to prevent potential data breaches, as the decryption keys are not publicly available and can only be accessed by trusted entities, thus significantly reducing the chances of sensitive data getting compromised.
- Implementation of this policy through Infrastructure as Code (IaC) tool like Terraform ensures consistent and repeatable deployments, reducing human error in manual configurations and improving security and compliance postures.
- This policy also ensures compliance with key regulatory standards, such as GDPR, and industry guidelines, which mandate that any form of data, especially personal and sensitive data, should not be accessible to unauthorized, anonymous, or public entities.
Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges
Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges
- This policy ensures the integrity and confidentiality of data stored in the MySQL database instance by preventing unauthorized access. Not allowing anyone to connect with administrative privileges protects sensitive data from being altered, deleted, or leaked intentionally or unintentionally.
- The enforcement of this rule diminishes the risk of a successful cyber attack. If a cyber attacker gains access to the system, they would not be able to escalate privileges to admin level on the MySQL database, limiting their sphere of influence and potential damage.
- The rule also contributes to compliance with data protection standards and regulations, such as GDPR or HIPAA, which may have specific rules about access control and privilege management. Non-compliance can lead to severe penalties and damage to the organization’s reputation.
- Implementing this policy using Infrastructure as Code (IaC) tool like Terraform enables scalable, repeatable, and consistent configurations across numerous resources. This efficient method minimizes human error and ensures that all google_sql_database_instance and google_sql_user configurations align with this security rule consistently.
Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible
Ensure that Cloud KMS Key Rings are not anonymously or publicly accessible
- This policy ensures the confidentiality and integrity of data by limiting access to Cloud Key Management System (KMS) key rings, helping to prevent unauthorized access, alteration, or destruction of data.
- Abiding by this policy is crucial to adhere to the principle of least privilege, as it only provides key rings accessibility to authenticated and authorized entities, thereby minimizing the risk of data exposure.
- Failure to implement this policy can lead to potential breaches or leaks of sensitive data, posing a significant risk to the organization, possibly causing reputational damage, legal penalties, and loss of customer trust.
- This policy aids in regulatory compliance, as many regulations and internal company policies mandate that sensitive data should not be publicly accessible, ensuring that the organization meets necessary data security standards.
Ensure that Container Registry repositories are not anonymously or publicly accessible
Ensure that Container Registry repositories are not anonymously or publicly accessible
- This policy prevents unauthorized access and potential misuse of sensitive information, as it restricts the availability of Container Registry repositories to only authenticated and permitted users.
- Implementing this policy efficiently mitigates the risk of malicious entities attempting to exploit vulnerabilities in the software stored in the repositories, as they would not have access to these repositories without proper authentication.
- The policy aims to keep the resource implementations (google_container_registry, google_storage_bucket_iam_binding, google_storage_bucket_iam_member) secure, protecting organizational resources from potential security breaches.
- By disallowing anonymous or public access, this policy also helps organizations in complying with various data privacy regulations and standards, thus eliminating legal repercussions.
Ensure GCP Cloud Function HTTP trigger is secured
Ensure GCP Cloud Function HTTP trigger is secured
- Enforcing this policy ensures that only authorized users or applications can trigger the Google Cloud Function, thereby mitigating the risk of unauthorized access and potential exploitation.
- A secured GCP Cloud Function HTTP trigger helps in preserving the integrity of the functions, preventing any unauthorized changes or manipulation, and ensuring the function executes as expected.
- Implementing this policy through Infrastructure as Code (IaC) such as Terraform allows a proactive security management approach. This ensures correctness and consistency in deployment, regardless of the environment.
- Non-compliance to this policy can leave the GCP Cloud Function susceptible to attacks, such as Denial of Service (DoS) or code injection, causing significant disruption to the cloud environment and potential data loss.
Ensure GCP GCR Container Vulnerability Scanning is enabled
Ensure GCP GCR Container Vulnerability Scanning is enabled
- This policy helps in identifying vulnerabilities within the Docker images stored inside the Google Cloud Platform’s (GCP) Container Registry (GCR), enabling companies to ensure their docker images are safe to use and do not pose a threat to their cloud infrastructure.
- Protects and prevents the deployments of applications with a known vulnerability by flagging them during the build process within the container registry, thus providing an additional layer of security in the development lifecycle.
- Implementing this policy with Terraform aligns the Infrastructure as Code (IaC) practices with security measures, enabling automation of vulnerability scanning, ensuring no susceptible Docker images are missed in the manual review process.
- Having this kind of infrastructure security policy enabled helps in keeping up with security compliance requirements set by various compliance programs like ISO, HIPAA, and GDPR, thus ensuring that company’s data and user information are protected and adhering to industry regulations.
Ensure GCP compute firewall ingress does not allow unrestricted access to all ports
Ensure GCP compute firewall ingress does not allow unrestricted access to all ports
- The policy ensures the security of Google Cloud Platform (GCP) applications by limiting the attack surface. If unrestricted access to all ports is permitted, it exposes the applications to many potential security threats, including Distributed Denial of Service (DDoS) attacks, intrusion attempts, and malware.
- This policy enriches the infrastructure-as-code (IaC) process by validating firewall configurations before they are deployed. As a result, it prevents misconfigurations, which are a common cause of security breaches.
- It encourages good practice in firewall management by pushing developers to specify which ports can be accessed, hence minimizing the chances of human error or oversight led security vulnerabilities.
- The policy is designed for ‘google_compute_firewall’ entities. This policy specifically checks for overly permissive firewall rules in GCP compute instances, ensuring that only necessary and secure ingress traffic can access these instances.
Ensure PostgreSQL database flag 'log_duration' is set to 'on'
Ensure PostgreSQL database flag 'log_duration' is set to 'on'
- This policy ensures that the ‘log_duration’ flag is enabled for the PostgreSQL database. This provides a record of the duration of each completed session, which can be valuable in performance tuning and identifying long-running queries.
- Enabling ‘log_duration’ plays a critical role in auditing, as it provides a granular log of all operation durations on the database. This could be crucial in the investigation of any suspicious activity or data breaches.
- Implementing this policy does not only enhance database security but also helps in maintaining compliance in environments where recording of activities on sensitive data is a regulatory requirement.
- With this policy applied via Terraform, the Infrastructure as Code (IaC) approach ensures that the ‘log_duration’ flag gets enabled with each deployment and instantiation of a google_sql_database_instance. This standardizes and automates the security practice, reducing the risk of human error.
Ensure PostgreSQL database flag 'log_executor_stats' is set to 'off'
Ensure PostgreSQL database flag 'log_executor_stats' is set to 'off'
- The ‘log_executor_stats’ flag in PostgreSQL, when set to ‘on’ logs execution statistics for each individual query, which could potentially flood logs and lead to increased storage use or fail the service. Turning it ‘off’ prevents this and maintains the efficient use of resources.
- Keeping this policy ensures that sensitive execution details won’t be stored or shared inappropriately, helping to maintain privacy and confidentiality of the database operations and prevent potential data breaches.
- The logging of each query execution could introduce performance overhead due to the increased amount of I/O operations, potentially slowing down the system. Turning this flag ‘off’ minimizes this risk, improving performance and speed.
- Meeting this policy can help to fulfill compliance requirements as many standards require minimizing the exposure of internal operations details to only necessary levels. Not having detailed execution stats logged aids in meeting these cybersecurity regulations.
Ensure PostgreSQL database flag 'log_parser_stats' is set to 'off'
Ensure PostgreSQL database flag 'log_parser_stats' is set to 'off'
- Ensuring the PostgreSQL database flag ‘log_parser_stats’ is set to ‘off’ prevents unnecessary logging of parser operations, reducing the amount of data stored and potentially improving database performance.
- With ‘log_parser_stats’ disabled, it mitigates the exposure of sensitive information, such as query structures or schema details, that may be potentially captured in the logs, enhancing the database’s security.
- Overuse of ‘log_parser_stats’ can overwhelm the system’s resources, leading to performance degradation. Therefore, turning it off can help maintain high performance and stability in the infrastructure.
- This policy is crucial for enterprises using Infrastructure as Code (IaC) with Terraform, to automate and standardize database configurations across GCP SQL instances, preventing potential human errors in manual configuration.
Ensure PostgreSQL database flag 'log_planner_stats' is set to 'off'
Ensure PostgreSQL database flag 'log_planner_stats' is set to 'off'
- This policy helps in limiting the amount of log output generated by PostgreSQL. This is essential as the ‘log_planner_stats’ flag when set ‘on’, can lead to excessive logging by recording highly detailed planner statistics, which may not be necessary for routine operations and could consume significant database resources.
- By setting ‘log_planner_stats’ to ‘off’, the policy aids in streamlining the data management process. Too much unnecessary data can hinder performance, increase storage consumption, and introduce clutter, which makes it harder to identify and focus on crucial data.
- Compliance with this policy can reduce risks associated with data exposure. Because logs in PostgreSQL may contain sensitive datasets, limiting what is logged can help maintain an optimal security stance, keeping exposure of sensitive or private data to the minimum possible level.
- Implementation of this policy is simplified through the use of Terraform, an Infrastructure as Code (IaC) tool. This enables consistent and repeatable infrastructure deployments, ensuring all PostgreSQL databases are configured with ‘log_planner_stats’ set to ‘off’ and thereby promoting uniformity and predictability across the cloud environment.
Ensure PostgreSQL database flag 'log_statement_stats' is set to 'off'
Ensure PostgreSQL database flag 'log_statement_stats' is set to 'off'
- Ensuring that the ‘log_statement_stats’ is set to ‘off’ in PostgreSQL helps prevent the unnecessary logging of all statement statistics, thereby reducing system load and optimizing performance by avoiding undue processing overhead.
- This setting reduces the risk of exposing sensitive data, as full logs might inadvertently capture and disclose information such as database structure and access patterns, potentially aiding malicious actors in gaining unauthorized access or launching a successful attack.
- It aids in ensuring compliance with various data privacy and security standards, which often require controls to minimize unnecessary data collection and logging, thus helping organizations avoid potential legal fines or business reputation damage.
- By reducing the amount of logged data, it maximizes the available storage space, postpones the need for storage expansions, and reduces costs associated with data storage and management.
Ensure GCP network defines a firewall and does not use the default firewall
Ensure GCP network defines a firewall and does not use the default firewall
- The policy ensures that security controls are tailored specifically to the needs of the GCP network, reducing the likelihood of unnecessary open ports or protocols that could be exploited by attackers.
- By defining a custom firewall rather than relying on the default settings, the organization can control network traffic and create rules that block or allow specific traffic, thereby increasing the security of GCP network.
- Using a default firewall could increase the risk of security vulnerabilities if the default settings are too permissive or not updated regularly. This policy mitigates that risk by enforcing the use of a defined, custom firewall.
- Implementing this policy encourages a best practice approach to network security, fostering proactive management of network traffic, monitoring and continuously improving the security posture of the google_compute_network.
Ensure GCP Kubernetes engine clusters have 'alpha cluster' feature disabled
Ensure GCP Kubernetes engine clusters have 'alpha cluster' feature disabled
- Disabling ‘alpha cluster’ in Google Cloud Platform (GCP) Kubernetes engine clusters helps to prevent the use of alpha features that are not stable and could potentially contain bugs, thereby enhancing the stability of the environments.
- Enforcing this policy ensures that only production-ready features are utilised within the GCP Kubernetes engine clusters, thereby reducing the risks and potential impact on services due to use of unstable features.
- Alpha features are not covered by any Service Level Agreements (SLAs) and their use can lead to unpredictable behavior, outages, or security vulnerabilities. Hence, it’s crucial to have the ‘alpha cluster’ feature disabled as a part of the infrastructure security policy.
- This policy helps to make the infrastructure more reliable and predictable by ensuring that all the enabled functions and services within the Kubernetes clusters are thoroughly tested and vetted before being deployed, leading to better service quality and user experience.
Ensure MySQL DB instance has point-in-time recovery backup configured
Ensure MySQL DB instance has point-in-time recovery backup configured
- Enabling point-in-time recovery backup for MySQL DB instances helps safeguard data against accidental deletion, corruption, or unforeseen circumstances like hardware or application failures. This, in turn, is essential in minimizing the risk of data loss - an issue that could lead to substantial setbacks for the business or operation.
- The policy ensures compliance with best practices for database management and cloud-based operations, thus contributing to a well-structured, efficient, and reliable infrastructure. Non-compliance could lead to inefficient data recovery procedures resulting in extended periods of downtime.
- Point-in-time recovery backup on MySQL DB instances enables seamless restoration of databases to any point within the backup retention period. This offers flexibility and immediacy in data recovery, in case of a need to restore the database state to a specific moment in time.
- With the application of the policy in the context of Infrastructure-as-Code (IaC) using Terraform, automation of the backup configuration is realized. This reduces manual overhead, increases productivity, and ensures consistency across databases since the recovery setup is defined in the infrastructure code.
Ensure Vertex AI instance disks are encrypted with a Customer Managed Key (CMK)
Ensure Vertex AI instance disks are encrypted with a Customer Managed Key (CMK)
- This policy ensures the safeguarding of sensitive information on Vertex AI instances by requiring encryption via a Customer Managed Key (CMK). This greatly reduces the risk of data exposure in case the disks of the instance are accessed maliciously or unknowingly.
- As the key is managed by the customer, it offers a greater degree of control over who can access the data and the circumstances under which the key can be used. This is because user controls the cryptographic keys for the purposes of cloud service encryption and decryption.
- The policy has a direct impact on compliance standards. Many regulations demand data to be encrypted at rest, especially in the cloud. By requiring the use of CMKs for the encryption of Vertex AI instance disks, the policy helps organizations meet the compliance requirements.
- Using Infrastructure as Code tool Terraform for implementing this policy facilitates automation, making it easier to enforce across various resources. This not only saves time but also reduces the chances of manual errors and ensures the consistent application of security practices across the infrastructure.
Ensure Document AI Processors are encrypted with a Customer Managed Key (CMK)
Ensure Document AI Processors are encrypted with a Customer Managed Key (CMK)
- This policy guarantees that Document AI Processors, responsible for handling and processing potentially sensitive documents, are encrypted with a Customer Managed Key (CMK), enhancing data protection measures.
- Encryption with a CMK offers more control and visibility to the customer, as they can manage the encryption and decryption procedures, set rotation policies, disable, enable, or destroy the key as per their security protocols.
- Incorporating this policy can prevent unauthorized data access and potential data breaches, since a CMK is more difficult to compromise due to its customer management aspect.
- Implementing this policy using Infrastructure as Code (IaC) tool like Terraform, allows it to be automatically enforced across the infrastructure, providing consistent security protection and reducing the chances of human error.
Ensure Document AI Warehouse Location is configured to use a Customer Managed Key (CMK)
Ensure Document AI Warehouse Location is configured to use a Customer Managed Key (CMK)
- Ensuring Document AI Warehouse Location is configured to use a Customer Managed Key (CMK) provides an added layer of security and control by allowing organizations to handle their own encryption keys. This implies sifting the accountability of managing encryption keys from the cloud provider to the user, enhancing data protection.
- It helps satisfy certain regulatory requirements. Some regulations mandate that businesses have direct control over their encryption keys, particularly when storing sensitive data. Thereby, using a CMK is vital for compliance with these guidelines.
- The aforementioned policy enables the encryption of stateful data, protecting it from potential threats or attacks. It limits data access only to authorized personnel owning the decryption key, which reduces the risk of data breaches.
- The use of CMKs also provides the capability to revoke an encryption key. This prevents any further data from being written to the warehouse when necessary, providing better management of data access and minimizing the potential damage in case of security incidents.
Ensure Vertex AI endpoint uses a Customer Managed Key (CMK)
Ensure Vertex AI endpoint uses a Customer Managed Key (CMK)
- Ensuring Vertex AI endpoint uses a CMK improves data security because CMKs offer a greater degree of control over encryption and decryption. You can manage your own cryptographic keys, providing an added layer of security to your data.
- This policy restricts unauthorized access to Vertex AI endpoints since the keys are controlled by the customer. Only entities with the proper permissions to use the CMK can access the encrypted data.
- Using Customer Managed Keys for Vertex AI endpoint can help meet compliance requirements. Many industry standards and regulations mandate that certain data be encrypted using keys that the customer has sole access to, and failing to do so can lead to penalties.
- A breach of the CMK-protected Vertex AI endpoint would be more difficult for potential bad actors as they would need access to the specific keys. This makes cybersecurity attacks less likely to succeed, enhancing the overall security posture of your Google Cloud environment.
Ensure Vertex AI featurestore uses a Customer Managed Key (CMK)
Ensure Vertex AI featurestore uses a Customer Managed Key (CMK)
- This policy ensures that Vertex AI featurestore data is encrypted using a Customer Managed Key (CMK), providing an extra layer of security and control as users manage their own encryption keys.
- Adhering to this policy mitigates the risk of unauthorized access and data breaches, as the encryption by CMK adds an additional hurdle for potential intruders.
- The policy aligns with industry-standard guidelines for securing sensitive data, significantly reducing the potential for non-compliance-related penalties or business fallout.
- This policy provides increased transparency and accountability, since the use of a CMK allows for detailed access control and auditing — users can monitor who is using the key and for what purpose.
Ensure Vertex AI tensorboard uses a Customer Managed Key (CMK)
Ensure Vertex AI tensorboard uses a Customer Managed Key (CMK)
- Ensuring Vertex AI Tensorboard uses a Customer Managed Key (CMK) offers the user complete control over the key management, such as creating, rotating, and deleting keys. This allows for more robust security management, and prevents unauthorized access to sensitive data.
- This policy impacts the overall data security strategy by facilitating compliance with regulatory standards that mandate encryption of data at rest with a key that the customer controls. Failure to comply can result in harsh penalties.
- Since Vertex AI Tensorboard is used for machine learning tasks involving sensitive data, having it encrypted with a CMK ensures data confidentiality, integrity and prevents the risk of data breaches.
- Utilizing Infrastructure as Code (IaC) tool like Terraform to enforce this policy helps in maintaining consistent environment configurations, streamlines the process of setting up encryption, and allows to keep track of changes made over time, thereby enhancing overall security posture.
Ensure Vertex AI workbench instance disks are encrypted with a Customer Managed Key (CMK)
Ensure Vertex AI workbench instance disks are encrypted with a Customer Managed Key (CMK)
- This policy ensures that data stored on Vertex AI workbench instance disks is encrypted using a Customer Managed Key (CMK), adding an extra layer of security by allowing owners to control access to their sensitive data.
- The encryption helps protect against unauthorized access to data at rest on the disk, ensuring the confidentiality of the data even if the physical storage medium is compromised.
- Using a CMK allows for more granular control over encryption keys, including control over key rotation, disabling, and deletion, hence enhancing the organization’s ability to manage and control their security posture.
- Adherence to this policy aids in compliance with regulatory or internal policies related to data encryption and reduces the risk of data breaches, thereby protecting the reputation and financial health of the organization.
Ensure Vertex AI workbench instances are private
Ensure Vertex AI workbench instances are private
- This policy ensures that Vertex AI workbench instances are not exposed to the public internet, reducing the risk of external attacks, data breaches, or unauthorized access to AI workloads.
- By mandating private instances, the policy enhances the overall security posture by ensuring that sensitive AI data, proprietary models, and algorithms are confined within a private virtual network.
- Enforcing this policy helps organizations meet compliance mandates that require sensitive data to remain within a specified network boundary, supporting data sovereignty and privacy requirements.
- In case of an inadvertent configuration change, this policy triggers alerts or prevent deployment, thereby acting as a control mechanism against potential security misconfigurations.
Ensure logging is enabled for Dialogflow agents
Ensure logging is enabled for Dialogflow agents
- Enabling logging for Dialogflow agents ensures constant monitoring of agent interactions, aiding in identifying unusual patterns, errors and potential security threats in real time.
- With logging enabled, it provides in-depth insight of the interactions, allowing administrators to optimise the performance, efficiency and security of the agent.
- It maintains compliancy with various regulations, as many regulations require that log data is kept for a certain period of time to conduct audits and ensure transparency.
- Without logging, malicious attacks or system errors can go unnoticed, potentially causing irreversible damage or loss of important data, reinforcing why this policy is necessary for safeguarding the infrastructure.
Ensure logging is enabled for Dialogflow CX agents
Ensure logging is enabled for Dialogflow CX agents
- Enabling logging for Dialogflow CX agents aids in tracking, debugging, and monitoring of all activities and interactions involving the AI service, enhancing the overall security and operability of the system.
- The policy ensures compliance with security best practices and standards, which require the collection of detailed audit logs to identify any potential security threats or breaches and take corrective action promptly.
- This policy could help in preserving audit trails, which are crucial for post-incident investigations, thus enabling organizations to learn from past security incidents and prevent them in the future.
- Implementation of this policy using Terraform as Infrastructure as Code (IaC) tool means that logging can be easily enforced across multiple agents, ensuring consistent application of security policies and reducing potential human error or oversight.
Ensure logging is enabled for Dialogflow CX webhooks
Ensure logging is enabled for Dialogflow CX webhooks
- Ensuring logging is enabled for Dialogflow CX webhooks provides a recorded trail of all events and operations, which can be used for problem-solving and auditing purposes, bolstering the reliability and accountability of systems.
- Logging for these webhooks is essential as it can provide visibility into potential security breaches, unauthorized access, or suspicious behavior, thus acting as an early warning system for potential threats or vulnerabilities.
- In the context of Infrastructure as Code (IaC) using Terraform, infra security policies such as this enable consistent and streamlined compliance with good practices, effortlessly ensuring all deployed resources have the necessary security configurations.
- Without enabling logging in Dialogflow CX webhooks, potential incidents may remain undetected, leading to lapses in security incident response, normal system behavior understanding, and potentially resulting in non-compliance with various regional and sector-specific data regulations.
Ensure TPU v2 is private
Ensure TPU v2 is private
- Ensuring TPU v2 is private helps in enhancing the security of your Tensor Processing Units (TPUs) by keeping them isolated and restricted from public access, which significantly reduces exposure to external threats and vulnerabilities.
- This policy allows you to adhere to best security practices by ensuring private endpoints are used, which allows secure, direct, and private network connectivity between your TPU instances and your applications, bypassing the public internet.
- The implementation of this policy can assist in regulatory compliance where there might be a need for secure and private data processing, further ensuring that sensitive information routed through TPUs isn’t susceptible to interception or unauthorized access.
- By making sure that TPU v2 is private, you’re better able to control and manage access to these processing units, improving your resource management and potentially preventing any misuse or wastage of processing power.
Ensure Vertex AI endpoint is private
Ensure Vertex AI endpoint is private
- This policy ensures data privacy and confidentiality by restricting access to the Vertex AI endpoint to within your private network, preventing unauthorized access from the public internet.
- By keeping the endpoint private, you reduce the attack surface and increase the security of your AI/ML processes which enhances the overall security posture of the system.
- Implementing this policy using Infrastructure as Code (IaC) tools like Terraform allows for repeatable, reliable processes and enables changes to be version-controlled, improving visibility and traceability of the security configurations.
- Enforcing this policy safeguards sensitive data processed by Vertex AI from potential data breaches and supports compliance with regulatory standards related to data protection and privacy.
Ensure Vertex AI index endpoint is private
Ensure Vertex AI index endpoint is private
- Ensuring a Vertex AI index endpoint is private mitigates the risk of unauthorized data access. Without this policy, sensitive data or AI intelligence could be exposed to malicious entities, leading to data breaches or unauthorized usage.
- This policy, which is implemented through Infrastructure as Code (IaC) using a Terraform configuration file, automates the security configuration. Automation can better prevent human error, speeds up deployment, and ensures consistency in the setup across multiple instances.
- The policy specifically references a Google Cloud Platform (GCP) resource type, google_vertex_ai_index_endpoint. By keeping private access to these endpoints, companies protect the integrity of their AI models and datasets by preventing external threats, which could compromise their Artificial Intelligence (AI) strategies or outcomes.
- Making the Vertex AI index endpoints private also ensures that they can be accessed only from within a given VPC network. This limits the exposure of the service to the wider internet, thus reducing the potential attack surface and enhancing the resilience of the infrastructure against intrusion attempts.
Ensure Vertex AI runtime is encrypted with a Customer Managed Key (CMK)
Ensure Vertex AI runtime is encrypted with a Customer Managed Key (CMK)
- Encrypting Vertex AI runtime with a Customer Managed Key (CMK) increases data security by ensuring only authorized users can access the stored data, reducing the risk of data breaches.
- Using a CMK for encryption allows greater control as it permits the customer to manage the lifecycle of the key, including creation, rotation, and deletion, providing superior flexibility and security over Google-managed keys.
- The policy checks for the use of CMKs to encrypt data on Vertex AI using Terraform’s Infrastructure as Code (IaC), maintaining consistency and eliminating the chance of human error in configuring security settings, leading to well-managed and error-free infrastructure.
- A failure to enforce this policy could lead to unauthorized access or data loss, as Google-managed keys may not provide the same level of encryption, control, and security as a CMK does, highlighting the significance of this policy.
Ensure Vertex AI runtime is private
Ensure Vertex AI runtime is private
- Ensuring Vertex AI runtime is private helps restrict unauthorized access, thereby maximizing the protection of your algorithms and machine learning models processed via the Vertex AI platform.
- In the context of the Infrastructure as Code (IaC) tool Terraform, implementing this policy reduces the risk of human error and ensures consistent security standards across your configurations.
- Adhering to this policy mitigates potential vulnerabilities associated with public runtime environments, such as data breaches or exposure of sensitive AI data, hence enhancing compliance with data privacy regulations.
- The policy specifically applies to the google_notebooks_runtime resource, indicating that any sensitive data processed or stored in this resource would be shielded from public access, thus improving the overall security posture of your Google Cloud Platform implementation.
Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables
Ensure ACTIONS_ALLOW_UNSECURE_COMMANDS isn't true on environment variables
- Setting ACTIONS_ALLOW_UNSECURE_COMMANDS to true specifically disables the mechanism to prevent unsecure command execution on GitHub Actions, increasing the potential risk for malicious attacks such as command injection, which could manipulate the system or access unauthorized data.
- Enabling unsecure commands can lead to vulnerabilities, as they might contain flaws or bugs which can be exploited causing disruption or compromise of the integrity and confidentiality of the system.
- If this setting is not strictly enforced, it could potentially open up the deployment environment to access by unverified third-party sources, indirectly increasing the chance for unauthorized access or manipulation of sensitive user data.
- It ensures that close screening of every action and command that is processed can take place, upholding a high level of security policy enforcement, and reducing the likelihood of adverse events occurring within the system architecture.
Suspicious use of curl with secrets
Suspicious use of curl with secrets
- This policy is designed to prevent illicit exploitation of sensitive system data by detecting and halting suspicious use of ‘curl’ with cloud secrets, thus mitigating any potential security threat posed by unauthorized data access or manipulation.
- By implementing this policy, an organization can forbid the execution of cloud jobs that unknowingly or intentionally use ‘curl’ with secrets, eliminating the risk of secret leakages, which could result in severe data breaches or system vulnerabilities.
- The policy also significantly improves the accountability and traceability of operations involving secrets, as it encourages developers and operators to handle secrets more securely and consciously, potentially deterring unintended system inconsistencies and errors.
- Compliance with this policy ensures enhanced security of the Infrastructure as Code (IaC) with respect to its GitHub actions, maintaining its integrity and reliability, and preventing any disruption in the service due to misuse of secrets in jobs and steps.
Found artifact build without evidence of cosign sign execution in pipeline
Found artifact build without evidence of cosign sign execution in pipeline
- This policy is important as it seeks to ensure that all artifacts built in a continuous integration/continuous delivery (CI/CD) pipeline have undergone the Cosign sign execution. Without this check, potentially malicious or compromised code could make its way into production.
- The policy serves as a line of defense against unauthorized changes to source code. This is accomplished by checking for digital signatures and validating the integrity of artifacts, to verify that they have not been tampered with during the build process.
- The importance of this policy is also underlined by how it promotes accountability and traceability. With evidence of cosign sign execution for each artifact, it becomes easier to track changes back to the source, which is critical in event of an incident investigation or audit.
- In terms of impact, the absence of this policy could expose any entities involved in the CI/CD pipeline (in this case, ‘jobs’) to risk, potentially allowing undetected alteration or introduction of code, leading to security vulnerabilities in the final product.
Found artifact build without evidence of cosign sbom attestation in pipeline
Found artifact build without evidence of cosign sbom attestation in pipeline
- This policy ensures that all artifact builds are accompanied by an SBOM (Software Bill of Materials) attestation. Such an attestation provides a detailed record of the components, libraries, and modules that make up a software artifact, thereby offering critical visibility for auditing and vulnerability tracking.
- Non-compliance with this policy may compromise the traceability of artifacts within the software development process. If artifacts are built without SBOM attestations, it becomes challenging to diagnose potential issues as there is no clear record of the components used.
- The policy reduces the risk of using potentially vulnerable or compromised software components in an artifact. If all builds are mandated to have signed SBOM attestations, it drives developers to consciously verify their component sources and not use unverified or high-risk libraries.
- By enforcing this policy, entities maintaining security in jobs on GitHub Actions also foster accountability and standardization in the software development process. This allows for better management of deviations or anomalies that could impact infrastructure security.
The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
- This policy ensures that the integrity of the build process is maintained by limiting the control of the build output to the build entry point and the top-level source location. This way, unauthorized modifications to the build process by altering user parameters are prevented.
- By requiring GitHub Actions workflow_dispatch inputs to be empty, this policy eliminates the chances of unwanted or unsafe code from being injected into the build output. Such code could contain vulnerabilities that would compromise the security of the produced software.
- This policy directly contributes to the implementation of least privilege principle in infrastructure security, where each user or process should have the least permissions required to perform its tasks, reducing potential damage from accidents or malicious attacks.
- By enforcing this rule, there is an increased traceability and control over build processes, allowing for easier auditing and ensuring only approved and known components are included in a build, thereby increasing overall trust in the deployed software.
Ensure top-level permissions are not set to write-all
Ensure top-level permissions are not set to write-all
- The policy reduces the risk of malicious activities or accidental changes since it prevents any user from changing top-level permissions to ‘write-all’, which would grant them the ability to modify any data or configurations.
- It guides towards the enforcement of the least privilege principle, which stipulates that individuals should only be given the minimal level of access needed to fulfill their responsibilities. This ensures security integrity by minimizing the potential attack surface.
- By restricting write-all permissions at top level, it isolates the possible impact of a compromised account or a malicious insider. This means only the permissions allocated to the compromised account would be at risk and not the entire infrastructure.
- The policy facilitates more effective auditing and accountability as it enforces granular permissions. Each user’s actions can be monitored and traced back to them individually, rather than being masked under a general write-all permission.
Ensure GitHub repository is Private
Ensure GitHub repository is Private
- Ensuring a GitHub repository is private enhances security by limiting who can view and contribute to the codebase, thus reducing the risk of unauthorized code alterations or data breaches.
- Accessibility to a Private GitHub repository is administered by permissions, which can be easily managed to control who can see, clone, fork, or download the repository’s content, offering granular control over one’s projects.
- Private repositories provide a safe environment for proprietary and trade secret programs or codes, data, and information to be stored and accessed by only authorized entities, therefore protecting intellectual property.
- By restricting repository access, potential risks from exposing sensitive data such as API keys, passwords, configuration details, or critical system info in plain text are significantly reduced, aiding in compliance to data privacy standards.
Ensure GitHub repository webhooks are using HTTPS
Ensure GitHub repository webhooks are using HTTPS
- Ensuring GitHub repository webhooks use HTTPS is crucial for data security during transmission, as it encrypts the data, preventing any unauthorized interception or modification.
- Without this policy, sensitive information being transferred through webhooks, such as source code, could be vulnerable to man-in-the-middle attacks, potentially leading to security breaches.
- Implementing this rule helps organisations comply with various data protection regulations and cybersecurity standards that mandate secure data transmission protocols like HTTPS.
- If HTTPS is not used, the connection between the GitHub repository and the server where the webhook sends the data will be unsecured, and might negatively affect user trust and the business reputation.
Ensure GitHub repository has vulnerability alerts enabled
Ensure GitHub repository has vulnerability alerts enabled
- Enabling vulnerability alerts on a GitHub repository allows for automatic detection and notification of any potential security threats in the repository’s dependencies, providing early warning and prevention of potential exploits before they occur.
- This security policy has a direct impact on the proactive risk management of the repository by allowing timely response to threats, contributing to the overall security hygiene and helping to maintain the integrity of the data and code in the repository.
- It minimizes disruption by reducing the risk of critical system failures or potential data breaches caused by unresolved vulnerabilities, ensuring continuous, stable, and secure operation of applications and systems using the repository.
- Through Infrastructure as Code (IaC) using Terraform, this policy ensures a seamless, automated and consistent application of the security setting across multiple repositories, eliminating human error and supporting efficient management of large volumes of repositories.
Ensure GitHub Actions secrets are encrypted
Ensure GitHub Actions secrets are encrypted
- Ensuring GitHub Actions secrets are encrypted is crucial to protect sensitive data, such as API keys, environment variables, and other critical credentials, from being exposed or accessed by unauthorized individuals or systems.
- By enforcing encryption, the policy provides an additional layer of security that makes it harder for cyber attackers to access the secrets even if they break through other security safeguards.
- Implementing this policy through Infrastructure as Code (IaC) tool like Terraform can improve efficiency and reduce human error in manual tasks, by automating the encryption of secrets across all GitHub Actions environments.
- The named entities, github_actions_environment_secret, github_actions_organization_secret, and github_actions_secret, suggests that the policy affects different levels of GitHub Actions, hence its importance in maintaining organization-wide data security and integrity.
GitHub pull requests should require at least 2 approvals
GitHub pull requests should require at least 2 approvals
- This policy is important because it ensures code quality and maintains the integrity of the software project. Requiring at least 2 approvals minimizes the risk of mistakes, unpolished code, or even malicious code making it into the main branch.
- The policy promotes a collaborative and systematic approach to code reviews, which can uncover bugs, security vulnerabilities or other issues that one person might overlook, enhancing the overall security and functionality of the software.
- It brings double-checking and oversight into the workflow, encouraging team members to take responsibility for the code they are contributing to and learn from each other’s reviews, fostering a culture of continuous learning and improvement.
- As this policy is enforced on the Infrastructure as Code (IaC) tool Terraform, it further emphasizes the importance of having secure and reliable infrastructure code. Incorrect infrastructure code can lead to significant issues such as data breaches or loss of service, making the two-approval policy crucial for solidifying infrastructure security.
Ensure GitHub branch protection rules requires signed commits
Ensure GitHub branch protection rules requires signed commits
- Enforcing signed commits in GitHub branch protection rules helps ensures the authenticity and integrity of the code changes. Only the authorized users who possess the private key can sign the commits, reducing chances of unauthorized or malicious activity.
- This policy can prevent attacks such as man-in-the-middle where third parties may try to inject malicious code changes. With signed commits, any alterations to commit data would be evident.
- The application of this policy brings traceability and accountability to code changes. Since each signed commit has metadata about who made the changes, it creates a reliable, verifiable history of the project’s development.
- Non-compliance with this policy could lead to regulatory repercussions in industries where code integrity and source verification are compulsory, such as healthcare or finance. Ensuring signed commits can thus assist in meeting regulatory standards.
Ensure each Repository has branch protection associated
Ensure each Repository has branch protection associated
- The policy guarantees that every repository has branch protection, discouraging direct code changes without any review and hence, prevents unintentional modifications, deletions or corruptions of the codebase.
- Through regulating code changes via pull requests, branch protection enhances the quality and security of the code by allowing only tested and reviewed code to be merged, thus averting possible vulnerabilities in the tech environment.
- It supports compliance with internal and external security standards as well as best practices, thus reinforcing the organization’s cybersecurity posture and creating fewer opportunities for a security breach.
- By enforcing a segregation of duties, the policy ensures auditing of all changes made, providing a transparent track of code alterations, which aids in swift and accurate pinpointing and reversing of undesired changes.
Ensure GitHub organization security settings require 2FA
Ensure GitHub organization security settings require 2FA
- The policy ensures that Two-Factor Authentication (2FA) is enforced, adding an extra layer of security, thereby significantly decreasing the probability of unauthorized access.
- It guards against credential theft by hackers since they would need both the account password and access to the owner’s authenticated device to gain entry.
- For companies or projects with numerous collaborators, this policy ensures that weak or compromised accounts are not the weakest link, thereby protecting all of the organization’s repositories.
- By mandating this policy, it contributes to demonstrating adherence to regulatory security standards and best practices that often recommend or require usage of 2FA.
Ensure GitHub organization security settings require SSO
Ensure GitHub organization security settings require SSO
- Enforcing Single Sign-On (SSO) in GitHub organization security settings enhances security by ensuring only authenticated users with company credentials can access the organizations’ repositories, thereby preventing unauthorized access.
- This policy promotes secure practices by encouraging the use of SSO, which consolidates user authentication into one managed point, reducing the likelihood of phishing attacks and other password-related security breaches.
- It helps in access management, as the organization can control the user access permission centrally and efficiently. It not only simplifies the user access process but also helps in promptly removing any user access when required.
- Implementing this policy can greatly improve compliance with industry regulations that require strict authentication standards, such as the General Data Protection Regulation (GDPR) or the Health Insurance Portability and Accountability Act (HIPAA), thus preventing potential legal penalties or loss of customer trust.
Ensure GitHub organization security settings has IP allow list enabled
Ensure GitHub organization security settings has IP allow list enabled
- Enabling IP allow list for GitHub organization security settings strengthens the security by restricting access to only trusted IP addresses, thus preventing unauthorized access from unknown IP addresses.
- The policy helps eliminating the risks of data breaches and cyber attacks as it prevents potential intruders or malicious actors from exploiting the organization’s GitHub repositories from unlisted IP addresses.
- Implementing this policy enhances access management within the GitHub infrastructure. It ensures that access to critical resources is controlled and limited to only approved and authenticated users.
- Non-compliance with this policy might mean the organization’s codebase is susceptible to unauthorized changes, including destructive alterations and data theft, potentially risking business continuity and the organization’s reputation.
Ensure GitHub branch protection rules does not allow force pushes
Ensure GitHub branch protection rules does not allow force pushes
- Force pushes can overwrite the history of the repository, which could result in lost commits. This policy ensures that repository history is preserved, facilitating traceability and auditing.
- Disallowing force pushes helps prevent accidental overwrites of code project branches, therefore maintaining the integrity and consistency of the codebase.
- The policy reduces the risk of unauthorized modifications by regulating force pushes, thus enhancing the repository’s security by making it harder for potential adversaries to manipulate the code.
- By preventing force pushes, this policy minimizes code conflicts between developers, improving team collaboration and efficiency in utilizing the repository.
Ensure GitHub organization webhooks are using HTTPS
Ensure GitHub organization webhooks are using HTTPS
- This policy ensures that communication between the GitHub organization and the server handling webhook events is encrypted, protecting sensitive information from being intercepted during transmission.
- It helps ensure compliance with data protection regulations that require secure transmission of data over networks, avoiding potential legal and regulatory penalties.
- Implementing this policy reduces the risk of man-in-the-middle attacks, where an attacker intercepts and potentially alters the data being sent via the webhook.
- By using HTTPS, the integrity and confidentiality of the information being sent via the webhooks is protected, which could be crucial for maintaining the security of the GitHub organization’s overall infrastructure.
Ensure GitHub branch protection rules requires linear history
Ensure GitHub branch protection rules requires linear history
- Ensuring GitHub branch protection rules require linear history helps prevent history rewrite on branches by disallowing force pushes and merge commits. This reduces the risk of accidentally overwriting work, preserving the integrity of the codebase.
- This policy aids in maintaining clear and understandable project history, as each commit is separate and sequential. It becomes easier for the team to navigate through the history, investigate issues, and understand the progression of changes in the project.
- Requiring linear history also puts checks on potentially malicious actors. Should an unauthorized person gain access, they could not conveniently rewrite or delete history, thereby providing a level of security against tampering, theft of intellectual property or introduction of harmful code.
- Adhering to this policy also ensures compliance with best practices for version control. It enhances transparency and accountability, as team members can see who made what changes when, which can be crucial in a large project, or where auditing and regulatory compliance are important considerations.
Ensure 2 admins are set for each repository
Ensure 2 admins are set for each repository
- This policy ensures dual oversight in the management of each repository, which eliminates singular dependency, encourages collaboration, and reduces the risk of any individual maliciously altering the repository.
- The implementation of two administrators per repository prevents situations where an individual admin is unavailable or leaves the organization, ensuring there’s always another person with the necessary permissions to handle necessary actions.
- Enforcing this policy strengthens the overall security of the repository, as any potential breaches or unintended changes need to go past two trusted individuals instead of one, making compromise more difficult.
- Since the policy is implemented via an Infrastructure-as-Code (IaC) tool, it allows for automated checks and enforcement. This automation increases operational efficiency, and ensures consistent adherence to security best practices across all repositories.
Ensure branch protection rules are enforced on administrators
Ensure branch protection rules are enforced on administrators
- The policy ensures that even administrators, who typically have more privileges, adhere to necessary workflow rules thereby promoting consistency across all levels of development and maintaining standards of coding practice.
- It prevents unintentional mistakes or malicious activities by limiting any direct changes to the codebase, including the master/primary branches, without review, which can potentially compromise the software’s security.
- Implementing this policy helps reduce the risk of code conflicts or incorrect merges, as all changes must go through a defined process regardless of user role, thereby ensuring the stability and reliability of the code.
- By enforcing branch protection rules on administrators, it leads to increased accountability and traceability in case of any issues or conflicts, as each change must go through the check and balance of pull requests and approvals.
Ensure GitHub branch protection dismisses stale review on new commit
Ensure GitHub branch protection dismisses stale review on new commit
- Dismissing stale reviews on a new commit ensures that all approved changes are relevant to the most recent commit, increasing overall code quality and minimizing the chance of merging outdated or irrelevant code.
- By requiring review of new commits, this security policy encourages continuous feedback and collaboration among the team, focusing efforts on the most current changes.
- The policy helps to maintain the integrity of the development process by preventing unnoticed changes in the codebase since the last review, ensuring that all changes are consciously approved, lowering the risk of including vulnerabilities, bugs, or flawed design.
- Enforcing this policy provides an automatic control mechanism to ensure review decisions are refreshed with each commit, creating a consistent and strong development and deployment process.
Ensure GitHub branch protection restricts who can dismiss PR reviews
Ensure GitHub branch protection restricts who can dismiss PR reviews
- This policy ensures that only authorized users can dismiss Pull Request (PR) reviews, minimizing the risk of unauthorized changes being implemented into the primary codebase, thus maintaining the integrity and quality of the code.
- Unauthorized dismissal of PR reviews may introduce vulnerabilities in the code that can be exploited, which could potentially lead to a security breach. Having this policy in place helps prevent such scenarios.
- It contributes to the traceability and accountability of changes made to the codebase. This is crucial for post-incident investigations and auditing as it allows tracking of actions back to individual users.
- By ensuring the policy is effectively implemented, organizations can adhere to recommended secure coding practices, leading to improved compliance with the required development and security standards.
Ensure GitHub branch protection requires CODEOWNER reviews
Ensure GitHub branch protection requires CODEOWNER reviews
- This policy ensures that modifications to code are only approved by recognized CODEOWNERS on GitHub; this aids in preventing unauthorized changes or addition of potentially harmful/erroneous code to the project repository.
- By requiring CODEOWNER reviews, it adds an additional layer of protection against malicious efforts to compromise the repository and reduces the risk of introducing vulnerabilities into the codebase, enhancing the security of the project.
- This policy fosters accountability among developers and maintainers, as it is known who has executed the review and approved the changes. This can be critical in tracking and resolving any future issues related to changes in the code.
- With this policy, potential programming errors and bugs are more likely to be identified and corrected during the review process, which can significantly improve code quality and reduce troubleshooting efforts in the future.
Ensure all checks have passed before the merge of new code
Ensure all checks have passed before the merge of new code
- Ensuring all checks have passed before the merge of new code helps to prevent introducing bugs, vulnerabilities, or other issues into the main codebase, safeguarding the integrity and functionality of software applications.
- It standardizes the development process and encourages a thorough review and validation of code, driving quality, consistency, and maintainability of the software.
- Preventing merges until checks pass can also simplify troubleshooting and debugging by enabling problems to be identified and resolved in isolated development branches before they reach the production code.
- The policy supports a safer continuous integration/continuous deployment (CI/CD) practice by automating code review checks, reducing the risk of human error, and speeding up the development cycle.
Ensure inactive branches are reviewed and removed periodically
Ensure inactive branches are reviewed and removed periodically
- The policy ensures that stale and unused code branches, which may harbor security vulnerabilities, are regularly cleaned up to maintain a tidy and updated codebase, reducing the potential attack surface for hackers.
- Regular review and removal of inactive branches can also free up computational resources, improve system performance, and minimize the potential of accidental deployment of outdated or insecure code.
- This policy fosters better team collaboration and minimizes confusion by ensuring everyone is working on the most recent and relevant code branches, thereby reducing possibilities of code conflicts and errors.
- The policy aids in maintaining code repository health as it promotes code manageability and traceability, which is crucial for understanding the code’s evolution and debugging issues.
Ensure GitHub branch protection requires conversation resolution
Ensure GitHub branch protection requires conversation resolution
- This policy ensures that all discussions and disputes related to code changes are resolved before changes are merged into the main branch. This helps maintain code integrity and reduces the chance of introducing faults due to unresolved programming disagreements.
- It helps foster more effective collaboration among contributors, as it forces relevant parties to reach a consensus about code changes. This can lead to higher quality code and fewer reworks.
- This policy mitigates risks associated with hastily merging changes that could affect the functionality or security of the production environment. By requiring conversation resolution, developers are made to thoroughly review and discuss potential changes.
- Implementing this policy can enhance project traceability, making it easier to understand the evolution and context of the project over time, as there is a clear record of discussions and decisions related to every code merge.
Ensure GitHub branch protection requires push restrictions
Ensure GitHub branch protection requires push restrictions
- This policy ensures that only certain individuals or teams who have been explicitly given permissions can push changes to a protected branch, thereby mitigating unauthorized code changes and protecting the integrity of the code.
- It helps maintain the quality of the code base. With push restrictions, there won’t be any unnecessary or erroneous modifications introduced into the code by unauthorized contributors, reducing the chance of bugs or system failures.
- It enforces review processes, as unauthorized contributors can still propose changes via pull requests, but those changes must be reviewed and approved by an authorized individual before merging, ensuring a proper check on the changes.
- It reinforces the security of your repository since malicious actors, even if they gain access to a valid contributor’s account, would still not be able to push damaging code directly if they are not among those with push privileges to protected branches.
Ensure GitHub branch protection rules does not allow deletions
Ensure GitHub branch protection rules does not allow deletions
- This policy prevents accidental or malicious removal of critical branches in a GitHub repository, safeguarding important codebase and historical data.
- By disallowing deletions, it maintains the integrity of the project’s version control history, facilitating better tracking of changes and debugging of any code issues.
- It ensures a continuous integration and deployment pipeline by preserving necessary branches linked to production or staging environments and preventing unexpected automation failures due to deleted branches.
- The policy aids in maintaining compliance with organizational or industry standards pertaining to codebase protection and data loss prevention, avoiding potential penalties and reputation loss.
Ensure any change to code receives approval of two strongly authenticated users
Ensure any change to code receives approval of two strongly authenticated users
- The policy ensures that a second set of eyes has reviewed all code changes, significantly lowering the chances of errors or malicious code being introduced into the codebase inadvertently.
- It requires that two trusted, authenticated users affirmatively approve any code changes, strengthening the verification process and adding an additional security layer.
- The policy effectively enforces segregation of duties within the software development process, minimizing the potential for a single user to make unauthorized or harmful changes.
- By requiring dual approval for code changes, the policy promotes heightened vigilance, fosters a culture of peer review and shared responsibility, and mitigates potential risks associated with insider threats.
Ensure open git branches are up to date before they can be merged into codebase
Ensure open git branches are up to date before they can be merged into codebase
- The policy ensures that all changes made in the main codebase are integrated into the open branch before it gets merged. This eliminates any inconsistencies or conflicts that could disrupt the build or functionality of the application.
- Adhering to the policy fosters better collaboration among developers. It ensures that everyone is working with the most recent version of the code, preventing overlapping work and confusion due to merging outdated branches.
- It significantly reduces the risk of introducing security vulnerabilities into the codebase. By ensuring the open branches are up to date before merging, outdated or potentially insecure code gets updated with the latest security patches and fixes.
- This policy promotes an efficient code flow management, making it easier to track changes, find bugs and maintain the integrity of the code over time, which enhances the overall reliability of the product.
Ensure public repository creation is limited to specific members
Ensure public repository creation is limited to specific members
- This policy restricts the creation of public repositories only to certain members, which mitigates risk by ensuring sensitive or critical code is only shared publicly by authorized individuals who understand the implications.
- This measure helps prevent unintentional data leaks that could occur if unauthorized individuals inadvertently publish sensitive information in a public repository, potentially resulting in both privacy and security violations.
- Enforcing the policy can help organizations maintain compliance with regulations about data handling and security, as it provides a level of control over who can expose data and code to the public.
- With this policy in place, companies can better manage and track their open-source contributions and public-facing code base, contributing to clear and efficient oversight and accountability.
Ensure private repository creation is limited to specific members
Ensure private repository creation is limited to specific members
- This policy safeguards sensitive company information by ensuring that only authorized individuals can create private repositories. Unauthorized repository creation can lead to data leakages and present significant security risks.
- It helps in the enforcement of access control principles, permitting certain members to initiate repositories based on their roles and responsibilities. This reduces the risk of accidental or intentional misuse of repositories.
- By limiting repository creation to certain members, the policy establishes a control point for auditing and governance. It thus simplifies review processes and makes it easier to trace any problems back to their source.
- The policy creates an additional layer of defense against malicious internal activity and external attacks, offering protection in case of compromised credentials. Entities with limited access can create less damage, thereby improving the overall security posture of the organization.
Ensure internal repository creation is limited to specific members
Ensure internal repository creation is limited to specific members
- This policy helps in mitigating the risks associated with unauthorized internal repository creation, like inadvertent exposure of sensitive information or proprietary code, by limiting the ability to create internal repositories to designated members only.
- By controlling who can create internal repositories, it ensures a more streamlined, organized, and secure approach to source code management; unnecessary or duplicate repositories can be minimized, improving the infrastructure’s overall integrity.
- It enables a proactive approach to security as it prevents potential breaches from the outset, as opposed to dealing with the consequences of a breach once it has occurred.
- This policy can aid in compliance with various data security regulations and standards by demonstrating a commitment to limiting access to sensitive data, which for many organizations, source code falls under.
Ensure minimum admins are set for the organization
Ensure minimum admins are set for the organization
- Ensuring minimum admins are set for the organization is crucial for maintaining strict access control, as an excessive number of admins could lead to a higher risk of exposed vulnerabilities or accidental changes that could disrupt the system.
- This policy mitigates issues of potential information breach or cyber attack. If a large number of admins have unfettered access, it increases the chances of exploiting the infrastructure, especially if a team member’s credentials are compromised.
- This policy helps uphold the principle of ‘Least Privilege’, where each user should only be given the bare minimum access they need to perform their tasks. This reduces the potential damage from human error, insider threat, or compromised account.
- Implementing minimum admin policy using Infrastructure as Code (IaC) approach and tools like GitHub, allows for standardization, automation and versioning control of the access rights, reduces admin overhead, and increases the security of the organization’s infrastructure.
Ensure strict base permissions are set for repositories
Ensure strict base permissions are set for repositories
- The policy ‘Ensure strict base permissions are set for repositories’ helps prevent unauthorized access to the codebase, protecting sensitive information and the integrity of the project.
- Applying strict base permissions limits the potential for accidental or unintentional changes to the codebase, ensuring that only authorized individuals have the ability to modify the repository.
- This policy promotes good security hygiene by establishing a clear delineation of power within the project team. This can be useful in the event of a security breach as it gives a clear picture of access and modification rights.
- Having strict base permissions in place for repositories helps to ensure compliance with best practice and regulatory requirements around data and infrastructure security, thereby reducing the risk of penalties or damage to the company’s reputation.
Ensure an organization's identity is confirmed with a Verified badge Passed
Ensure an organization's identity is confirmed with a Verified badge Passed
- The policy ensuring an organization’s identity is confirmed with a Verified badge provides a layer of credibility and trust. Users interacting with the organization on platforms like GitHub can be assured that the organization is legitimate.
- This policy minimizes the risk of phishing attacks or other security concerns, as external entities will not be able to pose as the organization without the Verified badge.
- Enhancing confidence among collaborators and potential partners, this policy could lead to increased cooperation and effective teamwork on projects, given the reduced risk of breaches and increased trust.
- The policy, implemented as part of the ‘github_configuration’, allows for better governance and accountability within the organization’s digital spaces. This contributes to effective security management and incident response.
Ensure all Gitlab groups require two factor authentication
Ensure all Gitlab groups require two factor authentication
- This policy mitigates the risk of unauthorized access, as two-factor authentication provides an extra layer of security beyond just the standard username and password credentials. Unlawful access to GitLab groups can lead to alterations of the code repository, changes to project documentation, and other detrimental impacts.
- The policy ensures that even in the event one’s password is compromised, the intruder cannot get into the system without the second form of authentication, thereby reducing the possibility of a successful breach.
- Enforcing two-factor authentication on all GitLab groups minimizes the risk of internal threats. A disgruntled employee with access credentials can’t make unauthorized changes if they are unable to pass the two-factor check.
- Adherence to this policy can serve as evidence of strong security practices during audits and regulatory evaluations, bolstering an organization’s reputation and trustworthiness in its commitment to protect its information assets.
Suspicious use of curl with CI environment variables in script
Suspicious use of curl with CI environment variables in script
- The policy helps to prevent unauthorized data exfiltration by detecting inappropriate or malicious use of curl command in Continuous Integration (CI) scripts which could be used to send sensitive data to remote servers.
- It serves as a safeguard against potentially harmful actions that could be performed in a CI environment, such as the execution of arbitrary codes or commands, that could take advantage of environment variables and cause significant damage to the system.
- With the improper use of curl in CI scripts, an attacker could alter the CI environment, leading to faulty builds, messed up deployment processes, or compromise of the entire application that relies on the CI pipeline.
- Implementation of this policy can prevent severe security breaches that could lead to loss of data, loss of system control, and reputational damage to the entity due to potential public exposure of vulnerabilities and subsequent malicious activities.
Avoid creating rules that generate double pipelines
Avoid creating rules that generate double pipelines
- Creating double pipeline rules in gitlab_ci can lead to unnecessary resource consumption as two pipelines running in parallel perform duplicate work. This could adversely impact system performance and cause delays in task execution.
- Double pipelines can increase the risk of conflicts or errors, especially if they are altering the same data or resources simultaneously. This could potentially lead to data loss or corruption.
- This policy promotes best practices for infrastructure as code by ensuring efficient and effective usage of resources. Adhering to this policy leads to cleaner, more manageable, and more sustainable codebase, reducing the complexity of managing the infrastructure.
- Violating this policy can result in an inefficient and costly CI/CD process. Frequent triggering of pipelines can consume build minutes unnecessarily, thereby incurring additional costs. It might also slow down the development process by causing longer wait times for build and deploy jobs.
Detecting image usages in gitlab workflows
Detecting image usages in gitlab workflows
- This policy is essential for improving security by identifying and managing the use of images in Gitlab workflows, which can potentially harbor vulnerabilities that can be exploited by malicious hackers.
- The policy can help organizations to maintain compliance, as it provides a structured approach towards identifying and tracking image usages, which are often subjected to regulations and standards set by compliance bodies.
- By implementing this policy via Infrastructure as Code (IaC) in Gitlab CI, it allows for consistency and prevents unintended configuration drift. Any changes or unapproved usage of images can be quickly identified and mitigated.
- The policy potentially lowers the risk and impact of a possible security breach by providing an automated and continuous check on image usage within jobs, thereby helping to ensure that only approved and secure images are used in the runtime environment.
Ensure at least two approving reviews are required to merge a GitLab MR
Ensure at least two approving reviews are required to merge a GitLab MR
- Requiring at least two approving reviews before merging a Merge Request (MR) on the GitLab project increases the oversight oversight for code changes which in turn strengthens the code quality and reduces the possibility of vulnerabilities being introduced.
- This policy helps prevent unauthorized or malicious changes from being merged into the main codebase. By requiring multiple approvals, the risk of one person with harmful intent or inadequate understanding of the codebase making significant changes is minimized.
- The policy also promotes collaboration among team members as it enforces peer-review of the proposed changes. This can lead to the discovery of bugs, design issues, or optimisation opportunities that a single reviewer might have missed.
- As an infra security policy, it’s particularly crucial for Infrastructure as Code (IaC) practices using Terraform where resource provisioning is managed through code. Misconfigurations or errors in such code can lead to serious security vulnerabilities, making the multiple review policy vital for infrastructure integrity.
Ensure GitLab branch protection rules does not allow force pushes
Ensure GitLab branch protection rules does not allow force pushes
- This policy ensures the integrity of the code in GitLab repositories, preventing force pushes that could overwrite or discard commits. This mitigates potential risks of data loss due to a developer accidentally or intentionally pushing a destructive command.
- Having force push disabled in GitLab branch protection rules enforces a workflow that encourages review and collaboration, as changes must be merged through pull requests, ensuring code quality and avoiding bugs or vulnerabilities being pushed to the codebase.
- The policy promotes transparency and accountability in the development process. Since force push erases history, disallowing it means that all changes to the code base are trackable and auditable.
- By utilizing the resource ‘gitlab_branch_protection’ with Infrastructure as Code (IaC) tool Terraform, this policy enables automated and consistent enforcement of branch protection across all repositories, minimizing human error and administrative overhead.
Ensure GitLab prevent secrets is enabled
Ensure GitLab prevent secrets is enabled
- Enabling GitLab prevent secrets policy safeguards sensitive data by disallowing commits that contain identifiable sensitive information which adds a layer of protection from potential data breaches.
- It decreases the risk of human errors during manual code reviews as it automates the process of detecting confidential information from being pushed into the codebase publicly.
- The rule encourages better code management practices and ensures compliance with privacy and data protection regulations like GDPR, thus avoiding potential legal penalties associated with non-compliance.
- By automating this process with Terraform’s Infrastructure as Code (IaC), the policy reduces overhead and saves significant time for large teams that would otherwise manually check for secrets in the codebase.
Ensure GitLab commits are signed
Ensure GitLab commits are signed
- The policy ensures integrity of the code by confirming that the commits are made by authentic users, thereby preventing unauthorized or malicious changes to the codebase in GitLab projects.
- It increases accountability as each commit is uniquely linked to a specific developer, making it easier to track who made what changes in a GitLab project.
- It enhances security by allowing the verification of the source of the commits by checking the validity of the signatures, deterring fake commits or commit forgery by malicious actors.
- It guarantees that the Terraform Infrastructure as Code (IaC) configuration is continuously monitored for violations, which helps in fixing security issues in an expeditious manner, hence reducing the risk for the GitLab project breaches.
Ensure load balancer for VPC is private (disable public access)
Ensure load balancer for VPC is private (disable public access)
- This policy mitigates potential security risks by ensuring that the Virtual Private Cloud (VPC) load balancer cannot be accessed publicly. This reduces exposure to external threats and potential hacking attempts.
- The policy prevents inadvertent exposure of potentially sensitive data or systems behind the load balancer, by cutting off any direct access route from the internet.
- By using Terraform Infrastructure as Code (IaC), this policy can be easily and consistently enforced across all deployments. This results in a higher level of compliance due to automation, consequently increasing the overall security posture.
- It allows network traffic control within a defined private network only—enhancing the ability to monitor and filter traffic flows, which leads to identifying and mitigating any suspicious activities rapidly.
Ensure VPC classic access is disabled
Ensure VPC classic access is disabled
- Disabling VPC classic access enhances the security posture of the cloud environment by preventing unauthorized and unintended resource access, as the classic infrastructure lacks certain security features that are present in the newer VPC infrastructure.
- Keeping VPC classic access disabled follows the principle of least privilege by restricting older, less secure access methods, thereby reducing potential vulnerabilities.
- The application of this policy reduces the potential attack surface by limiting the number of entry points available to malicious entities or hackers.
- Using Terraform to automate the compliance of this policy ensures the consistent application across all ‘ibm_is_vpc’ resources, preventing misconfigurations and reducing the chance of human error.
Ensure API key creation is restricted in account settings
Ensure API key creation is restricted in account settings
- This policy decreases the potential attack surface by limiting who has the ability to create API keys, which could give unauthorized access to the infrastructure if misused or leaked.
- In case of a breach, the restriction on the creation of API keys will help in mitigating the risk, as hackers or malicious users would be unable to progress in creating new access points within the system.
- It aids in role segmentation and access control within the organization’s or project’s system infrastructure, making sure that only privileged and authorized users are able to create API keys.
- Enforcing this policy ensures that the level of access security is maintained according to standardized compliance benchmarks, contributing to overall security hygiene.
Ensure Multi-Factor Authentication (MFA) is enabled at the account level
Ensure Multi-Factor Authentication (MFA) is enabled at the account level
- This policy ensures an extra layer of protection for the IBM account by confirming the user’s identity through multiple verification methods, making it significantly harder for unauthorized users to gain access.
- The MFA policy helps to prevent potential breaches that may result from compromised credentials by requiring additional verification code or device on top of the username and password.
- It also safeguards sensitive data residing within the IBM account, reducing the risk of data loss, data corruption, and other potential negative impacts on the business.
- With the Infrastructure as Code (IaC) tool, Terraform, this policy can be automated and integrated into the development pipeline, ensuring consistent implementation of secure practices and maintaining compliance across all accounts in a scalable manner.
Ensure Service ID creation is restricted in account settings
Ensure Service ID creation is restricted in account settings
- A well-enforced policy of restricting service ID creation in account settings enhances the security of IBM Cloud infrastructure by mitigating risks associated with unauthorized entities creating service IDs for malicious purposes.
- The policy will help in establishing strong access control in the IBM Cloud environment as it ensures that only authorized users can create service IDs, limiting potential breach of sensitive data.
- The policy will be implemented using Terraform, a popular IaC tool, crucial for creating easily reproducible and maintainable infrastructure, where the rules and their enforcement can be programmatically defined and managed.
- Implementing this policy significantly strengthens audit trails, making it relatively simpler to identify any suspicious activity related to service ID creation, thus effectively assisting in incident response and post-incident analysis.
Ensure Databases network access is restricted to a specific IP range
Ensure Databases network access is restricted to a specific IP range
- This policy significantly enhances the security of ibm_database by preventing unauthorized access. By restricting network access to a specific IP range, it ensures that only trusted sources can interact with the database, reducing the risk of unauthorized access and potential data breaches.
- The implementation of this policy specifically through Infrastructure as Code (IaC) tool like Terraform ensures consistent deployment of the policy across multiple environments. This not only increases operational efficiency but also ensures security conformity as the environment scales up.
- The policy aids in compliance with data protection norms or regulations, such as GPDR, that mandate the restriction of network access to sensitive data-storage entities like databases. Non-adherence to this could lead to penalties and legal consequences.
- Leaving the database open to all IPs could potentially expose sensitive data to external threats and cyber attacks. Implementing this restriction drastically cuts down the attack surface, mitigating potential security threats and the associated costs of a breach, in terms of financial, reputational, and incident response efforts.
Ensure Kubernetes clusters are accessible by using private endpoint and NOT public endpoint
Ensure Kubernetes clusters are accessible by using private endpoint and NOT public endpoint
- This policy ensures that Kubernetes clusters are only accessible via private endpoints, reducing the risk of unauthorized access or infiltration from external parties on a public network, thereby enhancing the security of the cluster.
- Since public endpoints can be potentially exposed to the internet, the policy of using only private endpoints significantly minimizes the surface area for cyber attacks such as Denial-of-Service (DoS) attacks, achieving better protection for the Kubernetes clusters.
- The policy increases network isolation, allowing only internal network traffic within private networks to communicate with the Kubernetes clusters, which promotes network performance and operational efficiency.
- With the Infrastructure as Code (IaC) tool - Terraform, the policy enables consistent and repeatable deployments by codifying the infrastructure requirements, which enhances the management and scalability of secure access to Kubernetes clusters.
Do not admit containers wishing to share the host process ID namespace
Do not admit containers wishing to share the host process ID namespace
Do not admit privileged containers
Do not admit privileged containers
- Privileged containers have root access to the host, leading to a potential security risk, as they could execute malicious actions with the host’s privileges. This policy is important because it restricts the use of such containers, thus minimizing the attack surface.
- This policy is essential to limit potential breaches or exploits as any compromise of a privileged container would give an attacker the same level of access to the host. By denying privileged containers, these risks are significantly reduced.
- Using Certified Kubernetes and following best practices around PodSecurityPolicy reduces the likelihood of unauthorized access to important or sensitive data, thus implementing this policy aids in maintaining data integrity and confidentiality.
- Ensuring that no privileged containers are admitted supports compliance with certain security standards and regulations that require organizations to implement strong access controls and protect system integrity.
Do not admit containers wishing to share the host IPC namespace
Do not admit containers wishing to share the host IPC namespace
Do not admit containers wishing to share the host network namespace
Do not admit containers wishing to share the host network namespace
Containers should not run with allowPrivilegeEscalation
Containers should not run with allowPrivilegeEscalation
- This policy prevents unauthorized escalation of privileges, thus strengthening container security by preventing an attacker with limited access from gaining complete control over the Kubernetes node or the entire cluster.
- Limiting the privilege escalation reduces the application’s attack surface since exploits or security vulnerabilities in one component cannot give carte blanche privilege to malicious users on other parts of the system, or on the entire infrastructure.
- The policy ensures the principle of least privilege is upheld, in which an application or process is given only the privileges it needs to function, significantly reducing potential damage in case of a security breach.
- Compliance with this policy prevents significant disruptions, data breaches, and potential exploitation of the deployed infrastructure, thereby protecting sensitive information from exposure and preserving system integrity.
Do not admit root containers
Do not admit root containers
- The policy ‘Do not admit root containers’ is important as it ensures the principle of least privilege is maintained, thereby preventing containers from operating with root permissions which can pose serious security risks if exploited.
- Adhering to this policy ensures the integrity and security of other containers and the underlying host system as root containers can potentially have unrestricted access to all commands and files, posing significant threat especially in multi-tenant environments.
- The restriction of root containers prevents bad actors from gaining full control over the system even in the case of a successful breach into a container, limiting the damage they can cause.
- The policy impacts how applications are planned, designed and deployed within containers to ensure they function correctly without root privilege, promoting good coding practices and potentially increasing overall application security.
Do not admit containers with the NET_RAW capability
Do not admit containers with the NET_RAW capability
- The ‘NET_RAW’ capability allows containers to directly craft and send network packets, which could be abused to create network attacks, such as spoofing, hence the policy guards against potential security threats.
- This policy ensures an additional layer of security for the infrastructure - by enforcing the rule, the likelihood of vulnerabilities inside the application being exploited is significantly reduced.
- Retaining NET_RAW capability exposes the system to security risks due to running applications as root within the container, with unrestricted network access, making it a target for intruders trying to move laterally across the network or to elevate privileges.
- Observance of this policy effectively complies with the best-practice principle of ‘Least Privilege’, meaning applications will only have capabilities that are essential for their functioning, which minimizes overall potential attack surface.
Liveness Probe Should be Configured
Liveness Probe Should be Configured
- Having a Liveness Probe configured is essential to ensure the Kubernetes system automatically handles situations where applications have entered a state where they are running but not able to handle requests, for example due to a deadlocked thread.
- This policy improves system reliability and availability by ensuring that unresponsive applications are restarted, minimizing service disruptions due to software faults or unexpected input combinations.
- Without the Liveness Probe, Kubernetes is unaware if a pod is in an unhealthy state and cannot take corrective action, thereby potentially putting the availability of the system at risk and impacting the user experience.
- It is highly useful for entity types that maintain a running state such as DaemonSet, Deployment, and StatefulSet, where the state is critical, and a failed pod could disrupt service continuity.
Readiness Probe Should be Configured
Readiness Probe Should be Configured
- A configured readiness probe in Kubernetes infrastructure signals that a particular pod or service is ready to accept traffic. This is critical to ensure a seamless user experience by routing traffic only to services that are fully ready to handle it.
- Without a readiness probe, Kubernetes may direct traffic to pods or services that are still initializing, which may lead to errors, delays, or loss of data. Therefore, this policy ensures that system performance and reliability are upheld.
- An unconfigured readiness probe could cause cascading effects in a microservices architecture. For example, if one service attempts to communicate with another initializing service, it can lead to failure of interdependent services. The policy prevents such scenarios, significantly reducing troubleshooting effort and downtime.
- Implementing this policy provides insight into the healthiness and operational state of individual containers within pods, allowing for better resource management and allocation. This is crucial in environments with large-scale deployments, ensuring efficiency and optimal use of resources.
CPU requests should be set
CPU requests should be set
- Setting CPU requests for pods in Kubernetes is crucial for proper resources allocation as it helps the Kubernetes scheduler to decide on which node the pod gets placed. Without it, pods could be scheduled on a node with insufficient resources, leading to poor performance or even errors.
- Resource starving can be avoided as setting CPU requests ensures that each pod gets its fair share of CPU resources. This can aid in preventing a scenario where a single pod uses the majority of the resources, starving other pods.
- Setting CPU requests provides a means of workload isolation. This ensures that one tenant’s workload cannot disrupt the performance of other tenants’ workloads within a multi-tenant system - a crucial aspect in terms of overall system performance and security.
- Defining CPU requests improves the stability of deployed applications by preventing unpredictable application behavior due to lacking or fluctuating resources. This contributes to the system’s reliability, enhancing users’ experience and trust in the deployed applications.
CPU limits should be set
CPU limits should be set
- Setting CPU limits for Kubernetes workloads, including CronJobs, DaemonSets, Deployments, Jobs, Pods, and StatefulSets, ensures fair distribution of CPU resources among different applications and services running in the cluster, enhancing overall performance.
- The absence of CPU limits can lead to situations where a single intensive application consumes most of the CPU resources, potentially leading to performance degradation of other services or even application failures due to resource starvation.
- Implementing CPU limits aids in preventing potential denial of service attacks where an attacker might try to overwhelm a particular service with requests, consuming all available CPU resources and causing service disruption.
- CPU limits create a more predictable operating environment by encouraging developers to optimize their applications to function within preset resource boundaries, hence improving the overall reliability and stability of the infrastructure.
Memory requests should be set
Memory requests should be set
- Setting memory requests in Kubernetes is critical in ensuring that the pods have sufficient resources to function properly. Without a defined memory request, pods may encounter performance issues or crashes due to a lack of memory resources.
- This policy can help in efficient resource allocation since Kubernetes uses memory requests to decide which nodes to place pods on. It assists the scheduler in making better decisions about distributing workloads across nodes in the cluster.
- Enforcing this policy can prevent potential disruptions caused by memory over-commitment. If the actual memory usage exceeds the amount of memory available on a node, it can lead to workloads being terminated or becoming unresponsive.
- By setting memory requests, it also provides a clear visibility on how much memory a pod is expected to consume, which enables easier troubleshooting and infra management in case of any performance-related issues.
Memory limits should be set
Memory limits should be set
- Setting memory limits for Kubernetes resources such as Pods, Deployments, or Jobs helps keep individual applications from using excessive amounts of system memory, which could degrade overall system performance or even crash the system due to memory inadequacy.
- Without set memory limits, a single application could potentially consume all available memory, affecting the functioning of other applications or services running on the same Kubernetes infrastructure. The policy ensures equitable distribution of memory resources.
- Proper setting of memory limits aligns with best practices for ensuring efficient use of infrastructure resources. It helps in cost management by minimizing the chances of needing to add more infrastructure due to uncontrolled memory utilization.
- With this policy, organizations can better predict and manage resource needs, improving the reliability of applications running on Kubernetes and mitigating the risk of application failure due to out-of-memory errors. It gives better control over how memory is allocated.
Image Tag should be fixed - not latest or blank
Image Tag should be fixed - not latest or blank
- Using a fixed image tag ensures consistent deployment across all environments. With ‘latest’ or blank tags, different environments might pull different image versions leading to discrepancies and potential functionality issues.
- Fixed image tags support auditing and traceability. If something goes wrong, teams can quickly identify which version of the image was deployed and investigate the issue accordingly. With ‘latest’ or blank tags, identifying the exact version becomes challenging.
- It helps maintain security by reducing the risk related to unexpected or untested changes. Using ‘latest’ or blank tags could potentially pull images with vulnerabilities yet to be addressed, risking the security of the entire system.
- A fixed image tag promotes predictability; the system behavior remains as expected. Systems are less prone to failure or bugs as there is no chance of unintentionally updating to an unstable or incompatible image version.
Image Pull Policy should be Always
Image Pull Policy should be Always
- This policy ensures that containers within these Kubernetes entities are always using the latest version of the source image. This is essential for continually delivering updated features and performance improvements to the containers.
- Having the Image Pull Policy set to ‘Always’ ensures that, even in the case of a network failure when the latest image cannot be pulled, Kubernetes will fall back to use the local image, thereby not causing any disruption to the service.
- The policy aids in maintaining the consistency and integrity of applications running in the Kubernetes environment because they’re being refreshed with the most updated safe source image available, enhancing security against potential vulnerabilities.
- Implementing this policy aids in the mitigation of risk associated with outdated Docker images that may be running on containers within Kubernetes entities. It specifically helps avoid issues like known security vulnerabilities, bugs or outdated configurations that a previous Docker image might have.
Container should not be privileged
Container should not be privileged
- This policy safeguards against potential abuse of privileges that can lead to serious security issues such as unauthorized access or exploitation of vulnerabilities in the system as privileged containers have access to all devices on the host.
- Ensuring containers are not privileged also helps in enforcing the principle of least privilege, which restricts the access rights for users to the minimal level necessary to perform their jobs, thereby minimizing the potential damage from errors or malicious actions.
- This contributes significantly to a layered defense strategy as even if a certain container is compromised, the impact is isolated and doesn’t put the entire infrastructure at risk.
- The policy serves to enhance the ability to monitor and audit systems effectively by maintaining a clear segregation of roles and responsibilities within different containers and restricting unnecessary access which could complicate auditing procedures.
Containers should not share the host process ID namespace
Containers should not share the host process ID namespace
Containers should not share the host IPC namespace
Containers should not share the host IPC namespace
Containers should not share the host network namespace
Containers should not share the host network namespace
The default namespace should not be used
The default namespace should not be used
- Using the default namespace for Kubernetes can lead to confusion and accidental modifications or deletions as all objects without a declared namespace fall into the default namespace. This policy ensures separation of concerns and the prevention of these potential issues.
- The policy promotes improved visibility and organization within the Kubernetes environment. By implementing namespace-specific resources, it becomes more manageable and secured due to the enhanced capability of assigning access policies per namespace.
- Enforcing this policy will limit the blast radius in case of security incidents. If a vulnerability is exploited in one namespace, the impact won’t escalate to other namespaces, providing an efficient isolation mechanism.
- The policy aids in setting tailored resource quotas per team or project — whenever a namespace is dedicated to a specific team or project, it allows for more effective resource management and prevents any single team or project from consuming disproportionate resources.
Use read-only filesystem for containers where possible
Use read-only filesystem for containers where possible
- Applying this policy ensures that data within containers cannot be altered or tampered with, thereby enhancing the security by minimizing the attack surface that hackers can exploit. This makes the system more resistant to unauthorized changes which could potentially lead to security breaches.
- Using a read-only filesystem can help in complying with certain industry regulations and standards that require data to be immutable, especially in sectors like Finance or Healthcare where data integrity is critical.
- This policy assists in maintaining system stability. Even if a rogue process or application tries to write to the filesystem, it will fail, ensuring that system files and critical data remain intact.
- Applying a read-only filesystem policy can greatly simplify system recovery and troubleshooting as the containers require less backup due to their immutable nature. This results in easier rollbacks and faster recovery times in the event of any disruption.
Minimize the admission of root containers
Minimize the admission of root containers
- Running root containers increases the privileges associated with the container, potentially allowing greater scope for malicious attacks. Minimizing the admission of root containers contributes to reducing this risk.
- This policy ensures consistency and standardization across multiple entities such as Pod, ReplicaSet, and Deployment which can ease the maintenance and security management.
- The enforcement of this policy reduces the likelihood of administrative errors that could inadvertently alter other parts of the system, potentially crashing the software or providing a gateway for cyber threats.
- By minimizing root containers, the policy also isolates any potential system vulnerabilities to a specific contained area, reducing the potential impact on broader systems and ensuring more robust overall security.
Do not allow containers with added capability
Do not allow containers with added capability
- This policy is important because it prevents the addition of capabilities to containers that could potentially expand their privileges beyond what is necessary or safe, increasing the risk of security breaches or misuse.
- It helps maintain Kubernetes’ principle of least privilege by ensuring that containers only have the minimum necessary capabilities to perform their function, thereby reducing the potential attack surface.
- The policy also limits the potential damage that can be caused by a compromised container, as it can’t use added capabilities to impact the system or other containers negatively.
- Strict adherence to this policy aids in compliance with data security standards, making it easier for organizations to meet regulatory requirements and pass security audits.
Minimize the admission of containers with added capability
Minimize the admission of containers with added capability
- The policy minimizes potential security threats by limiting the additional capabilities of containers on Kubernetes, ensuring that they don’t have more privileges than required, thus reducing the likelihood of unauthorized or malicious activities.
- It aims to enhance the Principle of Least Privilege (PoLP) in Kubernetes by ensuring only necessary permissions are granted to containers, minimizing potential violation into other application’s space, enhancing confidence in system security and data privacy.
- By putting this policy in place, it decreases the chances of system vulnerabilities by engaging only the absolute essential services, capabilities and components in order to deliver its functionality, thus minimizing the potential risk vectors.
- This policy impacts the overall efficiency and robustness of the Kubernetes infrastructure by promoting best practices regarding system permissions and capabilities, leading to a more secure, reliable, and robust infra environment.
Do not specify hostPort unless absolutely necessary
Do not specify hostPort unless absolutely necessary
- This policy minimizes the risk of port conflicts on a node by ensuring that applications do not specify a hostPort unless required. Clashes in port assignments can lead to failure of pods or deployments, reducing system reliability.
- It enhances the distribution schema of pods across nodes. When a hostPort is specified, the Kubernetes scheduler is less flexible in distributing pods because it has to consider the hostPort in the scheduling decision which reduces the pods scheduling possibilities across the Kubernetes cluster.
- Avoiding the unnecessary specification of hostPort strengthens security by reducing the attack surface. Specific hostPorts might be targeted externally, potentially exposing Kubernetes cluster to vulnerabilities.
- This policy allows for better automation and scalability within the Kubernetes environment. Not specifying a hostPort eases the process of scaling up the number of replicas of a service as there won’t be the constraint of finding a node with a particular port free.
Do not expose the docker daemon socket to containers
Do not expose the docker daemon socket to containers
- Exposing the Docker daemon socket to containers could provide excessive privileges to the container processes, potentially leading to abuse of the host system. This policy mitigates this risk by preventing such exposures.
- The policy offers protection against potential attacks. If the Docker daemon socket is exposed, an attacker could gain root access to the host and all other containers, expanding the potential damage they could cause.
- Implementing this policy ensures better compliance with security best practices and standards. The Docker daemon socket should, by default, not be exposed to containers, and this policy enforces that rule.
- The ‘do not expose Docker daemon socket’ policy brings about improved system management by reducing attack surface within Kubernetes infrastructure, which makes it easier for security teams to detect and respond to threats.
Minimize the admission of containers with the NET_RAW capability
Minimize the admission of containers with the NET_RAW capability
- This policy is crucial because it minimizes the risk of network attacks by restricting the usage of NET_RAW capability, which allows programs to create any kind of packets without any interference by the kernel. Any container with such power can potentially create illegitimate traffic, disrupt network communication, and compromise the security of the system.
- Application of this policy ensures adherence to the principle of least privilege, reducing the number of workloads or containers with the ability to use the NET_RAW capability. This subsequently restricts the possible attack surface and prevents internal or external threat actors from exploiting the system via these capabilities.
- By enforcing this policy for various entities including CronJob, DaemonSet, Deployment, Pod, and more, it ensures this security measure is applicable across different Kubernetes workloads and not restricted to a particular type, hence providing comprehensive security.
- This policy also contributes to a standard and secure coding practice in Infrastructure as Code (IaC) context, by promoting the creation of manifests/scripts in Kubernetes that do no grant unnecessary or overly extensive permissions to containers, thus fostering a security-focused approach to IaC development.
Apply security context to your pods and containers
Apply security context to your pods and containers
- Applying security context to pods and containers can significantly enhance Kubernetes infrastructure security by limiting permissions, thus reducing the potential attack surface for unauthorized entities.
- Security context allows Kubernetes to define privilege and access control settings for a Pod or Container, which can protect sensitive data and prevent privilege escalation attacks.
- This policy ensures that security parameters are consistently applied across all Kubernetes entities such as CronJob, Deployment, Pod, ReplicaSet, and more, ensuring uniform security standards throughout the system.
- It aids in improving the audit process as it allows clear visibility into what each pod or container is authorized to do, leading to faster detection of security breaches and resolution of security incidents.
Apply security context to your containers
Apply security context to your containers
- Applying a security context to containers is crucial for delineating privileges and access rights for each container in Kubernetes. This helps to prevent unauthorized access or manipulation of container resources and maintains a secure deployment environment.
- Security contexts can help to reduce the potential attack surface. Applying a security context can limit the capabilities of a process running in a pod, restricting the operations it can perform, which in turn can prevent exploitation of potential security weaknesses.
- The policy also helps to isolate and separate resources in a multi-tenant environment. This isolation between containers can prevent impact on other containers in the event of a security breach or if a container is compromised.
- Non-compliance with this policy can lead to an increased risk of vulnerabilities. Therefore, it’s essential for entities like CronJob, DaemonSet, Deployment, Job, Pod, ReplicaSet, ReplicationController, and StatefulSet to follow this policy closely for secure resource management in Kubernetes.
Ensure that the seccomp profile is set to docker/default or runtime/default
Ensure that the seccomp profile is set to docker/default or runtime/default
- Ensuring that the seccomp profile is set to docker/default or runtime/default is important as it isolates the container process from the host process, preventing it from making system calls that can potentially compromise the host’s security.
- The policy helps to safeguard against any exploits or vulnerabilities that may be present within the system calls, protecting the entire infrastructure, including CronJob, DaemonSet, Deployment, Job, Pod, ReplicaSet, ReplicationController, StatefulSet.
- Having this policy in place helps in maintaining the principle of least privilege. By restricting the type of system calls that a process within a Pod can make, the possibility of a breach is greatly reduced even if an attacker gains access to the Pod.
- Not having an appropriate seccomp profile set for containers can potentially open numerous avenues for malicious activities like cryptomining, data theft, denial of service etc., therefore, it’s important to apply this policy to mitigate these risks.
Ensure default seccomp profile set to docker/default or runtime/default
Ensure default seccomp profile set to docker/default or runtime/default
- The policy helps to establish a default Secure Computing Mode (seccomp) for docker or runtime environments which limits the system calls that a container can make, preventing it from accessing arbitrary host resources, thereby increasing infrastructure security.
- Setting the seccomp profile to default isolates the container processes from the host system, providing an additional layer of protection against unwanted system-level interactions and confining them to a limited set that reduces security risks and potential attacks.
- Absence of this policy can expose the infrastructure to potential exploits and zero-day vulnerabilities. By limiting the scope of system calls a container can perform, the risk of exploiting a vulnerability in the system call (even if it exists) is mitigated.
- Applying this security policy as part of Infrastructure as Code (IaC) in Kubernetes promotes consistent security practices across all container deployments, making it easier to identify and monitor non-compliance while scaling.
Ensure the Kubernetes dashboard is not deployed
Ensure the Kubernetes dashboard is not deployed
- The Kubernetes dashboard can potentially expose sensitive information. Limiting or blocking its deployment increases the security of the infrastructure by reducing possible attack surfaces for malicious actors.
- Unrestricted access to the Kubernetes dashboard can provide hackers with an opportunity to understand the underlying architecture and configuration, putting applications and data at risk. Ensuring that the dashboard isn’t deployed helps in safeguarding the infrastructure from this vulnerability.
- The Kubernetes dashboard, if compromised, could give unauthorized users the ability to perform administrative tasks such as creating, deleting, and modifying resources. Restricting its deployment protects critical system components from potential sabotage.
- Reducing the use of the Kubernetes dashboard can lead to more secure system as it forces administrators and users to use command-line interfaces which typically provide more granular control and a clearer record of actions taken for auditing and accountability purposes.
Ensure that Tiller (Helm v2) is not deployed
Ensure that Tiller (Helm v2) is not deployed
- Ensuring that Tiller (Helm v2) is not deployed is important as it runs with full cluster administrative privileges leading to potential security risks such as unauthorized access or alteration of resources.
- The policy minimizes attack surface area by preventing usage of deprecated software like Tiller (Helm v2), thus reducing vulnerability to attacks that may exploit known issues in such software.
- Strictly following this policy is crucial for maintaining the integrity of data and applications running in the Kubernetes environment, given that Helm charts deployed via Tiller may not follow best security practices.
- Preventing Tiller deployments enables Kubernetes users and administrators to implement better security model offered by Helm v3, which does not require Tiller and is more widely supported and maintained, thereby maintaining infrastructural security and effectiveness.
Prefer using secrets as files over secrets as environment variables
Prefer using secrets as files over secrets as environment variables
- Storing secrets as files in Kubernetes rather than as environment variables helps to minimize unauthorized access as files can be secured using restrictive permissions, not easily getting exposed by a ‘printenv’ command or logged accidentally by third-party applications.
- This policy mitigates the risk of secret leakage between containers running in the same pod. While environment variables can be shared between containers, file-based secrets are not directly shared, providing a higher level of isolation.
- It reduces the risk of sensitive data being exposed in system logs, as logging solutions usually do not log the content of files, whereas they might log environment variables.
- Implementing this policy prevents the possibility of inherited and pre-existing environment variables from conflicting with or overriding the secret values, maintaining the integrity and intended functioning of the system.
Minimize the admission of containers with capabilities assigned
Minimize the admission of containers with capabilities assigned
- The policy minimizes the risk of container exploitation by reducing the number of capabilities assigned, therefore limiting potential malicious actions an attacker could perform within a compromised container.
- If containers are granted unnecessary capabilities, they can present an excessive attack surface, making it easier for bad actors to find vulnerabilities and exploit them, impacting the overall security of the Kubernetes setup.
- The policy prevents accidental misconfigurations by ensuring containers only have necessary capabilities, closing potential security gaps and raising the overall integrity of the infrastructure.
- In case of a container breach, the impact on the wider system is minimized, as the capabilities of the breached container are limited, thereby helping to protect sensitive data and system resources from unauthorized access.
Ensure that Service Account Tokens are only mounted where necessary
Ensure that Service Account Tokens are only mounted where necessary
- This policy minimizes the risk of unauthorized access or token abuse. When tokens are only mounted where necessary, the possibility of those tokens being exploited, either maliciously or accidentally, is significantly reduced.
- The policy optimizes the use of Kubernetes’ resources by ensuring that Service Account Tokens aren’t redundantly mounted in unnecessary places. This preserves resource capacities and helps maintain optimal system performance.
- The adherence to the policy helps to maintain the robustness of the CronJob, DaemonSet, Deployment, Job, Pod, ReplicaSet, ReplicationController, and StatefulSet entities in Kubernetes. The misuse of Tokens could potentially disrupt or degrade the function and efficiency of these entities.
- Implementing this policy aligns with standard security best practices in Kubernetes, and facilitates meeting regulatory compliance mandates related to data access control.
Do not use the CAP_SYS_ADMIN linux capability
Do not use the CAP_SYS_ADMIN linux capability
- This policy is important because the CAP_SYS_ADMIN Linux capability effectively gives the process elevated, root-level privileges, which can open up potential security vulnerabilities and increase the attack surface of the system.
- The limitation of using the CAP_SYS_ADMIN capability aligns with the principle of least privileges, ensuring that applications, services and users operate using the minimum levels of access necessary to perform their functions, thereby reducing the potential damage from accidental errors or malicious attacks.
- Failure to adhere to this policy can lead to unauthorized privilege escalation. In a worst-case scenario, a malicious actor who gained access to a process with this capability could gain complete control over the whole system.
- In the context of Kubernetes resources like pods and deployments, running these entities without the CAP_SYS_ADMIN capability minimizes the risk of one compromised pod or container affecting other resources or the entire cluster. This is a key component to maintaining the integrity and security of container orchestration.
Containers should run as a high UID to avoid host conflict
Containers should run as a high UID to avoid host conflict
- Running containers as a high UID helps prevent the possibility of UID collisions between the container and the host system. This can cause operational issues and inefficiencies, especially in a Kubernetes environment that relies on multiple containerized applications.
- It reduces potential security risks, as running containers with low or default UIDs can inadvertently grant the process root permissions on the host, providing an easier path for exploitation if the container is compromised.
- This policy also provides process isolation and security between containers and the host. A container running as a high UID cannot directly interfere with a process running as a lower UID on the host system.
- For the specific entities like CronJob, Deployment, or ReplicaSet, implementing this policy ensures that these resources don’t accidentally have escalated privileges which can lead to unintended access to files or processes, improving the overall security posture of the system.
Ensure that default service accounts are not actively used
Ensure that default service accounts are not actively used
- Using default service accounts can give applications more permissions than they require, leading to potential vulnerabilities that can be exploited by attackers. This policy helps in ensuring adherence to the principle of least privilege, which is a critical aspect of securing the infrastructure.
- Default service accounts have a broad set of permissions that could allow potentially malicious activities. Enforcing this policy helps in limiting potential damage caused by compromised applications or rogue actors within the organization, contributing to the overall security posture.
- Compliance with this policy aids in limiting the Scope of Control (SoC) to specific pods or namespaces in Kubernetes rather than having all-encompassing default service accounts, which facilitates granular control and the ability to isolate security issues.
- Additionally, actively tracking and managing the use of service accounts improves visibility into cluster activity, facilitates auditing, and aids in early detection of anomalies. Such proactive management of service accounts can play a pivotal role in identifying and mitigating potential threats early.
Image should use digest
Image should use digest
- Using a digest in images ensures that each time they are pulled, the same content is obtained. This is important for consistency across instances and ensures that, despite newer versions being available, the specific configuration used in an image remains the same.
- This policy helps to protect against image source or code changes that may inadvertently introduce bugs or security vulnerabilities into your deployed applications. By using a digest, you are confirming the exact version of the image to be deployed.
- Using image digests also improves security by defending against unauthorized or potentially malicious changes in your container images. If the digest changes, it signifies that the image too has been altered.
- This policy is vital in environments like Kubernetes that automate application deployments. Using digests helps to ensure repeatable deployments. This is especially relevant for all entities like CronJob, DaemonSet, Job, Pod among others, where any changes in the images used can lead to different outcomes in the tasks performed.
Ensure that the Tiller Service (Helm v2) is deleted
Ensure that the Tiller Service (Helm v2) is deleted
- Ensuring that the Tiller Service (Helm v2) is deleted helps to improve the security posture of Kubernetes clusters. Tiller is notorious for its inadequate permissions model and might have full cluster administrative access, which could potentially be exploited by malicious actors.
- Tiller can store release information in configMaps, which are viewable by other users in the same namespace. By deleting Tiller service, you’d reduce your security risks associated with the exposure of sensitive data stored in configMaps.
- Tiller might be deprecated in Helm v3, but left-over Tiller services in your Kubernetes services could leave backdoors into your system. Ensuring that the Tiller service is deleted hence secures your Kubernetes services from possible security oversights due to legacy implementations.
- The enforcement of this policy will necessitate the refactoring of resources that still rely on Tiller, fostering a transition towards improved security practices and up-to-date resource management tools, which is critical in reducing the attack surface within Kubernetes services.
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster
Ensure the Tiller Deployment (Helm V2) is not accessible from within the cluster
- This policy is important because it prevents unauthorized access to the Tiller Deployment from within the cluster. Unauthorized access can potentially lead to data breaches, system misconfigurations and can allow attackers to gain unauthorized access to sensitive information.
- This policy is crucial in maintaining the integrity and confidentiality of data in the Kubernetes cluster. Without it, the sensitive information related to the Tiller deployments - such as configuration details and secret keys - could be manipulated, viewed, or stolen by malicious actors.
- By limiting access to the Tiller Deployment, the policy reduces the attack surface within the Kubernetes cluster. This helps to strengthen the overall security posture of the system by reducing the number of potential entry points for an attacker.
- Ensuring that the Tiller Deployment is not accessible from within the cluster also aids in complying with security best practices and regulatory requirements, especially for organizations handling sensitive data. Non-compliance can lead to legal consequences and damage to the company’s reputation.
Minimize wildcard use in Roles and ClusterRoles
Minimize wildcard use in Roles and ClusterRoles
- The policy minimizes the risk of privilege escalation by limiting the scope of permissions granted to users. Overuse of wildcards can inadvertently give overly permissive access, leading to potential unauthorized actions.
- Limited use of wildcards in roles and cluster roles helps preserve the principle of least privilege. This principle restricts users, systems, or processes to only those privileges necessary to perform their assigned tasks, thereby reducing the attack surface.
- The policy helps to avoid conflicts and ambiguity when defining access rules. Excessive wildcard usage can result in unclear permissions, making it harder to maintain and audit role-based access control (RBAC).
- It indirectly promotes increased security awareness and governance in role assignment and management. Understanding and specifying required privileges requires clarity on the user’s responsibilities, thus encouraging more thoughtful role creation and assignment processes.
Ensure that the --anonymous-auth argument is set to false
Ensure that the --anonymous-auth argument is set to false
- Setting the —anonymous-auth argument to false in Kubernetes is crucial to prevent unauthorized access to kubelet’s HTTP API. Unauthorized access can lead to malicious activities such as data theft, alteration of critical parameters, or disruption of service.
- This policy helps ensure that only authenticated and authorized users, nodes, or services can make requests to the Kubelet server. Having this check is therefore vital to maintaining secure communication within the Kubernetes environment.
- For entities like CronJob, DaemonSet, Deployment, Job, Pod, etc., this security measure ensures that these entities can reliably perform their tasks without any unneeded interruptions or malicious alterations to the work they’ve been programmed to perform.
- Implementing this policy can strengthen overall cluster security, preventing potential security breaches and the associated reputational damage, financial cost, and potential data protection regulation non-compliance penalties for the organization.
Ensure that the --basic-auth-file argument is not set
Ensure that the --basic-auth-file argument is not set
- Ensuring that the —basic-auth-file argument is not set in Kubernetes’ resources helps to avoid the use of basic authentication, which is considered weak and outdated, thus enhancing the security of the cluster.
- This policy mitigates the risk of unauthorized access by attackers who exploit the vulnerabilities of basic authentication, raising the security standards of the system and protecting sensitive data.
- Enhancing the security policy by removing the —basic-auth-file argument increases compliance with regulatory requirements and industry best practices, which mandate the use of stronger and more modern authentication methods.
- The policy reduces the potential attack surface for cyber threats by eliminating plain-text passwords, thereby preventing the risk of security breaches and subsequent reputation and financial losses in CronJob, DaemonSet, Deployment, DeploymentConfig, Job, Pod, PodTemplate, ReplicaSet, ReplicationController, StatefulSet entities.
Ensure that the --token-auth-file argument is not set
Ensure that the --token-auth-file argument is not set
- This policy helps prevent exposure of sensitive data because the —token-auth-file argument in Kubernetes can contain tokens that authenticate users, potentially leading to unauthorized access if misused or exposed.
- The policy negates the risk of relying on static file-based tokens, which can be more susceptible to compromise as they don’t change dynamically. If the file is accessed by unauthorized individuals, they can bypass security measures.
- Ensuring the setting remains unset guarantees consistent authentication practices across all the listed entities such as CronJob, DaemonSet, Deployment, etc. This consistency makes the system more robust to misconfigurations, which can pose security threats.
- By adhering to this policy, potential vulnerabilities can be mitigated from the development phase, enabling secure infrastructure as code (IaC) practices. This means less time and resources are spent on remediation further down the line.
Ensure that the --kubelet-https argument is set to true
Ensure that the --kubelet-https argument is set to true
- Ensuring the —kubelet-https argument is set to true enhances the security of the Kubernetes infrastructure by enabling encrypted communication between the API server and kubelets.
- It minimizes the possibility of data being intercepted or tampered with as it ensures all traffic between the API server and kubelets is securely transmitted over HTTPS.
- Non-compliance could lead to malicious activity such as data theft or denial of service attacks, potentially compromising the integrity and availability of workloads running in the Kubernetes platform.
- This policy applies across a range of Kubernetes resources including CronJobs, Pods, and StatefulSets, therefore enforcing it is crucial for maintaining a uniform and high level of security across the Kubernetes environment.
Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate
Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate
- Ensuring the —kubelet-client-certificate and —kubelet-client-key arguments are set up correctly is crucial for establishing a secure communication channel between the API server and kubelets in Kubernetes. Any communication weakness due to incorrect or missing parameters can expose your system to potential risks.
- The —kubelet-client-certificate is used to authenticate the API server to the kubelet: without it, the API server can’t prove its identity reliably. The —kubelet-client-key is used to maintain the security of data exchanged between the two endpoints, thus preventing unauthorized data manipulation or exposure.
- Entities like CronJob, DeploymentConfig, StatefulSet, and others are deployments of pods that allow applications to run on Kubernetes. If these entities are communicating with the API server under non-secure conditions (i.e., without these arguments), it could result in unauthorized data accesses or even take over access from these entities to the API server.
- Incorrect use of this policy could lead to fatal security consequences such as interception of communication between the API server and kubelets. This interception could also lead to unauthorized execution of commands, affecting the integrity of the entire infrastructure and potentially causing major operational disruptions.
Ensure that the --kubelet-certificate-authority argument is set as appropriate
Ensure that the --kubelet-certificate-authority argument is set as appropriate
Ensure that the --authorization-mode argument is not set to AlwaysAllow
Ensure that the --authorization-mode argument is not set to AlwaysAllow
Ensure that the --authorization-mode argument includes Node
Ensure that the --authorization-mode argument includes Node
Ensure that the --authorization-mode argument includes RBAC
Ensure that the --authorization-mode argument includes RBAC
Ensure that the admission control plugin EventRateLimit is set
Ensure that the admission control plugin EventRateLimit is set
- Implementing the EventRateLimit admission control plugin enhances the security of the Kubernetes infrastructure by mitigating any form of Distributed Denial of Service (DDoS) attacks, as it limits the number of events any entity can create within a given time frame.
- Without this rule in place, an attacker could potentially overload the system with numerous event creation requests, causing performance issues or complete system breakdown, thus impacting the operation and availability of the services running on the Kubernetes infrastructure.
- This policy also improves the overall stability and performance of the Kubernetes infrastructure by avoiding spamming of the system with too many events, which can lead to system slowdowns, resource exhaustion, and potential system crashes.
- The policy provides a controlled framework for admission of events into the Kubernetes system, ensuring system resources are not misused, critical system components are not overwhelmed, and denial-of-service vulnerabilities are not exploited.
Ensure that the admission control plugin AlwaysAdmit is not set
Ensure that the admission control plugin AlwaysAdmit is not set
- Ensuring that the admission control plugin ‘AlwaysAdmit’ is not set is crucial for maintaining strong security controls, as enabling this plugin would allow all requests, regardless of their nature, to be admitted to a Kubernetes cluster, potentially enabling malicious actions or unwanted changes.
- This policy helps to maintain the integrity of the Kubernetes resources and objects such as Pods, Jobs, DaemonSets, etc., ensuring that only authorized and validated requests are admitted, reducing the risk of unauthorized access and subsequent misuse of resources.
- Having a policy to restrict the use of the ‘AlwaysAdmit’ setting helps enforce the application of established security policies and rules during the admission process, hence enhancing the overall security posture of the Kubernetes infrastructure.
- It encourages the application of the principle of least privilege within the Kubernetes environment, as some requests which do not fit into the security model/menu setup by the administrator will be rejected, thereby reducing the chances of privilege escalation and resource exploitation.
Ensure that the admission control plugin AlwaysPullImages is set
Ensure that the admission control plugin AlwaysPullImages is set
- The AlwaysPullImages admission control plugin is essential because it ensures that the latest version of an application image is always pulled, mitigating risks associated with outdated or potentially compromised images.
- By ensuring that images are always pulled, this policy ensures that security patches, updates, and bug fixes from the image updates are utilized, which contributes to strengthening the overall security posture of the Kubernetes deployment.
- Enforcing this policy prevents the reuse of local images which could have been manually manipulated or tampered with, ensuring that your deployed Pods are functioning as intended and not causing any unforeseen security vulnerabilities.
- The policy applies to multiple entities within Kubernetes such as CronJob, DaemonSet, Deployment, and so forth, which illustrates its significance in maintaining a consistent security measure across various components of a Kubernetes cluster.
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used
- The SecurityContextDeny plugin is vital as it safeguards against the misuse of pods within Kubernetes, by denying the creation of pods that attempt to escalate privileges or maintain unnecessarily high ones. This cuts down the possibility of unauthorized access to sensitive information.
- This policy requirement ensures that if you don’t utilize PodSecurityPolicy, which disallows the execution of pods that violate set security policies, you will have an alternative measure in place to control the security context and hence, prevent potential security vulnerabilities.
- It impacts every Kubernetes entity, from Pod and ReplicaSet to Deployment and StatefulSet, by ensuring that only those entities with required and minimum privilege can run, enhancing the security of your entire Kubernetes infrastructure.
- Implementing this policy can also help to meet compliances and standards such as HIPAA, GDPR, or PCI-DSS. These regulations require adequate measures to secure data and this policy plays a necessary role in mitigating risks and improving data security within your Kubernetes deployment.
Ensure that the admission control plugin ServiceAccount is set
Ensure that the admission control plugin ServiceAccount is set
- The ServiceAccount admission control plugin is crucial to ensure that service account tokens are automatically attached to requests for permissions, hence maintaining the integrity and security of the system by avoiding unauthorized requests.
- This policy secures applications running on entities like CronJob, DaemonSet, Deployment, etc., by preventing potentially rogue or malfunctioning applications from performing damaging or unauthorized operations.
- Setting the ServiceAccount admission control plugin helps assign specific permissions to each component of the infrastructure. This enhances the manageability of permissions across different roles, minimizing security risks from misconfigured permissions.
- Ensuring the enforcement of this policy can help detect potential issues or vulnerabilities during the development phase itself, thus aiding in the development of more secure and robust Kubernetes applications, and improving overall infrastructure security.
Ensure that the admission control plugin NamespaceLifecycle is set
Ensure that the admission control plugin NamespaceLifecycle is set
- Ensuring the NamespaceLifecycle plugin is set guarantees that no request resulting in an ‘orphaned’ object (an object without a namespace) will be admitted, thus reducing inconsistencies and ghost entities within the system.
- This policy, when implemented, helps maintain the organized structure of Kubernetes deployments, allowing for easier management, tracking, and debugging of the aforementioned entities.
- Proper enforcement of this policy reduces potential security risks by preventing the existence of orphan resources that could be exploited by malicious attackers or inadvertently impact operations due to lack of visibility.
- This specific rule gives an additional level of control over the namespaces’ resources, preventing inadvertent deletion of important system namespaces, further promoting system stability and integrity.
Ensure that the admission control plugin PodSecurityPolicy is set
Ensure that the admission control plugin PodSecurityPolicy is set
- The PodSecurityPolicy admission control plugin is crucial to determine and enforce security contexts for pods and containers within a Kubernetes environment. The plugin provides a control layer that prevents the execution of pods that do not meet specified policies, maintaining the infrastructure’s security integrity.
- Non-compliance could enable the creation of pods that disrupt the functioning of the cluster by exhausting resources or negatively affecting other components. By setting the PodSecurityPolicy, resource usage is limited, protecting the stability and availability of the Kubernetes infrastructure and its services.
- The policy directly impacts entities such as CronJob, DaemonSet, Deployment, DeploymentConfig, Job, Pod, PodTemplate, ReplicaSet, ReplicationController, and StatefulSet. Without the policy, these entities may not be securely configured, potentially opening avenues for cyber threats exploiting vulnerabilities.
- Violating the policy could expose infrastructure-as-code (IaC) resources to privileged escalations and other security flaws. Following the policy helps in retaining secure defaults and preventing avoidable flaws through any possible insecure Kubernetes configurations.
Ensure that the admission control plugin NodeRestriction is set
Ensure that the admission control plugin NodeRestriction is set
- The NodeRestriction plugin is crucial for limiting the Node and Pod objects that a kubelet can modify. This adds a layer of protection against potentially malicious activities, like changing node configurations or deleting important pods.
- Implementing this policy ensures that the kubelet can only modify its own node and Pod objects and not any other entities in the cluster. This is key in preventing unauthorized and potentially harmful changes from being made to the system.
- The policy is highly applicable to a wide array of Kubernetes entities such as CronJob, DaemonSet, Deployment, Pod, and many others. Therefore, its implementation has a broad, positive impact on the overall security posture and robustness of the infrastructure.
- Compliance with this policy ensures that even if a kubelet is compromised, the potential damage can be effectively contained within its own Node, protecting important data and operations on other parts of the Kubernetes cluster.
Ensure that the --insecure-bind-address argument is not set
Ensure that the --insecure-bind-address argument is not set
- The policy of not setting the —insecure-bind-address argument is crucial in maintaining robust security within Kubernetes infrastructures by averting the potential for unauthorized and insecure access, which can be destructive to systems.
- Avoiding setting the —insecure-bind-address argument ensures that the API server does not serve on an insecure and unrestricted HTTP endpoint, which could expose critical infrastructural data due to unencrypted communication.
- Compliance with this policy is crucial for all Kubernetes entities mentioned, as it results in tighter security controls, reducing the likelihood of any successful cyberattacks through the prevention of unauthorized access and data breaches.
- Violating this policy by setting the —insecure-bind-address argument could result in severe repercussions including interruption of services, compromise of sensitive information, and potential violation of regulatory and data protection standards, negatively affecting the organization’s reputation and customer trust.
Ensure that the --insecure-port argument is set to 0
Ensure that the --insecure-port argument is set to 0
- Ensuring the ‘—insecure-port’ argument is set to 0 increases security by disabling unsecured HTTP access to the API server, thereby reducing the risk of unauthorized intrusion or data theft.
- This policy helps to ensure all communication with the Kubernetes API server is encrypted and authenticated, enforcing strict secure communication protocols and protecting sensitive information from being exposed in clear text.
- Implementing this policy can help in maintaining compliance with various cybersecurity regulations and standards that mandate secure access to servers, enhancing the company’s overall regulatory compliance posture.
- It minimizes the attack surface for potential denial-of-service or man-in-the-middle attacks by ensnaring unsecured APIs, thereby improving the reliability and integrity of workloads running on Kubernetes.
Ensure that the --secure-port argument is not set to 0
Ensure that the --secure-port argument is not set to 0
- The —secure-port argument ensures secure communication between the API server and clients, so setting it to 0 means it’s not activated, potentially exposing the communication to security threats such as man-in-the-middle attacks.
- Any data transmission done over an insecure port can be intercepted, altered, and misused by malicious third parties, which could lead to data breaches or unauthorized access to confidential information contained in Kubernetes objects.
- CronJobs, Pods, Deployments, and others that relay on the API server for scheduling and managing tasks could be disrupted or manipulated if the communication is compromised, impacting service availability and overall system performance.
- Without a functional secure port, Kubernetes’ integrated security measures like RBAC, admission control, or secret management could be compromised, weakening Kubernetes’ defense against unauthorized access, privilege escalation, or security misconfigurations.
Ensure that the --profiling argument is set to false
Ensure that the --profiling argument is set to false
- The —profiling argument ensures that performance profiling endpoints are not exposed on the Kubernetes scheduler, avoiding potential exploitation by malicious users if set to false.
- It restricts the ability to capture runtime profiling data of the Kubernetes system, restricting opportunities for unauthorized access or discovery of system vulnerabilities.
- It increases the security levels of the resources such as CronJob, DaemonSet, Deployment, DeploymentConfig, Job, Pod, PodTemplate, and so forth, as any exposed profiling information can be utilized for crafting targeted attacks.
- By setting —profiling to false, it prevents data leaks or information disclosure which could potentially aid in continuity of operations under an attack or a threat scenario.
Ensure that the --audit-log-path argument is set
Ensure that the --audit-log-path argument is set
- This policy ensures that the —audit-log-path argument is set, leading to crucial log data being saved in a specified path, which can be used later for analysis, troubleshooting, or security auditing of the Kubernetes (K8s) server.
- By enabling this argument, activities performed within the CronJob, DaemonSet, Deployment, DeploymentConfig, Job, Pod, PodTemplate, ReplicaSet, ReplicationController, StatefulSet resources can be tracked, reducing the risk of unauthorized activities going unnoticed.
- Without —audit-log-path set, important audit information might be lost or disorganized, negatively affecting the potential for incident responses or forensic analysis in the event of a breach or system failure.
- By setting the —audit-log-path, it creates a sense of accountability among users and administrators, as their actions can be monitored and reviewed, driving better practices and adherence to the organization’s security policies.
Ensure that the --audit-log-maxage argument is set to 30 or as appropriate
Ensure that the --audit-log-maxage argument is set to 30 or as appropriate
- Enforcing the —audit-log-maxage argument to 30 or as deemed appropriate helps keep the system’s audit log up-to-date and avoids storage issues that can occur due to endless log growth. This helps maintain the infrastructure’s reliability and performance.
- This policy ensures data protection and privacy are upheld by regularly recycling audit logs and not keeping them longer than necessary, reducing the risk of unauthorized access to old or outdated audit logs.
- Keeps the system compliant with industry best practices for security and data retention, such as those stipulated by GDPR and other privacy laws, which require data turnover policies to be in place.
- Allows for optimal resource management, avoids the unnecessary use of storage resources and improves system speed and efficiency, as old and unnecessary logs are removed in a timely manner.
Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate
Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate
- The
--audit-log-maxbackupargument controls the maximum number of audit log files to retain. Setting it to an appropriate value, such as 10, ensures older log files are automatically removed, preventing potential disk space issues in the Kubernetes environment. - This policy ensures that past audit logs are available for review in the event of a security incident or investigation. By retaining a sufficient number of backup logs, teams can perform thorough analysis of past activities.
- The policy reduces the risk of data loss due to accidental deletion or modification. Since entities like CronJob, DaemonSet, and Pod rely on these logs for operational insights, this consistency can help prevent operational disruptions.
- Proactively managing the number of audit log backups contributes to a cleaner, more efficient Kubernetes environment. This fosters better resource management and can improve overall system performance.
Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate
Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate
- This policy ensures that the audit log file does not grow indefinitely, which can cause storage issues in the Kubernetes platform leading to potential downtime or service unavailability.
- By setting the —audit-log-maxsize argument to 100, Kubernetes will automatically roll over the log file when it reaches this size limit, improving the management of audit data and optimizing storage use.
- Adhering to this policy can also enhance security incident response and forensic capabilities as it helps in maintaining a manageable, organized record of activities that have occurred in the system.
- It is beneficial for all Kubernetes entities including CronJob, DaemonSet, Deployment, DeploymentConfig, Job, Pod, PodTemplate, ReplicaSet, ReplicationController, and StatefulSet, as it ensures proper tracking, accountability, and control in the system.
Ensure that the --request-timeout argument is set as appropriate
Ensure that the --request-timeout argument is set as appropriate
- The policy ensures efficient utilization of resources as setting appropriate request timeout prevents the system from hanging indefinitely due to an unfulfilled request, thereby reducing wastage of computational capacity and network bandwidth.
- By setting the —request-timeout argument as indicated, the policy mitigates the risk of Denial of service (DOS) attacks via long or infinite requests that can exhaust server resources, maintaining the integrity and availability of the services running on Kubernetes.
- This policy assists in maintaining the overall health and responsiveness of the Kubernetes service by avoiding backlog of uncompleted requests, ensuring timely resolution of tasks which is crucial for entities like CronJob, Deployment, and StatefulSets, that rely on prompt execution.
- The —request-timeout parameter helps in defining operational boundaries in the Kubernetes environment enabling easier troubleshooting when services are not responding as expected, enhancing overall system reliability.
Ensure that the --service-account-lookup argument is set to true
Ensure that the --service-account-lookup argument is set to true
- This policy ensures that the Kubernetes API Server verifies the existence of Service Accounts before mounting their corresponding secrets, preventing any potential unauthorized access.
- Enforcing the —service-account-lookup argument as true safeguards against potential attacks that can occur due to tokens associated with deleted service accounts still being accepted by the API Server.
- By ensuring this rule, it both limits the potential attack surface and heightens the infra security level for CronJob, DaemonSet, Deployment, DeploymentConfig, Job, Pod, PodTemplate, ReplicaSet, ReplicationController, or StatefulSet.
- It promotes the practice of least privilege. If a service account is no longer in use, their associated tokens should not be able to grant any access, maintaining access control as per the policy rules applied.
Ensure that the --service-account-key-file argument is set as appropriate
Ensure that the --service-account-key-file argument is set as appropriate
- This policy ensures that the Kubernetes API server is started with a specific service account private key file, thus enabling cryptographic verification of service account tokens used for authentication and authorization. Such verification enhances security by validating the identity of service accounts.
- In Kubernetes, service accounts provide an identity for processes that run in a Pod. By enforcing this policy, only those service accounts with correct key files will have the access, thus reducing the risk of unauthorized access or malicious activities.
- This policy can aid in preventing privilege escalation attacks. If the —service-account-key-file argument is not set appropriately, an attacker may potentially misuse service account tokens, resulting in elevated privileges and unauthorized system access.
- Enforcing the rule effectively mitigates risks associated with data breaches and system compromise. It helps ensure that the security principle of ‘least privilege’ is adhered to, significantly reducing the potential attack surface within a Kubernetes environment.
Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate
Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate
- Setting the —etcd-certfile and —etcd-keyfile arguments ensures that the Kubernetes API server is securely communicating with the etcd database. This prevents unauthenticated and unauthorized entities from viewing or manipulating the stored data.
- Using certificates for communication between the API server and etcd ensures the data privacy and integrity, as it encrypts the data and verifies the identity before an entity can access the data.
- Failure to correctly set these arguments can leave the Kubernetes infrastructure susceptible to unauthorized access and potential data breaches, leading to serious security consequences.
- This rule applies to numerous Kubernetes resources, including CronJob, DaemonSet, and StatefulSet, reinforcing the essential role these certificates play in diverse security contexts to ensure the robustness and reliability of the overall infrastructure.
Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate
Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate
- Ensuring the —tls-cert-file and —tls-private-key-file arguments are set as appropriate is important to secure communication within the Kubernetes infrastructure. Insecure or unauthenticated communication can lead to privacy breaches or potential data loss.
- Using these arguments correctly ensures that only authenticated and authorized entities within the Kubernetes infrastructure can access or perform operations, thus reducing the potential for unauthorized access.
- Incorrectly set TLS certificates and private keys can lead to susceptibility to man-in-the-middle attacks, where a third party may intercept, manipulate or inject data into the communication string, compromising data integrity
- Implementing this policy correctly impacts the overall reliability and trust in the Kubernetes infrastructure, as it assures that all communications are authenticated and encrypted, enhancing the security posture of the application deployment lifecycle.
Ensure that the --etcd-cafile argument is set as appropriate
Ensure that the --etcd-cafile argument is set as appropriate
- Ensuring the —etcd-cafile argument is set appropriately in Kubernetes enforces the secure communication between the API server and etcd, an open-source distributed key-value store that provides a reliable way to store data across a cluster of machines. This, in turn, safeguards sensitive data being transferred within the cluster.
- The set-up of —etcd-cafile argument helps in validating the authenticity of the etcd server by the API server, which prevents unauthorized entities from intercepting the communication between the two, thus mitigating the risk of data tampering or exposure.
- The implementation of this rule impacts all entities mentioned, including CronJob, DaemonSet, Deployment, and more, as they all rely on the etcd for storing their state and configuration data. Incorrect setup could compromise the secure operations of these entities.
- Not setting up —etcd-cafile properly can lead to a complete breakdown of Kubernetes operations, as etcd is the primary datastore of Kubernetes, and insecure or compromised communication can cause data inconsistency, leading to service failure or adverse effects on application performance.
Ensure that encryption providers are appropriately configured
Ensure that encryption providers are appropriately configured
- Ensuring encryption providers are correctly configured in Kubernetes protects sensitive data from unauthorized access by enforcing secure communication between pods, services, and external entities.
- Improperly configured encryption providers can lead to data leaks or cyber attacks, thus disrupting services and potentially causing business and financial loss, and impacting customer trust.
- This policy directly impacts how CronJob, DaemonSet, Deployment, DeploymentConfig, Job, Pod, PodTemplate, ReplicaSet, ReplicationController, and StatefulSet entities are secured, influencing system behavior, performance, and reliability.
- The policy also helps meet various regulatory and compliance requirements related to data protection and cybersecurity, thus avoiding potential legal and financial penalties.
Ensure that the API Server only makes use of Strong Cryptographic Ciphers
Ensure that the API Server only makes use of Strong Cryptographic Ciphers
- Ensuring that the API Server only uses Strong Cryptographic Ciphers is important because it significantly reduces the risk of sensitive data being intercepted and decrypted by unauthorized entities during transmission. This enhances the overall data security of the application.
- Implementing this policy can protect against well-known vulnerabilities and attacks such as the BEAST and POODLE, which seek to exploit weaker ciphers in order to gain unauthorized access to sensitive information.
- Using strong cryptographic ciphers increases the protection of inter-node communication within a Kubernetes cluster, which is beneficial as the listed entities (e.g. CronJob, DaemonSet, Deployment, etc.) often interact with each other and need to transmit sensitive data securely.
- Lastly, conforming to this policy sets an excellent standard for application security, potentially contributing to regulatory compliance (e.g. GDPR, HIPAA) that requires strong encryption methods for data protection.
Ensure that the --terminated-pod-gc-threshold argument is set as appropriate
Ensure that the --terminated-pod-gc-threshold argument is set as appropriate
- Ensuring that the —terminated-pod-gc-threshold argument is set as appropriate helps control when garbage collection for terminated pods occurs. This helps maintain a clean and efficient working environment by managing resource consumption and preventing potential overflows.
- A proper setting for this argument allows the system to efficiently handle workload distribution by automatically removing terminated pods that no longer serve a purpose, making room for new or existing pods that might need the resources.
- This policy ensures that the system operates without interruption by avoiding possible conflicts that can result from having too many terminated pods, it helps prevent them from consuming resources needed by active pods.
- By setting the —terminated-pod-gc-threshold argument, we can have control over how long terminated pods exist before being deleted, which can be critical for debugging and audit processes, thus improving the system’s overall management and transparency.
Ensure that the --use-service-account-credentials argument is set to true
Ensure that the --use-service-account-credentials argument is set to true
- This policy ensures that Kubernetes workload access to the API server is done using Service Account credentials, enhancing accountability and traceability by linking API requests back to specific Service Accounts.
- Enforcing this rule implies each service/pod will have the minimum necessary access (principle of least privilege) scoped to their specific requirements rather than broad access, minimizing potential security vulnerability.
- By checking if —use-service-account-credentials is set to true, it aids in reducing the attack surface, as compromised applications would only have access to the privileges assigned to their service account and not to the entire Kubernetes cluster.
- The policy positively impacts the security of entire infra entities (CronJob, DaemonSet, etc.) by applying the same access control consistently, thus reducing manual errors and overall security misconfigurations.
Ensure that the --service-account-private-key-file argument is set as appropriate
Ensure that the --service-account-private-key-file argument is set as appropriate
- This policy ensures that the —service-account-private-key-file argument is correctly set, limiting the possibility of unauthorized access. Without this setting, service accounts may use insecure or default keys, which could be compromised easily, leading to potential data breaches.
- A correctly configured —service-account-private-key-file argument safeguards the Kubernetes infrastructure, as it associates service accounts with a unique and secure private key file. This reduces the risk of potential spoofing attacks where malicious entities imitate a legitimate service account to gain unauthorized privileges.
- Without the —service-account-private-key-file argument set appropriately, it could lead to improper resource allocation and service performance issues. The specific entities like CronJob, DaemonSet, Deployment can malfunction, delivering sub-optimal performance affecting the overall service reliability.
- Correctly setting up the —service-account-private-key-file argument enforces strong security measures, which is crucial for compliance with various industry standards and regulations. Non-compliance could result in substantial penalties and harm an organization’s reputation.
Ensure that the --root-ca-file argument is set as appropriate
Ensure that the --root-ca-file argument is set as appropriate
- The —root-ca-file argument is critical to maintain trust within the network by ensuring that the Kubernetes API Server only trusts the certificates signed by a Certificate Authority (CA) that it recognizes. This aids in blocking unauthorized or malicious access.
- With the correct —root-ca-file argument setting, you can guarantee that the Kubernetes’ certificate authentication system is in place and effective, offering a protection layer against impersonation attacks or unauthorized access attempts.
- Setting the —root-ca-file argument properly ensures secure communication between the API server and kubelets. This is critical for protecting sensitive information from interception or manipulation, acting as an integral aspect of the defense-in-depth approach for Kubernetes security.
- Failing to correctly set the —root-ca-file argument can leave your Kubernetes’ control plane components susceptible to potential attacks, hampering the workload of CronJob, DaemonSet, Deployment, Job, Pod, and other identified entities.
Ensure that the RotateKubeletServerCertificate argument is set to true
Ensure that the RotateKubeletServerCertificate argument is set to true
- Setting the RotateKubeletServerCertificate argument to true ensures that the API server automatically rotates the kubelet’s serving certificates when they are about to expire, improving the security of Kubernetes clusters by preventing unauthorized access due to expired certificates.
- The policy enhances the resilience of the infrastructure as it minimizes downtime or disruption of services due to expired kubelet certificates, maintaining the system’s reliability and up-time.
- It ensures compliance with best security practices and may be a requirement for adherence to certain regulatory standards relating to data security, which demand regular rotation of cryptographic keys and certificates.
- This policy impacts a wide range of Kubernetes entities including CronJob, DaemonSet, Deployment and others, therefore ensuring the RotateKubeletServerCertificate argument is on guards these resources from being the weak link in infrastructure security.
Ensure that the --bind-address argument is set to 127.0.0.1
Ensure that the --bind-address argument is set to 127.0.0.1
- Setting the —bind-address argument to 127.0.0.1 is important as it ensures that the Kubernetes scheduler, which allocates tasks to nodes, can only be accessed from within the host itself, enhancing the security of the infrastructure by preventing unauthorized and potentially harmful external access.
- The policy is crucial to minimize the attack surface of the Kubernetes cluster which, in turn, guards against potential attackers who might exploit open scheduler services to execute malicious activities, compromising the integrity, availability, and confidentiality of the cluster resources.
- This policy is especially significant to the mentioned Kubernetes entities, as securing the scheduler directly impacts the operation of CronJobs, DaemonSets, Deployments, and other entities also, thus maintaining the stability of the overall Kubernetes environment.
- Any violation of this policy can have severe impacts, including the possibility of Denial-of-Service (DoS) attacks on the Kubernetes scheduler, leading to disruption of Kubernetes task allocation and ultimately, the operation of the entire Kubernetes ecosystem.
Ensure that the --cert-file and --key-file arguments are set as appropriate
Ensure that the --cert-file and --key-file arguments are set as appropriate
- Ensuring the —cert-file and —key-file arguments are set appropriately in Kubernetes provides necessary certificate-based authentication, which helps validate the identity or privileges of a user, machine, or device in a network. This enhances secure communication pathways within the system.
- Since entities like CronJob, DaemonSet, Deployment, Pod, among others, are part and parcel of the Kubernetes ecosystem, correctly configuring these arguments minimizes the risk of unauthorized access, as it becomes extremely difficult for an intruder to mimic or steal the cert and key files to gain access.
- A strict policy enforcing the matching of —cert-file and —key-file arguments supports the overall integrity of a Kubernetes application. Misconfigured or mismatched certificates and keys can cause disruptions or failures in various functions and processes of the application, negatively impacting its performance and reliability.
- Following this policy also ensures adherence to compliance standards related to data protection and privacy. It is critical for organizations handling sensitive data to meet industry-specific regulations, failing which may result in severe penalties or damage to brand reputation.
Ensure that the --client-cert-auth argument is set to true
Ensure that the --client-cert-auth argument is set to true
- This policy enforces mutual TLS (Transport Layer Security), ensuring that client certificates are checked by the server. This increases the privacy and data integrity between Etcd server and its clients, thus offering enhanced security.
- Setting the —client-cert-auth argument to true helps to trace who did what in case of an incident or misconstruction by tying authentication to a particular client. This can be helpful in identifying and resolving security issues.
- Following this policy helps protect Kubernetes entities (like CronJob, DaemonSet, Deployment, etc.) from unauthorized access. Without it, malicious users could potentially gain access to sensitive information or manipulate application behavior.
- Violating this policy can lead to significant security issues, making an application or system vulnerable to attacks. Therefore, ensuring this policy is enforced strengthens security posture and aligns with best practices for secure Kubernetes configuration.
Ensure that the --auto-tls argument is not set to true
Ensure that the --auto-tls argument is not set to true
- Ensuring the —auto-tls argument is not set to true safeguards against the automation of Transport Layer Security (TLS) certificates generation, which could potentially be exploited if an unauthorized entity gains access to the system and deploys their own certificates.
- It encourages having a deliberate control over the encryption and decryption process, which is crucial for maintaining a secure data transmission in a Kubernetes environment.
- This policy helps in preventing a single point of failure by not depending on a single type of automatically generated certificates, but instead allows for unique and varied certificates.
- Reducing the risk of man-in-the-middle attacks due to an attacker’s ability to manipulate the automated certificate generation process, thereby compromising the data exchanged within Kubernetes workloads such as CronJob, DaemonSet, Deployment, Pod, etc.
Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate
Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate
- This policy ensures that the mutual SSL/TLS communication between etcd servers is enforced. This reduces the risk of unauthorized access or data tampering between etcd peers.
- By insisting on the use of —peer-cert-file and —peer-key-file arguments, the policy guarantees that only peers with trusted certificates can join the etcd cluster thus ensuring the integrity and confidentiality of the data stored in etcd.
- Compliance with this policy helps to detect and avoid potential security breaches. Failure to comply can leave the infrastructure exposed to Man-in-The-Middle (MITM) attacks.
- The policy directly impacts several Kubernetes entities such as CronJob, DaemonSet, Deployment, and others. Through these entities, it contributes to overall orchestration security, influencing reliability and trust in the system.
Ensure that the --peer-client-cert-auth argument is set to true
Ensure that the --peer-client-cert-auth argument is set to true
- This policy ensures mutual authentication between Kubernetes members, enhancing the protection against unauthorized access by validating both parties, thus increasing the overall security of the network.
- The enforcement of this infra security policy guarantees that the certificates presented by the clients are verified, thereby significantly reducing the chances of a malicious client impersonating a legitimate entity.
- Implementing this security policy complements the basic authentication method and helps in achieving a comprehensive and tighter security model in Kubernetes deployments — enhancing the overall integrity and confidentiality of data in transit.
- Non-compliance with this policy could potentially leave the system vulnerable to Man-in-the-Middle (MitM) attacks, data breaches and unauthorized access to sensitive data, resulting in disruptions and potential damage to the enterprise’s reputation.
Ensure that the --client-ca-file argument is set as appropriate
Ensure that the --client-ca-file argument is set as appropriate
- The —client-ca-file argument helps in verifying client certificates, which ensures that only authorized clients can make connections to the Kubernetes server; thereby preventing unauthorized or malicious connections.
- The correct setting of this argument is crucial for maintaining a trust relationship between the Kubernetes server and its client nodes. A misconfiguration can lead to the client nodes being unable to connect and interact with the server, disrupting operations.
- The entities affected, which include CronJob, DaemonSet, Deployment, etc., are critical resources for Kubernetes operations. Failure to properly secure these could result in major disruptions to the functionality and performance of the entire Kubernetes cluster.
- Enforcement of this policy not only bolsters the security strength of the Kubernetes infrastructure but also supports regulatory compliance and avoids potential penalties associated with failure to adhere to data protection and privacy standards.
Ensure that the --read-only-port argument is set to 0
Ensure that the --read-only-port argument is set to 0
- Ensuring the —read-only-port argument is set to 0 is important as it disables the usage of Kubelet’s unauthenticated, read-only port 10255. This port was previously used to serve metrics and debug information on pods and the nodes they are running on which could pose a security risk.
- By applying this policy, it helps in mitigating the potential risk of unauthorized data access as once this port is disabled, all access to Kubelet requires authentication.
- The application of this policy directly impacts all the listed Kubernetes entities including CronJob, DaemonSet, Deployment, Job, Pod, etc., as the information about these entities no longer gets exposed via an insecure endpoint.
- Implementing this policy can also impact system diagnostics and monitoring by requiring authenticated access for retrieving any metrics or debug information, ensuring only authorized personnel or systems have access to such sensitive data.
Ensure that the --streaming-connection-idle-timeout argument is not set to 0
Ensure that the --streaming-connection-idle-timeout argument is not set to 0
- By ensuring that the —streaming-connection-idle-timeout argument is not set to 0, it prevents resources like Pods, Jobs, and Deployments from maintaining persistent, idle connections, thus reducing the potential exploitation of unused connections by rogue agents or botnets to infiltrate the system.
- The rule helps to manage server load effectively. Continual streaming connections that idle can unnecessarily consume valuable server resources, leading to potential denial of service issues impacting performance and availability of the Kubernetes environment.
- Enforcing this policy enhances security by reducing the surface area for network-based attacks. Without a timeout, a malicious user could potentially utilize these idle connections to perform malicious activities, like data theft or launching attacks on other resources.
- The policy can contribute to cost-efficiency by reducing network and compute resource wastage, which, in turn, benefits the overall operational efficiency of managing the Kubernetes environment, affecting entities such as DaemonSet, ReplicaSet, and StatefulSet.
Ensure that the --protect-kernel-defaults argument is set to true
Ensure that the --protect-kernel-defaults argument is set to true
- Ensuring the —protect-kernel-defaults argument is set to true in Kubernetes strengthens the protection against unauthorized kernel modifications. This prevents unauthorized users or malicious software from changing the kernel’s behavior.
- This policy promotes best practices for maintaining security in Kubernetes. Without setting —protect-kernel-defaults to true, the system might allow configuration changes which could potentially compromise the kernel, leading to undesirable consequences.
- The policy would protect a wide range of entities including CronJob, DaemonSet, Deployment, Job, Pod, and others. These entities can run critical applications, so safeguarding the underlying kernel security helps protect the application data from being tampered with.
- Ensuring the —protect-kernel-defaults argument is set to true enhances the robustness of the entire Kubernetes infrastructure. It acts as a buffer against attacks that take advantage of kernel vulnerabilities, thus helping to maintain the integrity and availability of services in the Kubernetes environment.
Ensure that the --make-iptables-util-chains argument is set to true
Ensure that the --make-iptables-util-chains argument is set to true
- The policy ensures that the Kubernetes Kubelet process creates utility chains for services, thus improving the organization and control over firewall policies within the Kubernetes nodes.
- Enabling —make-iptables-util-chains improves security by implementing pre-defined chains in the iptables, which provide a systematic way to handle packets, instead of having individual rules for each packet, reducing chances of misconfiguration.
- This policy, when enforced, reduces the risk of network-based attacks on the Kubernetes clusters. The defined iptables chain helps protect the deployed entities such as CronJob, DaemonSet, Deployment, Job, Pod, etc. which are integral parts of a Kubernetes-based application.
- Non-compliance to this policy could lead to unnecessary exposure of the internal networks and application resources, making them susceptible to attacks such as Denial of Service (DoS), potentially disrupting business functions.
Ensure that the --hostname-override argument is not set
Ensure that the --hostname-override argument is not set
- This policy ensures the stability and reliability of your infrastructure by maintaining the original hostname in Kubernetes, instead of overriding it with a different value, which could potentially lead to conflicts or inconsistencies.
- The policy reduces the risk of DNS issues or routing problems, as changing the hostname can affect how services communicate within the Kubernetes cluster, potentially leading to service disruptions or outages.
- This policy is critical for security because if an attacker gains access to the Kubernetes CLI or API, they could potentially use the —hostname-override argument to redirect or spoof traffic, gaining unauthorized access to data or services.
- By ensuring the —hostname-override argument is not set, the policy supports best practices for Kubernetes configuration management, improving the overall operational efficiency and simplicity of your deployment process.
Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture
Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture
- This policy ensures correct logging of Kubernetes events by setting the —event-qps argument to 0 or a level that guarantees optimal event capture. Proper logging is integral for auditing, troubleshooting, and security monitoring.
- Applying this rule provides an effective mechanism to dictate the rate at which events can be generated by the Kubernetes’ Kubelet component, this helps in averting events overload which could potentially cause a denial of service attack or hinder system performance.
- Violating this policy could lead to missing critical system events or inconsistencies in system logs, hampering the ability to detect and respond to security incidents in a timely manner, thereby increasing the security risk.
- The implementation of this policy impacts multiple Kubernetes entities (CronJob, DaemonSet, Deployment, etc.), reinforcing the uniformity in event logging across diverse object types, ensuring that vital information is not lost or overlooked, which is crucial for the all-round stability and security of system.
Ensure that the --rotate-certificates argument is not set to false
Ensure that the --rotate-certificates argument is not set to false
- This policy ensures continual rotation of certificates, mitigating the risk of certificate spoofing or Man-in-the-Middle (MitM) attacks, increasing the security and integrity of the system.
- Enabling the —rotate-certificates argument helps in maintaining up-to-date certificates and decreasing the possibility of an expired certificate causing disruption in services or communication, therefore enhancing uptime and reliability.
- Non-compliance to this policy can result in outdated or expired certificates being used, which in adverse circumstances can lead to service interruption or a complete shutdown of the Kubernetes system.
- By ensuring the renewal of certificates frequently, this policy aids in system audit and compliance by aligning with best security practices and data and communication encryption regulations.
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers
- Utilizing strong cryptographic ciphers in Kubelet is essential for protecting sensitive data during transmission by encrypting it. This ensures that data remains secure, even if it is intercepted, enhancing data integrity and confidentiality.
- Establishing this policy is significant in preventing possible cyber threats, like Man-in-the-Middle (MitM) attacks, where attackers can read, modify, and relay messages between a sender and a receiver without their knowledge.
- The policy directly affects various Kubernetes entities such as CronJob, DaemonSet, and Pod. Improper configuration of cryptographic ciphers in these entities can make them a potential weak link in the security chain and thereby endanger the entire infrastructure.
- Enforcement of strong cryptographic ciphers in Kubelet promotes trust and reliability in the system among users and stakeholders due to enhanced security. It conforms to best practices in security compliance and can assist in meeting regulatory requirements, thereby avoiding potential legal and financial repercussions.
Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742
Prevent NGINX Ingress annotation snippets which contain LUA code execution. See CVE-2021-25742
- This policy prevents potential malicious activities within the NGINX Ingress annotations which were found to allow execution of arbitrary LUA code, as informed by the CVE-2021-25742 vulnerability report.
- The policy’s adherence ensures Kubernetes-based applications are not susceptible to unauthorized code execution that could lead to data breaches or service disruptions.
- It aids in fortifying the security of Ingress resources in a Kubernetes environment, a critical component that manages external access to services within the cluster, thus securing the entire flow of information.
- It facilitates enforcement of best practices for Infrastructure as Code (IaC), enhancing the overall integrity, reliability, and resilience of development and operational processes in a Kubernetes environment.
Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742
Prevent All NGINX Ingress annotation snippets. See CVE-2021-25742
- This policy prevents All NGINX Ingress annotation snippets, addressing a weakness outlined in CVE-2021-25742, which could allow potential unauthorized network access by malicious actors, jeopardizing the integrity, confidentiality, and availability of data in the infrastructure.
- In line with Infrastructure as Code (IaC) principles, the reason for this policy is to ensure secure configuration of Kubernetes Ingress resources, reducing risks associated with misconfigurations that could lead to potential breaches.
- Strictly enforcing this policy helps maintain control over network traffic in Kubernetes environments, as the Nginx Ingress controller plays a key role in routing external HTTP/HTTPS traffic to backend services within clusters, which is crucial in ensuring secure and expected application behavior.
- Failure to implement this policy could expose Kubernetes applications to traffic injection attacks. Respectively, successful adherence can significantly reduce vulnerabilities, safeguarding crucial IT systems and improving overall operational security posture.
Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742
Prevent NGINX Ingress annotation snippets which contain alias statements See CVE-2021-25742
- The policy prevents potential security vulnerabilities as it mitigates misuse of alias statements in NGINX Ingress annotation snippets, which could be exploited under CVE-2021-25742.
- It promotes good security practices and adherence to recommended infrastructure as code (IaC) configuration strategies for NGINX on a Kubernetes platform.
- By disallowing alias statements, the policy eliminates the risk of unauthorized modification in hosted resources, which could lead to unauthorized data access.
- This policy encourages a higher level of control and integrity within NGINX ingress configurations in a Kubernetes environment, improving overall system security and resiliency.
Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations
Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations
- Minimizing ClusterRoles that have control over validating or mutating admission webhook configurations is key to mitigating risks associated with granting excessive permissions, which could potentially allow malicious users to alter the behaviour of existing services in a Kubernetes cluster.
- This policy ensures that only necessary roles have the ability to control webhooks, thereby reducing the attack surface and enhancing the security posture of the overall system protecting the integrity of application data.
- Application of this policy also helps in compliance with various security standards and best practices as it strictly enforces the principle of least privilege.
- Non-compliance to this policy could lead to possible unauthorized access leading to data breaches or service disruptions, which not only compromises the system but also leads to reputational damage and potential legal liabilities for the entity.
Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests
Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests
- This policy is important because it helps in limiting the number of entities that have access to approve CertificateSigningRequests, reducing the risk of unauthorized or accidental approval.
- The policy enforces Principle of Least Privilege (PoLP), ensuring that ClusterRoles only have necessary privileges. This minimizes potential for damage if a ClusterRole’s credentials are compromised.
- By minimizing ClusterRoles that grant permissions to approve CertificateSigningRequests, it reduces the attack surface area, making it harder for malicious entities to gain access.
- It enforces good security hygiene practices, making entities accountable and trackable for their actions, thus improving overall security posture and compliance with standards and regulation.
Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings
Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings
- This policy is crucial as it helps in reducing the risk of unauthorized access in the Kubernetes environment. Limiting the number of Roles and ClusterRoles that can bind RoleBindings or ClusterRoleBindings prevents users from acquiring permissions beyond what they need, promulgating the principle of least privilege.
- It prevents potential internal threat incidents, where a user with too broad permissions can intentionally or accidentally perform high-impact actions. By reducing the number of roles that can bind RoleBindings or ClusterRoleBindings, it constrains users’ capabilities, making the overall environment more secure.
- The policy helps to implement granular access control and facilitate consistent adherence to permission rules, thus allowing for a more manageable and scalable system. This is important in large Kubernetes environments where managing permissions can become complicated without properly defined roles.
- It can mitigate the impact of external security breaches. In case an attacker gains access, they will be limited to the permissions of a particular role and unable to elevate their permissions by creating or binding to another Role or ClusterRole. Therefore, it adds an extra layer of defense against privilege escalation attacks.
Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles
Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles
- This policy is critical in reducing the attack surface in a Kubernetes environment by minimizing the number of Roles and ClusterRoles that have permissions to escalate other Roles or ClusterRoles, possibly limiting potential damage should a break-in occur.
- By ensuring that these rights are not unnecessarily widespread, it makes it far more difficult for bad actors to gain access to sensitive information or cause disruptions by elevating their privileges, thereby enhancing the overall security posture.
- Adhering to the principle of least privilege, this policy diminishes the risk of inside threats where internal users with excessive permissions may inadvertently set malicious activities in motion or be exploited by malware or hackers.
- Misconfigured roles rights are common vulnerability points in Kubernetes, making this policy integral for enforcing strong access control practices and maintaining a robust, secure infrastructure.
RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding
RoleBinding should not allow privilege escalation to a ServiceAccount or Node on other RoleBinding
- This policy prevents unauthorized privilege escalation, which can compromise systems by allowing unwanted access to a ServiceAccount or Node on other RoleBinding. This helps maintain the security of the infrastructure and keeps resources accessible only to authorized users.
- The policy ensures that every user within the Kubernetes Cluster has a defined role and can only operate within the confines of that role. It serves as a safeguard against rogue access or inadvertent access, which can lead to unintended consequences.
- Implementing this policy effectively reduces risk and assists in regulatory compliance, as enforcing privilege controls and maintaining least privilege access are key security principles mandated in many regulatory frameworks.
- The policy facilitates better auditing of user actions and accountability within the Cluster. If users cannot escalate their privileges, all their actions can be reliably traced back to their specific roles, encouraging proper usage of the cluster resources and enhancing overall security.
Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation
Granting `create` permissions to `nodes/proxy` or `pods/exec` sub resources allows potential privilege escalation
- This policy is crucial in maintaining a secure Kubernetes environment, as granting
createpermissions tonodes/proxyorpods/execsub resources could give users or entities too much control over the system. This would make it easier for those with malicious intent to escalate their privileges and compromise the system. - The potential for privilege escalation represents a significant security threat. If a malicious actor manages to compromise a less privileged user or component of the system, they could leverage these permissions to elevate their access rights and perform unauthorized actions, such as altering the Kubernetes configuration, deploying malicious containers, or accessing sensitive data.
- Implementing this policy drastically reduces the attack surface of the Kubernetes cluster by preventing inappropriate access to these critical sub resources. This in turn can stop the propagation of an attack, potentially containing it before any significant damage is done.
- It provides a safeguard against poor security practices such as over-permissioning, where roles are given more privileges than they need to perform their tasks. By limiting the
createpermissions for thenodes/proxyorpods/execsub resources, the policy ensures the principle of least privilege is upheld across the Kubernetes environment, thereby enhancing overall security.
No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts
No ServiceAccount/Node should have `impersonate` permissions for groups/users/service-accounts
- This policy is crucial in preventing unauthorized access and potential security exploits.
Impersonatepermissions allow an account to act as another user, which can pose serious threats if leveraged by malicious actors. - It upholds the principle of least privilege by ensuring that no ServiceAccount/Node is granted more access than necessary. Limiting permission to
impersonategreatly reduces the potential surface area for attacks. - Violation of this rule can lead to devastating security incidents including data breaches and illegal activities being carried out under pseudo identities, which could harm organization’s reputation and result in heavy regulatory fines.
- Adhering to this policy promotes accountability and traceability within the Kubernetes infrastructure. By disallowing impersonation, we can accurately track and audit user activities, ensuring each action is connected to an identifiable user.
ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster.
ServiceAccounts and nodes that can modify services/status may set the `status.loadBalancer.ingress.ip` field to exploit the unfixed CVE-2020-8554 and launch MiTM attacks against the cluster.
- The policy mitigates the risk of a Man-in-the-Middle (MiTM) attack, which involves an attacker intercepting and possibly altering communications between two parties without their knowledge, by regulating who can modify crucial service statuses.
- It safeguards against potential attack vectors, such as the specified vulnerability CVE-2020-8554, that specifically attempt to exploit this field. By preventing compromised ServiceAccounts and nodes from modifying
status.loadBalancer.ingress.ip, the policy reduces the attack surface. - Ensuring compliance with this policy aids in maintaining the robust security posture of Kubernetes clusters by assigning and enforcing precise permission levels on ClusterRole, ClusterRoleBinding, Role, and RoleBinding entities.
- This policy also ensures the stability and integrity of the Kubernetes infrastructure. Preventing unauthorized modification of
status.loadBalancer.ingress.iphelps maintain the expected service state and reduces the possibility of service disruptions, improving the cluster’s reliability and uptime.
No ServiceAccount/Node should be able to read all secrets
No ServiceAccount/Node should be able to read all secrets
- This policy is vital as it prevents unauthorized access to sensitive data because Kubernetes secrets are meant to hold sensitive information like API keys, passwords, tokens, etc. Allowing ServiceAccount/Node to read all secrets could leak sensitive data to mal-intended users.
- It maintains the principle of least privilege (PoLP) by restricting the access or permissions a service account or node has in reading secrets. Implementing such policy ensures that every part of the system only has accesses necessary for its legitimate purpose.
- The policy lowers the overall risk of insider threats and breaches as in case of a compromise of a service account or node, the damage is limited because access to other secrets is denied.
- Implementing such policy allows for improved audit and compliance as this follows best security practices for handling sensitive data, which can be critical for regulatory compliance in some industries.
Minimize the admission of pods which lack an associated NetworkPolicy
Minimize the admission of pods which lack an associated NetworkPolicy
- This policy acts as a safety net that prevents any pods from operating without a defined NetworkPolicy. This ensures that no pod is running with an insecure, undefined, or default network configuration, which could potentially expose the system to security threats.
- Imposing this policy reduces the potential attack surface within Kubernetes deployments, as every pod is permitted to communicate based on explicitly defined rules, reducing the chance of unauthorized access or data leakage.
- The policy aids in managing network traffic effectively by controlling ingress and egress traffic. It ensures that every pod handles the traffic flow in a manner that adheres to the security protocols of the organization, thus upholding data confidentiality and integrity.
- The policy also enforces best practices in Kubernetes deployments and pod creations. It fosters a culture of security in the development process, reducing oversights and vulnerabilities in the production environment.
Ensure no hard coded Linode tokens exist in provider
Ensure no hard coded Linode tokens exist in provider
- Ensuring no hard coded Linode tokens exist in the provider is crucial as hardcoded secrets can be easily discovered and can lead to unauthorized access to Linode resources, resulting in potential data exposure, loss, or disruption of services.
- This policy emphasizes the principle of least privilege where the system permits only the necessary access rights for tasks, eliminating the risk of tokens being used beyond their intended scope.
- Utilizing a secure secrets management system instead of hardcoding Linode tokens in the provider prevents potential human errors and security vulnerabilities, like accidental check-ins to version control systems.
- Implementing this policy makes the system less prone to attacks, as it would require tampering of the secrets management system, which is designed with multiple security controls in place, to gain access to the tokens.
Ensure SSH key set in authorized_keys
Ensure SSH key set in authorized_keys
Ensure email is set
Ensure email is set
- The policy ‘Ensure email is set’ is important because it ensures that there’s a channel for communication between the system and its users. This helps in conveying important information, system updates, or alerts such as when suspicious activities are detected, ensuring quick action can be taken.
- Its absence may lead to insufficient user management, for instance, if email verification is required for user authentication and such email is not set, maintaining system integrity and security would be challenged.
- Without the adequate set up of user emails, there could be difficulty tracking activities attached to a particular account especially when an anomaly is detected, thus making incident response ineffective.
- Setting up email as described in the policy also aids in password recovery, account updates, and user notifications. The absence of this might result in increased administrative burden and poor data security in case of a compromise.
Ensure username is set
Ensure username is set
- Ensuring a username is set in a Linode user account helps in defining a unique identity for each user, enhancing security by preventing impersonation and ensuring accountability for actions taken within the system.
- The policy of setting a username prevents the possibility of anonymous access to resources. This ensures that every operation or transaction can be traced back to an individual user, thus providing a robust audit trail in case of any security breach.
- In the event of any unforeseen security issues, having a username-set policy allows for quicker identification and response to the issue, as it would be easier to isolate the compromised account based on the unique username.
- Implementing this policy through Infrastructure as Code (IaC) like Terraform allows for scalable and efficient roll-out across multiple Linode users, making robust security easier to manage and maintain.
Ensure Inbound Firewall Policy is not set to ACCEPT
Ensure Inbound Firewall Policy is not set to ACCEPT
- This policy ensures that the inbound firewall is not set to accept all incoming traffic without any scrutiny, which significantly reduces the risk of a network intrusion or attack by limiting access only to known, trusted sources.
- The policy as implemented in Terraform makes use of Infrastructure as Code (IaC), which allows for consistent, repeatable, and auditable changes to the firewall setting, helping to avoid human errors or misconfigurations that could compromise security.
- If an inbound firewall policy is set to ACCEPT, it may lead to excessive exposure of the Linode resources, thereby increasing their vulnerability to data breaches, denial-of-service attacks, and other cybersecurity threats.
- By enforcing this policy, organisations can better comply with security best practices and regulatory standards, thus maintaining customer trust, avoiding potential legal issues, and ensuring the resilient and secure operation of their network infrastructure.
Ensure Outbound Firewall Policy is not set to ACCEPT
Ensure Outbound Firewall Policy is not set to ACCEPT
- Ensuring that the Outbound Firewall Policy is not set to ACCEPT is crucial for preventing unauthorized and potentially malicious data transmission from the network, bolstering the overall network security of the infrastructure.
- The policy improves control over network traffic by forcing each outbound communication to be explicitly allowed, reducing the risk of data leaks or exposure of sensitive information.
- A policy of unrestricted outbound access can lead to a compromised system used as a launch pad for attacks, spam, or other malicious activities. Therefore, setting the policy to something other than ACCEPT mitigates potential misuse of resources.
- Implementing this policy via Infrastructure as Code (IaC) platform like Terraform, allows for automated and consistent security measures across multiple deployments, enhancing the efficiency and reliability of security policies application.
Ensure every access control groups rule has a description
Ensure every access control groups rule has a description
- Ensuring every access control group rule has a description enhances clarity on the purpose of each rule, making it easier for administrators and users to understand and manage permissions and security levels in an organized and efficient manner. This ultimately optimizes the user experience and increases productivity.
- Detailed descriptions of access control group rules offer auditors and security professionals an easier time during compliance checks. They can quickly understand the rationale behind rules without having to sift through convoluted code, thus improving efficiency and accuracy of compliance audits.
- Without adequate descriptions, misconfigurations can easily occur in the Terraform Infrastructure as Code setup. This can lead to unintended security vulnerabilities, making the infrastructure susceptible to breaches and attacks, hence compromising the integrity and confidentiality of data.
- The policy minimizes risk of unauthorized access or insider threats, as it becomes easier to identify and rectify any over-permissive rules. Each rule description allows security teams to verify that only the necessary access levels are granted to users and devices, thereby enforcing the principle of least privilege effectively.
Ensure no security group rules allow outbound traffic to 0.0.0.0/0
Ensure no security group rules allow outbound traffic to 0.0.0.0/0
- This policy helps to prevent potential data breaches by blocking all outbound traffic, thus limiting the routes that could potentially be taken advantage of by a malicious actor or malware.
- Implementing the policy minimizes the attack surface by restricting the outbound traffic to specific IP addresses only instead of allowing it to any destination.
- In case of a system compromise, this policy helps in hindering the attacker’s ability to export data or establish a connection from the compromised system to an external one.
- Enforcing such a policy could help meet compliance with many security standards and regulations, demonstrating the company is taking proactive measures to protect sensitive client and business data from unauthorized access.
Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22
Ensure no access control groups allow inbound from 0.0.0.0:0 to port 22
- This policy is important because it prevents potential unauthorized access to systems by limiting connections to port 22, which is typically used for secure shell (SSH) remote administration, effectively barring any IP address (0.0.0.0:0 signals any IP from any port) from connecting.
- The policy reduces the risk of brute force attacks by preventing unrestricted access, as would be the case if all IP addresses were allowed. This effectively shields systems from potential attackers who could exploit an open port 22 to gain control or compromise internal systems.
- The policy enforces a more secure usage of port 22 only by specified IPs, enhancing overall infrastructure security by enabling only trusted and approved IP addresses to connect, minimizing the risk of data breaches or system compromises.
- With this policy in place, security teams can exercise more control over network traffic and monitor for any suspicious activity more effectively, ensuring that all inbound network connections are vetted and are within organizational policies, thus refining incident response.
Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389
Ensure no access control groups allow inbound from 0.0.0.0:0 to port 3389
- This policy is important as it prevents unrestricted access from all IP addresses (0.0.0.0:0) to a specific port (3389), used commonly for Remote Desktop Protocol (RDP). This reduces the possibility of unauthorized access and makes a system less prone to attacks by tightening the security perimeter.
- Limiting inbound traffic to port 3389 to specific IP addresses or ranges increases the security of machines running Remote Desktop Services, as the exposure to the internet and potential malicious activity is significantly reduced.
- Without this policy, unfettered access to port 3389 would make systems vulnerable to brute-force attacks where attackers might eventually guess correct login credentials, leading to potential system compromise, data theft, and misuse.
- It helps maintain a principle of least privilege by allowing only specific, necessary access, making sure that no extra permissions are granted unintentionally which could get exploited by malicious entities. It also aids in achieving regulatory compliance related to data and system security.
Ensure Server instance is encrypted.
Ensure Server instance is encrypted.
- The policy ensures that the data stored on the server instance is secure and protected from unauthorized access, thus reducing the risk of sensitive data exposure.
- It mandates encryption at rest of the server instance, enhancing confidentiality of the data stored on disk and protecting it even if the server host is compromised.
- Proper implementation of this policy, using tools like Terraform, facilitates compliance with regulations and standards such as GDPR and HIPAA which demand rigorous data protection measures, minimizing legal and reputational risks.
- The policy, when applied using IaC approach, makes infrastructure security more streamlined, repeatable, and less prone to human error, strengthening an overall security posture of the organization.
Ensure Basic Block storage is encrypted.
Ensure Basic Block storage is encrypted.
- The policy ensures that data at rest in Basic Block storage is encrypted, providing an extra layer of security to protect sensitive information from unauthorized access and potential data leaks.
- Encrypting Basic Block storage helps in complying with privacy regulations and industry standards, such as GDPR and PCI DSS, which require data encryption.
- By adhering to this policy, businesses can enhance their reputation for security, consequently improving customer trust. Non-compliance, conversely, might lead to financial and reputational damage.
- Using Terraform as Infrastructure as Code tool simplifies the enforcement of this policy across all ncloud_launch_configuration resources, making the cloud environment more secure and less prone to configuration errors or oversights.
Ensure no NACL allow inbound from 0.0.0.0:0 to port 20
Ensure no NACL allow inbound from 0.0.0.0:0 to port 20
- This policy prevents unrestricted inbound traffic to port 20, which is typically used for FTP data transfers. By not allowing inbound from 0.0.0.0:0 (any IP address), it can help to mitigate potential unauthorized access and data breach.
- Ensuring this rule can reduce the risk of exposing sensitive data during file transfers if the FTP sevice is misconfigured or not properly secured. Thus, it helps protect the confidentiality of transferred files.
- Policies like this contribute to maintaining a least privilege model, as not all external entities should have access rights to exchange data through port 20. This strengthens the security posture by reducing potential attack vectors.
- Enforcing this policy could help comply with many data protection regulations, such as GDPR and HIPAA, that require the implementation of strong access control measures to protect sensitive information, demonstrating compliance and avoiding potential fines.
Ensure no NACL allow inbound from 0.0.0.0:0 to port 21
Ensure no NACL allow inbound from 0.0.0.0:0 to port 21
- The policy restricts access to port 21 from any IP address (0.0.0.0:0), reducing the attack surface by limiting the number of potential entry points for malicious activities, such as brute force attacks.
- This rule specifically protects against unauthorized FTP (File Transfer Protocol) connections, since port 21 is typically used for FTP, thus preventing potential data breaches.
- By using Infrastructure as Code (IaC) tool such as Terraform, the policy ensures consistent enforcement across various cloud environments, which improves the overall security posture and reduces the likelihood of misconfiguration.
- The policy applies to ‘ncloud_network_acl_rule’ entities, helping to maintain network segmentation and isolation that is crucial for containing attacks and limiting their lateral movement within the network.
Ensure no NACL allow inbound from 0.0.0.0:0 to port 22
Ensure no NACL allow inbound from 0.0.0.0:0 to port 22
- This policy is critical as it prevents unauthorized access to system resources by blocking unrestricted inbound traffic on port 22, thereby reducing the risk of successful cyber-attacks such as brute-force and denial of service.
- The policy aligns with best security practices by restricting inbound traffic from all IP addresses (0.0.0.0:0), effectively reducing the attack surface, making it more difficult for an intruder to find and exploit vulnerabilities in the system.
- Infrastructure as Code (IaC) tools like Terraform can be used to implement and enforce this policy across the infrastructure dynamically and consistently, minimizing human error and the likelihood of security misconfiguration.
- Adherence to this policy might lead to an improved security posture for ncloud_network_acl_rule resources by strengthening the network access control list (NACL) restrictions, which can ultimately help the business entities meet compliance standards and pass security audits.
Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389
Ensure no NACL allow inbound from 0.0.0.0:0 to port 3389
- This policy ensures the prevention of unauthorized access, reducing risk of cyber attacks such as brute force or DDoS. Inbound access from 0.0.0.0:0 means allowing all IP addresses access, which could potentially include malicious entities.
- By restricting inbound access to port 3389, it decreases the potential exploitation through Remote Desktop Protocol (RDP) attacks. Port 3389 is typically used for Windows RDP, which if left unsecured, provides an attackers a gateway into the network.
- Enforcing this policy increases the need for explicit identification of IP addresses that should be allowed access, encouraging better control and visibility over network connections and contributing to the overall robustness of the organization’s cybersecurity strategy.
- Violation of this policy could lead to a potentially insecure infrastructure setup, jeopardizing compliance with various data protection regulations and corporate policies. It could also expose sensitive data to risk, causing reputational damage and potential financial losses in the event of a breach.
An inbound Network ACL rule should not allow ALL ports.
An inbound Network ACL rule should not allow ALL ports.
- Allowing all ports in an inbound Network Access Control List (NACL) rule greatly increases the attack surface, making the network susceptible to unauthorized access and potential cyberattacks.
- When all ports are open, it makes it harder to track and monitor network traffic effectively, as essential data might get lost in a sea of non-essential traffic, impeding the detection or investigation of suspicious activities.
- Having a policy to restrict all ports from being accessible discourages practices of defaulting to ‘Open-All’ configurations, which can happen when specific access needs are unclear, leading to heightened risks.
- Implementing this policy in a Infrastructure-as-Code (IaC) tool like Terraform, as suggested by the NACLPortCheck.py resource, allows for a centralized, programmatic control of network security policies, improving overall security management and compliance.
Ensure LB Listener uses only secure protocols
Ensure LB Listener uses only secure protocols
- This policy ensures that only secure protocols are used for communication by load balancer listeners. Using insecure protocols can expose the network to potential vulnerabilities and attacks.
- The implementation of this policy via Terraform promotes infrastructure as code (IaC) practice, enabling automatic enforcement and thus reducing the risk of any manual configuration errors.
- The strict usage of secure protocols is fundamental for the overall security of the cloud infrastructure. Any breach could lead to data loss, unauthorized access or even the disruption of the service hosted by the load balancer.
- With this security policy in place, entities ‘ncloud_lb_listener’ abide by the standard of privacy and security compliance while allowing traffic, thereby providing a significant impact on the organization’s security posture.
Ensure NAS is securely encrypted
Ensure NAS is securely encrypted
- This policy helps ensure that data stored on network attached storage (NAS) devices on ncloud_nas_volume is encrypted, providing an added layer of security and making data unreadable to unauthorized users.
- Having NAS encryption enabled as per this policy prevents potential breaches from resulting in valuable data loss or exposure, as attackers cannot decipher the encrypted information.
- This policy protects the integrity and confidentiality of data in transit and at rest on the NAS, improving overall data privacy and compliance with data protection regulations such as GDPR and HIPAA.
- Using Infrastructure as Code (IaC) tool like Terraform for encryption ensures a consistent and audit-ready infrastructure setup, thereby decreasing the likelihood of configuration errors and security vulnerabilities.
Ensure Load Balancer Target Group is not using HTTP
Ensure Load Balancer Target Group is not using HTTP
- Ensuring Load Balancer Target Group is not using HTTP enhances data security by mitigating the risks of data interception, tampering, and identity theft that are common with unencrypted HTTP communication.
- This policy enhances compliance with security standards and regulations that require encrypted communication for transmission of sensitive data.
- Implementing this policy reduces potential points of entry for attackers, thereby improving the overall infrastructure resiliency against cyber attacks.
- Through Terraform, this policy ensures a consistent application of security configurations across multiple environments, reducing configuration errors and improving manageability.
Ensure Load Balancer isn't exposed to the internet
Ensure Load Balancer isn't exposed to the internet
- Ensuring that the Load Balancer isn’t exposed to the internet prevents unauthorized access and potential security breaches, as malicious actors can exploit vulnerabilities or launch DDoS attacks if the LB is publicly accessible.
- Compliance with the policy decreases the risk of data loss or tampering which could occur if the Load Balancer, which manages network traffic, is compromised.
- Abiding by the policy contributes to a defense-in-depth security strategy by providing an additional layer of protection for the resources and services behind the Load Balancer.
- Implementing the policy via Infrastructure as Code using Terraform facilitates consistent, automated application of secure configurations across numerous ‘ncloud_lb’ resources, reducing configuration errors and increasing operational efficiency.
Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks.
Ensure that auto Scaling groups that are associated with a load balancer, are using Load Balancing health checks.
- Ensuring auto Scaling groups use Load Balancing health checks is vital as it enables automatic adjustment of system capacity according to the incoming traffic. This helps to maintain high availability and fault tolerance, thereby ensuring the system is always stable and up.
- Implementation of this policy ensures the system can handle unexpected surges or drops in traffic, hence promising continuous service provision even during peak or off-peak hours. It will ensure there is neither over-provision nor under-provision of resources.
- Enforcing this policy will reduce chances of system failure due to overloading since the Load Balancing health checks will ensure that no single server is overworked. This promotes the even distribution of workloads among all servers in the auto Scaling group.
- Commitment to this policy helps in cost optimization, as the scaling in or out in accordance to the demand lowers infrastructure costs. By auto Scaling, you only use and pay for what you need per time. This can result significant savings when dealing with fluctuating workloads.
Ensure Naver Kubernetes Service public endpoint disabled
Ensure Naver Kubernetes Service public endpoint disabled
Ensure Routing Table associated with Web tier subnet have the default route (0.0.0.0/0) defined to allow connectivity
Ensure Routing Table associated with Web tier subnet have the default route (0.0.0.0/0) defined to allow connectivity
- Ensuring that the routing table associated with the web-tier subnet includes a default route allows all traffic not matched by any other routes to be routed through a common path. Without a default route, this unmatched traffic might not be handled, disrupting service availability.
- The policy helps to maintain the continuity and reliability of web services by guaranteeing that every packet sent to the web-tier subnet will have a routing pathway, regardless of the destination IP address.
- By properly configuring the default route, this action can prevent unnecessary network latency and potential packet loss, which can impact user experience on web services.
- Compliance with this policy can enhance network security by reducing the potential for unauthorized traffic in the web-tier subnet. In absence of a default route, unmatched traffic could potentially be exploited for malicious activities.
Ensure NKS control plane logging enabled for all log types
Ensure NKS control plane logging enabled for all log types
- Enabling NKS control plane logging for all log types helps monitor and record all activities and events on your ncloud_nks_cluster, ncloud_route_table, ncloud_subnet resources, ensuring traceability for any security audits or anomaly investigations.
- This policy enhances visibility over the infrastructural operations of the entity it is applied to, enabling quick detection and rectification of potential security flaws or breaches thereby supporting proactive security measures.
- The policy guarantees compliance with crucial security standards and best practices by mandating the active logging of all events, contributing to the overall robustness and reliability of the IT environment.
- With Infrastructure as Code (IaC) using Terraform, policy enforcement becomes an automated process, reducing the risk of human error which could lead to potential security gaps, and maintaining a highly secure state of the infrastructure resources.
Ensure Server instance should not have public IP.
Ensure Server instance should not have public IP.
- Ensuring the server instance does not have a public IP increases the security of the server by reducing the number of potential entry points for malicious users or software, thereby decreasing the risk of unauthorized access.
- This security policy is especially relevant for systems that store sensitive data, as a public IP address would make them more visible and accessible to potential intruders, significantly increasing the risk of data breaches.
- Implementing this policy can result in significant cost savings in the long run. It reduces the risk of potential damage and loss from a cyber attack, and ensures the system architecture adheres to security best practices, thereby reducing time and resources spent on dealing with security incidents.
- Using infrastructure as code tools like Terraform to enforce this policy ensures a consistent and reliable application of the policy across all the servers regardless of their physical or virtual locations. This makes the infrastructure more secure and easier to manage for the IT team.
Ensure Load Balancer Listener Using HTTPS
Ensure Load Balancer Listener Using HTTPS
- This policy ensures that the load balancer only accepts HTTPS traffic, providing a secure connection for data transmission. It will reject HTTP traffic which is not secure and any data transmitted over it can be easily stolen.
- Implementing this policy in the existing Terraform IaC will help enforce the secure use of HTTPS protocol, significantly reducing the risk of possible data breaches or cyber attacks due to unencrypted data communication.
- Strict adherence to this policy minimizes the risk of transmitting sensitive details such as user authentication details, credit card information etc., without encryption. Thus, ensuring that these details are always sent over secured networks, thereby avoiding potential data theft.
- The policy imposes better control over the web traffic, allowing the admin to enforce secure communication and easily track any potential violation attempts. It also helps meet certain legal and compliance requirements relating to data security, privacy, and encryption.
Ensure no access control groups allow inbound from 0.0.0.0:0 to port 80
Ensure no access control groups allow inbound from 0.0.0.0:0 to port 80
- This policy is important to limit exposure of resources to potential exploitation, as allowing inbound traffic from 0.0.0.0/0 (all IPv4 addresses) to port 80 opens the door for unauthorized access attempts or attacks on HTTP service from any source.
- Ensuring no access control groups allow inbound from 0.0.0.0/0 to port 80 reduces the potential risk of Distributed Denial of Service (DDoS) attacks, which overwhelm the system with traffic, causing service disruptions.
- By enforcing this policy, we ensure the principle of least privilege is adhered, where resources are only accessible to those entities that absolutely need it, further enhancing the overall security posture of the infrastructure.
- The impact of this policy would be elevated control and monitoring over network traffic, thereby ensuring transparent and secure operations within the infrastructure, and compliance with best security practices. This in turn, contributes to safeguarding the integrity, confidentiality, and availability of infrastructure resources.
Ensure Access Control Group has Access Control Group Rule attached
Ensure Access Control Group has Access Control Group Rule attached
- This policy helps solidify the principle of least privilege by ensuring that access permissions are explicit and defined through Access Control Group Rules, reducing the likelihood of unauthorized access.
- It establishes a clear link between Access Control Groups and their corresponding rules, providing a ncloud-specific, structured way to manage access, which improves understandability and ease of management.
- Prevents potential misconfigurations or oversights in access control settings, ensuring that no Access Control Group exists without an explicit rule, thereby reducing potential security gaps.
- By validating this policy with Terraform- a popular tool for defining and provisioning data center infrastructure- users can manage access controls more efficiently and increase the predictability of their infrastructure, facilitating Infrastructure as Code (IaC) practices.
Ensure no hard coded OCI private key in provider
Ensure no hard coded OCI private key in provider
- Hard coding OCI private keys in Terraform providers can potentially expose highly sensitive information, allowing unauthorized individuals to have access to your infrastructure hosted on Oracle Cloud Infrastructure (OCI).
- Breaching this policy by hardcoding keys could result in an attacker gaining complete control over OCI environments, thus damaging the integrity, confidentiality, and availability of your cloud resources.
- This policy promotes better security practices, such as secret management or utilizing environment variables, thereby ensuring that credentials cannot be compromised or misused if your code is exposed or shared.
- By not hardcoding OCI private keys, you ensure regulatory compliance related to data security, as many governance, risk management, and compliance frameworks strictly dictate the handling of sensitive credentials in a secure manner.
Ensure OCI Block Storage Block Volume has backup enabled
Ensure OCI Block Storage Block Volume has backup enabled
- The policy aids in protection against unintended deletion or alteration of important data on OCI Block Storage Block Volume, by ensuring that a backup is always available in such instances.
- It acts as a safeguard against potential data losses that may emerge from malicious attacks, infrastructure failures, or human errors, ensuring business continuity.
- With the help of Infrastructure as Code (IaC) tool Terraform, it provides a programmable and automated way of implementing the backup policy across many OCI core volumes, enhancing efficiency and consistency.
- Non-compliance to the policy can lead to an inability to restore services to a functional state after an incident, which could disrupt business operations and lead to reputational and financial damage.
OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK)
OCI Block Storage Block Volumes are not encrypted with a Customer Managed Key (CMK)
- This policy highlights the lack of encryption with a Customer Managed Key (CMK), a type of data security measure, in OCI Block Storage Block Volumes, which may compromise the integrity and confidentiality of stored data.
- As the data stored in the unencrypted volumes can easily be accessed by unauthorized entities, it could lead to data loss, leaks, or manipulation, thereby violating compliance standards and hindering an organization’s reputation.
- The use of a Customer Managed Key (CMK) gives the customer full control over data encryption. Lack of a CMK would mean that the customer is dependent completely on the provider for data security, reducing visibility and control over their own security measures.
- The policy is implemented in Terraform, a widely used IaC tool. Any non-compliance with this rule could lead to exposing the terraform state files which contain sensitive information, hence can lead to a security breach if not encrypted properly.
Ensure OCI Compute Instance boot volume has in-transit data encryption enabled
Ensure OCI Compute Instance boot volume has in-transit data encryption enabled
- This policy ensures that all data transferred between the boot volume and the virtual compute instance in Oracle Cloud Infrastructure (OCI) is encrypted, protecting sensitive information from potential interception during transit.
- In-transit encryption avoids the risk of the boot volume’s data being exposed and prevents unauthorized access, ensuring business information and customer data remain confidential.
- Implementing this policy under the Infrastructure as Code (IaC) tool, Terraform, streamlines the process and minimizes human error, reinforcing secure practices in the setup and management of OCI compute instances.
- The policy upholds regulatory compliance for certain industries or regions where data encryption in transit is mandated, reducing the risk of potential fines or reputational damage.
Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled
Ensure OCI Compute Instance has Legacy MetaData service endpoint disabled
- Disabling the Legacy Metadata service endpoint in OCI Compute Instance significantly minimizes the risk of unauthorized accesses or data exposure, enhancing the overall security posture of the infrastructure by limiting potential attack surfaces.
- With the Legacy Metadata service endpoint disabled, it increases the resilience against certain kind of attacks like Server Side Request Forgery (SSRF), when a malicious actor might induce the server to make HTTP requests to an arbitrary URI using instance metadata.
- Ensuring this policy means moving towards updated practices and using newer versions, which are typically more secure due to advances in technology, additional features, and better response to identified vulnerabilities.
- Non-adherence to this policy may potentially violate compliance norms and industry standards such as PCI-DSS, HIPAA, or GDPR, which mandate strict regulations related to data privacy and security hence it can impact legal and financial standing of the entity.
Ensure OCI Compute Instance has monitoring enabled
Ensure OCI Compute Instance has monitoring enabled
- Enabling monitoring on an OCI Compute Instance is crucial for getting detailed insight into the performance of the instance, ensuring anomalies can be detected and addressed to guarantee optimal operation.
- This policy aids in the early identification of potential security threats, enabling faster response times and prevention of any serious damages to the instance or the integrity of the data stored on it.
- Monitoring enabled in the OCI Compute Instance allows for better management of system resources as infrastructure managers can accurately gauge usage trends and plan for capacity needs accurately, thereby ensuring efficiency and reducing operational costs.
- Implementing this policy via Infrastructure as Code (IaC) tool like Terraform, ensures consistency and repeatability in deployment, allowing for seamless scalability and agility in infrastructure management.
Ensure OCI Object Storage bucket can emit object events
Ensure OCI Object Storage bucket can emit object events
- This policy is crucial as it allows OCI Object Storage buckets to emit events such as creation, deletion or removal of objects, providing real-time feedback on bucket activity.
- It enhances security by enabling monitoring and alerting of unusual activity or unauthorized changes in the bucket, which can potentially be early indicators of a breach or malicious activities.
- It aids in satisfying compliance requirements that necessitate monitoring of access and modification of data. Without this policy, it would be challenging to track changes or trace issues back to their source.
- Leveraging Infrastructure as Code (IaC) capabilities with Terraform for implementing this policy ensures consistent application across all object storage buckets, reducing the risk of human error or oversights generally associated with manual configurations.
Ensure OCI Object Storage has versioning enabled
Ensure OCI Object Storage has versioning enabled
- Enabling versioning on OCI Object Storage ensures that all versions of an object are preserved, which allows for recovery of data if any accidental deletes or overwrites occur, thus it provides a backup mechanism for data.
- Versioning assists in maintaining data integrity by generating and saving unique versions each time an object is uploaded, hence ensuring that even if the object is compromised, its previous healthy instances remain available.
- Any changes made to Objects in Object Storage will be non-destructive due to versioning. This brings about a consistent and trackable framework, important for auditing and regulatory compliance.
- With versioning enabled, certain operations that would usually be permanent, such as deletion or overwriting data, are reversible. This adds an additional layer of protection against both accidental or malicious alterations.
Ensure OCI Object Storage is encrypted with Customer Managed Key
Ensure OCI Object Storage is encrypted with Customer Managed Key
- This policy ensures that data stored in OCI Object Storage is secured by encryption, adding an additional layer of protection from unauthorized access or potential data breaches.
- It mandates the use of Customer Managed Key which enables the customer to control and manage the security aspects of data encryption, thereby improving the reliability and confidentiality of the information.
- Non-compliance to this policy could expose sensitive data, making it easy for malicious entities to access and misuse it which might lead to significant financial and reputation damage.
- Implementing this policy through Infrastructure as Code (IaC) tool like Terraform automates the process, making it more efficient and less prone to human error, thus strengthening overall infrastructure security.
Ensure OCI Object Storage is not Public
Ensure OCI Object Storage is not Public
- The policy to ensure OCI Object Storage is not Public is important because it prevents unauthorized users from accessing and manipulating the stored data, securing sensitive information and maintaining data integrity.
- A public object storage could be potentially exploited by malicious parties for data breaches, causing reputational damage to the organization and possibly leading to legal liability.
- Ensuring private object storage can help meet data privacy regulations and compliance needs, as many laws mandate certain types of data cannot be publicly accessible.
- The enforcement of this policy through Infrastructure as Code (IaC) using Terraform allows consistent application across the infrastructure, removing human error and increasing operational efficiency.
OCI IAM password policy - must contain lower case
OCI IAM password policy - must contain lower case
- The OCI IAM password policy requiring a lower case enhances security by making user passwords less predictable and harder to guess or crack via brute force attacks, therefore improving the resilience of OCI identities against unauthorized access.
- Implementing this policy using Infrastructure as Code tool like Terraform allows for code-based configuration and easy replication across environments, maintaining a consistent security posture and reducing the likelihood of manual errors.
- The lack of lowercase letters in passwords could mean a weaker password strength, thus the enforcement of a lowercase rule ensures all generated passwords meet a certain strength threshold, protecting sensitive data within OCI resources against potential breaches.
- Violation of this policy could lead to non-compliance with established industry security standards and best practices, potentially jeopardizing the organization’s reputation, relationship with customers, and may lead to legal consequences, hence its importance.
OCI IAM password policy - must contain Numeric characters
OCI IAM password policy - must contain Numeric characters
- The OCI IAM password policy requiring numeric characters increases the complexity of passwords, thereby reducing the chances of password-related security breaches. The addition of numeric characters adds another layer of difficulty for attackers attempting to crack passwords.
- Implementing this policy in Terraform ensures standardization and enforcement of password security rules across all OCI identities. This offers consistency and security even in large scale infrastructures where manual monitoring may not be possible or effective.
- In the absence of this policy, users may create weak passwords only consisting of alphabets which can be easily guessed or cracked through brute-force attacks. By requiring numeric characters, this potential vulnerability is mitigated.
- The policy impacts the user onboarding process too, as users will have to be informed and educated about the imposed password requirements. This may slightly complicate the sign-up process but will significantly enhance the overall security posture of the OCI infrastructure in the long run.
OCI IAM password policy - must contain Special characters
OCI IAM password policy - must contain Special characters
- The policy enforces the use of special characters in passwords, which significantly enhances password strength and complexity, making it harder for attackers to guess or crack.
- It minimizes the risk of brute-force attacks where cybercriminals try millions of password combinations in a short amount of time.
- The implementation of this policy sets a security standard for password creation within the oci_identity_authentication_policy, which governs all Oracle Cloud Identity Access Management (OCI IAM) authentication processes.
- In compliance with best security practices, it directly impacts the security posture of the OCI IAM entity by reducing potential security vulnerabilities.
OCI IAM password policy - must contain Uppercase characters
OCI IAM password policy - must contain Uppercase characters
- Enforcing the use of uppercase characters in the OCI IAM password policy enhances security by adding complexity to passwords, making them more resistant to brute force and dictionary attacks, thereby protecting resources from unauthorized access.
- This policy also promotes better password hygiene among users within the oci_identity_authentication_policy, encouraging the use of a variety of characters instead of easily guessable, weak passwords.
- Non-compliance with this policy can expose the infrastructure, managed via Terraform, to unnecessary risk as attackers may easily crack simple, lowercase-only passwords, leading to possible data breaches and violations of compliance requirements.
- Implementing this policy rule has a direct impact on the overall security posture of the cloud environment, improving resilience to potential cyber threats, maintaining the integrity of the infrastructure and aiding in the fulfilment of regulatory and industry-specific standards related to the security of data and systems.
Ensure OCI File System is Encrypted with a customer Managed Key
Ensure OCI File System is Encrypted with a customer Managed Key
- This policy ensures the security and confidentiality of data stored in Oracle Cloud Infrastructure (OCI) file system, as encryption with a customer managed key provides an additional layer of security control compared to system managed keys.
- This policy mitigates threats such as unauthorized data access and data breaches by providing a unique encryption key that is solely controlled by the customer, ensuring only authorized access to the encrypted files in OCI file system.
- By adhering to this policy, organizations are able to meet various compliance standards like HIPAA, PCI DSS and GDPR, which often require companies to have control over their own encryption keys.
- The policy implementation with Infrastructure as Code (IaC) tool Terraform allows development teams to codify the security of their OCI file storage infrastructure, enabling an efficient and non-error-prone mechanism for implementing encryption.
Ensure VCN has an inbound security list
Ensure VCN has an inbound security list
- Ensuring a Virtual Cloud Network (VCN) has an inbound security list is crucial for managing incoming network traffic access to resources within the network. It acts as the first layer of defense, protecting sensitive data from unauthorized access.
- An inbound security list in a VCN dictates which sources have the right to send traffic to the instances residing in a subnet, controlling the type of traffic (based on protocols and port numbers) that can be received. Without it, all instances within the VCN might be exposed to malicious traffic.
- The mentioned policy is specifically beneficial in the adoption of Infrastructure as Code (IaC) using Terraform. It enables the automated establishment of inbound security rules, increasing the scalability, replicability, and manageability of complex network structures in cloud environments.
- Not adhering to this rule can lead to a serious security loophole where an attacker could gain unauthorized access, leading to data breach, system disruption or misuse of cloud resources. Strict compliance ensures a secure and optimized cloud infrastructure.
Ensure VCN inbound security lists are stateless
Ensure VCN inbound security lists are stateless
- Ensuring Virtual Cloud Network (VCN) inbound security lists are stateless is crucial to prevent unauthorized access and attacks on your network. A stateless security list does not keep track of the connection state, providing more strict security controls for incoming traffic.
- This policy enables better scalability for the network. Since a stateless security list does not keep information about the state of previous connections, it requires less computing resources, allowing you to accommodate more connections in your network.
- Terraform’s support for implementing a stateless security list means you can automate your security configurations, reduce manual errors, and maintain consistent security practices across your infrastructure.
- The policy can help to mitigate potential network-related vulnerabilities that could be introduced to the oci_core_security_list if incoming connections were not managed properly, thereby helping to enhance the overall security of your Oracle Cloud Infrastructure (OCI) environment.
OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters
OCI IAM password policy for local (non-federated) users has a minimum length of 14 characters
- The policy ensures a minimum level of security for user accounts on the OCI (Oracle Cloud Infrastructure) platform by enforcing a robust password requirement. Longer passwords are generally harder to crack, thereby increasing security.
- Compliance with this policy minimizes the risk of unauthorized access due to weak or easily guessable passwords. It sets the base hard-line defense of the OCI IAM user account against brute force attacks and password guessing.
- This password policy is specifically designed for local (non-federated) OCI IAM users, potentially reducing exposure to risks associated with inadequate outside password policies, thus strengthening the overall infra security ecosystems.
- Through the implementation of this policy via Infrastructure as Code (IaC) tool Terraform, automated checks can be performed. This ensures that all OCI IAM user passwords meet the minimum length requirement, thereby facilitating consistent application of security policy across the entire infrastructure.
Ensure no security list allow ingress from 0.0.0.0:0 to port 22.
Ensure no security list allow ingress from 0.0.0.0:0 to port 22.
- The policy aims to prevent unauthorized access from any IP address to port 22, which is typically used for secure shell (SSH) connections. This significantly reduces the risk of unwanted intrusion and potential security exploits.
- Allowing unrestricted ingress on port 22 may lead to brute-force attacks or exploits of any known vulnerabilities in the SSH protocol. Thus, it is crucial to restrict unknown or suspicious IP addresses from accessing this port.
- Employing this policy with Infrastructure as Code (IaC) tool like Terraform allows scalable, consistent, and automatic application of security rules across all existing and future infrastructure resources, minimizing potential human errors in manual configuration.
- The policy applies specifically to ‘oci_core_security_list’ resources in Oracle Cloud Infrastructure (OCI), implying it will effectively prevent SSH connection based threats for systems or applications hosted in OCI.
Ensure no security list allow ingress from 0.0.0.0:0 to port 3389.
Ensure no security list allow ingress from 0.0.0.0:0 to port 3389.
- This policy protects against unauthorized remote access by ensuring that Security Lists do not permit unrestricted ingress to port 3389, which is commonly used for Remote Desktop Protocol (RDP) connections. This reduces the attack surface and minimizes the risk of a cyber attack.
- Enforcing this policy mitigates the threat of brute-force attacks. Port 3389, being the default for RDP, is a popular target for attackers trying to gain unauthorized access using methods like password guessing.
- It promotes the principle of least privilege, a good cybersecurity practice. By restricting access to port 3389, only necessary connections are allowed, lowering the chance of exploitation by limiting potential vulnerabilities.
- Violation of this policy could leave the cloud infrastructure open to risks such as data leaks, machine control, or even a full-scale network compromise, having severe impacts on the security and reliability of services.
Ensure security group has stateless ingress security rules
Ensure security group has stateless ingress security rules
- Ensuring security groups have stateless ingress security rules is important because it allows for bidirectional traffic flow, meaning that return traffic is allowed regardless of any outbound rules, increasing the flexibility of network communication.
- This rule significantly enhances network security by inspecting all ingress and egress traffic, thereby allowing only legitimate traffic and dropping any traffic that does not conform to the specified security rules, effectively protecting against unauthorized access and potential attacks.
- The implementation of this rule with Terraform as Infrastructure as Code (IaC) accelerates the deployment process and simplifies the management and enforcement of this policy across multiple environments and systems within an organization.
- Violations of this policy could potentially lead to security breaches, data loss or system downtime due to exposure to threats - this emphasizes the policy’s critical role in risk management and business continuity strategies.
Ensure no security groups rules allow ingress from 0.0.0.0/0 to port 22
Ensure no security groups rules allow ingress from 0.0.0.0/0 to port 22
- This policy prevents unauthorized access to your resources by restricting inbound traffic to port 22 from all IP addresses (0.0.0.0/0). This port is typically used for secure shell (SSH) connections, which, if compromised, can present a significant security threat.
- By limiting access to port 22, Infrastructure as Code (IaC) with Terraform can significantly reduce the attack surface and potential for malicious actors to gain unauthorized entry, protecting sensitive data and system integrity.
- Violating this policy could expose the infrastructure to attacks such as brute force or SSH-based exploits. These attacks typically aim to guess credentials or exploit vulnerabilities in the SSH protocol, leading to unauthorized access and potential data breaches.
- The policy pertains to the specific resource type ‘oci_core_network_security_group_security_rule’. Therefore, if this rule is violated, not only is the infrastructure exposed to security risks, but any resources and services dependent on this security group could also be jeopardized.
Ensure administrator users are not associated with API keys
Ensure administrator users are not associated with API keys
- This policy ensures that powerful administrator-level privileges are not used for API calls, which could lead to catastrophic events if an API key leaks or gets into the wrong hands. It adds an additional layer of protection against unauthorized access and potential data breaches.
- By implementing this policy, it upholds the principle of least privilege (POLP) which states that an user should have the minimum levels of access necessary to complete their job functions. This limits potential security risks.
- If an admin user is associated with an API key, it creates a vulnerability that could be exploited by malicious actors to manipulate or gain unauthorized access to sensitive system resources, potentially causing significant damage.
- As this policy is enforced via Infrastructure as Code (IaC) using Terraform, it can be consistently applied across different environments and projects, enhancing enforcement of secure configurations throughout the software development lifecycle and reducing the chance of human error.
Ensure NSG does not allow all traffic on RDP port (3389)
Ensure NSG does not allow all traffic on RDP port (3389)
- Ensuring Network Security Group (NSG) does not allow all traffic on RDP port (3389) helps to limit the number of potential attack vectors available to malicious actors, ultimately bolstering the security posture of your infrastructure.
- By restricting all traffic on RDP port 3389, the policy reduces the risk of unauthorized access by hackers who might exploit vulnerabilities associated with Remote Desktop Protocol (RDP), since this is a common target for brute force attacks or malware exploits.
- This policy ensures compliance with best-practice security configurations for terraform infrastructure as code (IaC). This aids in meeting regulatory requirements and standards for cloud infrastructure security.
- Implementing this rule supports the principle of least privilege, as it enforces the restriction of unnecessary network connections to your resources and minimizes the potential attack surface, thus enhancing the protection levels of your data and systems.
Ensure Kubernetes engine cluster is configured with NSG(s)
Ensure Kubernetes engine cluster is configured with NSG(s)
- Ensuring Kubernetes engine cluster is configured with Network Security Group(s) (NSG) enhances the overall security posture by placing an extra layer of security, preventing unwanted or unauthorized access to the cluster.
- Network Security Group works on allow-list and deny-list principle, which can be set to manage and control communication using specific IP addresses or IP address ranges, thus safeguarding the Kubernetes engine cluster from potential cyber-attacks.
- By configuring NSG with Kubernetes engine cluster, potential security vulnerabilities are mitigated by default allowing only the defined set of IP addresses and ports, blocking the undefined ones, thus providing granular control over the network traffic.
- In a scenario where the Kubernetes engine clusters are not configured with NSGs, it increases the risk of exposure to potential threats or attacks, which could possibly lead to service disruption or loss of valuable data.
Ensure File Storage File System access is restricted to root users
Ensure File Storage File System access is restricted to root users
- This policy ensures only root users, who have comprehensive permissions, can access the file storage system, preventing unauthorized access and potential exploitation of sensitive data stored in the OCI file system.
- By restricting access to only root users, the policy mitigates the risks associated with unrestricted access including data breaches, tampering or deletion.
- It simplifies management and auditing of filesystem activities as actions will only come from a minimal set of root user accounts.
- Any violations or deviations of this policy can be traced back and attributed to specific root users, thereby improving accountability and facilitating precise incident response.
Ensure Kubernetes Engine Cluster boot volume is configured with in-transit data encryption
Ensure Kubernetes Engine Cluster boot volume is configured with in-transit data encryption
- The policy ensures the encryption of data as it moves between the Kubernetes Engine Cluster boot volume and other components, enhancing the confidentiality and preventing unauthorized disclosure of information.
- In-transit encryption for Kubernetes Engine Cluster boot volume provides an additional layer of security to protect sensitive data that might be susceptible to intrusion or eavesdropping attacks.
- With in-transit data encryption, even if data packets are intercepted during the communication process, the data will remain inaccessible due to the encryption, therefore effectively minimizing the risk of data breaches.
- The policy impacts how the Kubernetes environment on the Terraform platform should be configured and managed, making it a crucial component in maintaining regulatory compliance and adhering to industry security standards.
Ensure Kubernetes Engine Cluster pod security policy is enforced
Ensure Kubernetes Engine Cluster pod security policy is enforced
- This policy ensures that each pod within the Kubernetes Engine Cluster adheres to defined security criteria, preventing pods from running with potentially harmful configurations which could put the whole system at risk.
- Enforcing Kubernetes Engine Cluster Pod Security Policy can prevent unwanted network access or escalation of privileges within the system by restricting pod-level access to system capabilities.
- This infra security policy, being implemented through Terraform, offers an effective means to manage the security policy of containerized applications across different development environments, promoting consistency and reliability.
- The policy specifically targets oci_containerengine_cluster entities which means it provides an additional layer of protection and governance specifically for Oracle Container Engine for Kubernetes (OKE), enhancing the overall security of applications run on this platform.
Ensure that securityDefinitions is defined and not empty - version 2.0 files
Ensure that securityDefinitions is defined and not empty - version 2.0 files
- The policy ensures that API security parameters are explicitly defined, enhancing the predictability and safety of API interactions.
- It mitigates risks related to unauthorized access or unplanned interactions, as a missing or empty ‘securityDefinitions’ could imply unspecified or weak security measures.
- In case of non-compliance, systems may be exposed to malicious activities such as data breaches due to a lack of proper access control.
- Consistent implementation of this rule could help meet compliance standards for data protection and cybersecurity, safeguarding a company’s reputation and potentially avoids any related legal or financial repercussions.
Ensure that if the security scheme is not of type 'oauth2', the array value must be empty - version 2.0 files
Ensure that if the security scheme is not of type 'oauth2', the array value must be empty - version 2.0 files
- The policy ensures that only ‘oauth2’ security scheme is associated with non-empty values in the array, thus preventing misconfigurations with other security schemes that could lead to vulnerabilities in the infrastructure.
- It enforces adherence to OpenAPI ver2.0 specifications, which specifically indicate that if a security scheme is not ‘oauth2’, the array should be empty, thereby maintaining interoperability and consistency in API design.
- The policy mitigates the risk of unauthorized access by inadvertently granting permissions through non-oauth2 security schemes as all values associated with them are required to be empty, preventing unintentional data exposure.
- By directing to the specific resource implementation link, it allows entities responsible for security to clearly understand the check performed and correctly implement the ‘oauth2’ security requirement, thereby improving awareness and ensuring compliance with best security practices.
Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files
Ensure that security schemes don't allow cleartext credentials over unencrypted channel - version 3.x.y files
- This policy helps protect sensitive data by ensuring that credentials are not sent in cleartext over an unencrypted channel, reducing the potential risk of data exposure and exploitation by malicious actors.
- Enforcing this rule reduces the chances of Man-in-the-Middle (MitM) attacks which may occur when cleartext credentials are intercepted during transmission over unencrypted channels.
- Ensuring the implementation of this policy can ensure compliance with data protection regulations and standards, which often require encrypted transmission of credentials.
- By not allowing cleartext credentials over unencrypted channel in 3.x.y files, security is improved in internal system communication as well as in communications involving third-party entities, thus adding a robust layer to the overall infrastructure security.
Ensure that the global security field has rules defined
Ensure that the global security field has rules defined
- Ensuring that the global security field has rules defined is essential for maintaining consistent security standards across all services in the infrastructure. This helps in preventing unauthorized access and securing sensitive data.
- The absence of defined rules in the global security field can lead to vulnerabilities, as it may leave some parts of the infrastructure unprotected, potentially allowing unauthorized access to critical resources or data leakage.
- Adherence to this policy reduces the chances of human error and the associated risks, as it ensures that each security rule does not have to be manually applied to each service but is done globally, thus preventing the possibility of missing out on some areas.
- Ensuring that global security fields have rules defined can help meet regulatory compliances and industry standards for security, further enhancing the trust and credibility of the organization.
Ensure that security operations is not empty.
Ensure that security operations is not empty.
- Ensuring that security operations is not empty helps to validate whether the necessary security protocols have been implemented, thereby reducing the risk of cyber-threats, attacks, and potential data breaches.
- This policy is crucial because an empty security operations indicates a lack of active monitoring and response mechanisms, impacting the system’s ability to counter, detect, and recover from security incidents.
- The enforcement of this rule ensures that the system’s security team is actively involved in managing its cyber-physical systems, which is essential to understand the system’s security posture and mitigate security threats in real-time.
- Strict adherence to this policy helps in maintaining the system’s confidentiality, integrity, and availability by preventing unauthorized access, data tampering, and service interruptions.
Ensure that security requirement defined in securityDefinitions - version 2.0 files
Ensure that security requirement defined in securityDefinitions - version 2.0 files
- Following the policy ensures that defined security requirements are established, thus enforcing authorization and authentication mechanisms necessary for OpenAPI infrastructure, leading to the prevention of unauthorized access.
- The policy enforces adherence to the widely accepted version 2.0 file standard, thereby ensuring compatibility and uniformity across various systems, making it easier to track security inconsistencies.
- The policy helps prevent potential security breaches related to insecure resource implementation in a proactive manner, as it requires developers to meet predefined security standards within their code.
- Implementing this policy supports continuous reliability on the implemented infrastructure, as it might lead to the immediate detection and resolution of security threats, thereby minimizing the potential for system downtime.
Ensure that the path scheme does not support unencrypted HTTP connection where all transmissions are open to interception- version 2.0 files
Ensure that the path scheme does not support unencrypted HTTP connection where all transmissions are open to interception- version 2.0 files
- This policy is important because it ensures the confidentiality and integrity of data transmitted between client and server, by prohibiting unencrypted HTTP connections susceptible to interception and data leaks.
- The policy reduces the risk of data breaches and unauthorized access by ensuring that all data in transit is secure and cannot be viewed or altered by third parties.
- By implementing this policy, the organization is safeguarding its digital assets and maintaining compliance with data privacy standards that require encryption of sensitive information during transmission.
- The version 2.0 file constraint ensures the policy continues to cater to the latest security needs of applications and provides consistent security standards irrespective of technological advancements or changes in infrastructure.
Ensure that security is not using 'password' flow in OAuth2 authentication - version 2.0 files
Ensure that security is not using 'password' flow in OAuth2 authentication - version 2.0 files
- Ensuring that ‘password’ flow is not used in OAuth2 authentication helps maintain the confidentiality of user credentials. As ‘password’ flow requires users to share their credentials with the client, it poses a significant security risk.
- Avoiding the ‘password’ flow in OAuth2 authentication enables the use of more secure methods, such as ‘authorization code’ or ‘client credentials’ flow which do not expose sensitive user data.
- Adherence to this policy protects the system from potential breaches as the ‘password’ flow can make the system vulnerable to attacks if the client storing the credentials gets compromised.
- Incorporating this policy within the infrastructure code (as indicated by the link to the Python module, Oauth2SecurityPasswordFlow.py) provides a proactive way to enforce good security practices, thus avoiding any loopholes that could be exploited.
Ensure that security scopes of operations are defined in securityDefinitions - version 2.0 files
Ensure that security scopes of operations are defined in securityDefinitions - version 2.0 files
- Defining the security scopes of operations in securityDefinitions - version 2.0 files helps in efficient management of access control. It ensures that each function or operation can only be performed by specific users or entities.
- This policy helps in minimizing potential risks or damages caused by malicious attacks or accidental misuse. By limiting the accessibility on operation-based level, the exposure of critical systems and data is reduced.
- Compliance to this policy ensures granular control over system operations, contributing to the robustness and dependability of its overall security architecture. By clearly defining the scope of each operation, any violation or attempted breach can be quickly identified and addressed.
- Ensuring proper security scopes are defined promotes adherence to best practices and standards related to Information Security Management Systems (ISMS), supporting compliance with laws and regulations such as GDPR and HIPAA. Operating under defined security scopes simplifies audit processes and presents a mature security posture to stakeholders.
Ensure that operation object does not use 'password' flow in OAuth2 authentication - version 2.0 files
Ensure that operation object does not use 'password' flow in OAuth2 authentication - version 2.0 files
- This policy ensures that sensitive data, specifically passwords, are not exposed in OAuth 2.0 authentication flows. This mitigates the risk of unauthorized access and data exposure.
- The policy reduces the possibility of brute-force or password theft attacks on the system by avoiding direct use of password-based authentication which is considered less secure in OAuth2.0.
- By adhering to this policy, it encourages the use of more secure authentication methods like authorization code, implicit, client credentials, or refresh token flows - enhancing security and data integrity.
- This policy enforces direct policy compliance and recommendation by the Open Authorization framework (OAuth 2.0) avoiding the password flow to help protect against possible regulatory or industry standard violations, thereby avoiding penalties and supporting audit processes.
Ensure no security definition is using implicit flow on OAuth2, which is deprecated - version 2.0 files
Ensure no security definition is using implicit flow on OAuth2, which is deprecated - version 2.0 files
- The policy ensures the avoidance of implicit flow in OAuth2, which is deprecated and considered less secure. Avoiding this flow decreases the likelihood of unauthorized access to sensitive data.
- The enforcement of this rule bolsters security by minimizing the exposure of access tokens to third-party apps or browser history as they’re not transferred via browser redirect, unlike in implicit flow.
- Using the latest recommended security standards, as prompted by this policy, helps in maintaining the resilience of the security system. Deprecated methods like the implicit flow may have known vulnerabilities that can be exploited by attackers.
- Following this policy can lead to improved compliance with modern security standards and regulations, reducing the risk of infractions or penalties for not adhering to best practices.
Ensure security definitions do not use basic auth - version 2.0 files
Ensure security definitions do not use basic auth - version 2.0 files
- This policy helps to prevent unauthorized access and ensures a high level of security by discouraging the use of basic auth, a method considered weak due to its lack of encryption and potential for credential exposure.
- The policy is relevant in protecting sensitive data as basic auth protocols can be easily intercepted and credentials stolen, leading to potential data breaches.
- It encourages the use of more secure authentication protocols, such as token-based or OAuth, which provide enhanced security measures like encryption, thus preventing unauthorized access and manipulation of data.
- Implementation of this policy minimizes the risk of security incidents and potential legal and financial repercussions from data breaches, while also promoting trust and confidence in the infrastructure’s security measures among users and stakeholders.
Ensure that operation objects do not use 'implicit' flow, which is deprecated - version 2.0 files
Ensure that operation objects do not use 'implicit' flow, which is deprecated - version 2.0 files
- Ensuring that operation objects do not use ‘implicit’ flow helps maintain the highest level of security, as the ‘implicit’ flow is deprecated and can expose sensitive information to potential security risks.
- Remaining updated with the most current version can aid in maintaining compliance with various cybersecurity standards and best practices, leading to improved organizational reputation.
- It reduces the risk of potential security vulnerabilities such as Cross-Site Request Forgery (CSRF) or token interception, which can result from the use of an ‘implicit’ flow.
- Implementation of this policy can prevent potential unauthorized access to your API’s resources, as it encourages the use of more secure and modern authentication models that the ‘implicit’ flow.
Ensure that operation objects do not use basic auth - version 2.0 files
Ensure that operation objects do not use basic auth - version 2.0 files
- This policy ensures higher security because basic authentication sends usernames and passwords in an easily readable format, potentially exposing sensitive information to malicious actors.
- Compliance with this policy reduces the risk of unauthorized access to resources since basic authentication, being based solely on a username and password, doesn’t offer multi-factor authentication or additional security checks.
- Effectively implementing this policy avoids possible security breaches and loss of data as using stronger authentication methods better protects your system from vulnerabilities.
- Violation of this policy could lead to non-compliance with data protection regulations and standards such as GDPR or ISO/IEC 27001, which can result in significant penal consequences for the organizations.
Ensure that operation objects have 'produces' field defined for GET operations - version 2.0 files
Ensure that operation objects have 'produces' field defined for GET operations - version 2.0 files
- This policy ensures that all HTTP GET operations defined in OpenAPI files explicitly state what format they return data in. This clarity can improve interoperability between different systems, as it removes ambiguity around the expected format of responses.
- It enhances the overall security posture of the API, by making it harder for attackers to exploit unexpected data formats. Thereby providing clear definitions of what types of data can be returned, this policy can limit the possibility of malicious data being sent to unsuspecting clients.
- It encourages developers to follow best practices in API design. By clearly specifying the format of the GET responses, the policy helps to ensure consistent and predictable behavior across all operations.
- The policy positively impacts the maintainability of the API over time, as the clearer definitions make it easier for future developers to understand and work with the API. This can lead to increased efficiency and less time spent on fixing misunderstandings or bugs related to data formats.
Ensure that operation objects have 'consumes' field defined for PUT, POST and PATCH operations - version 2.0 files
Ensure that operation objects have 'consumes' field defined for PUT, POST and PATCH operations - version 2.0 files
- The policy ensures that all PUT, POST, and PATCH operations in OpenAPI define the ‘consumes’ field, which facilitates the understanding of which media types an API can consume. This ensures clarity and precision in operation documentation.
- By ensuring that operation objects have ‘consumes’ field defined, the policy prevents potential compatibility issues because clients know accurately what type of content they should send, reducing the risk of incorrect requests and subsequent failed operations or errors.
- The rule supports interface polymorphism by allowing different operations on the same path to consume different media types, enhancing the versatility of the API.
- Noncompliance with this policy could lead to inconsistencies in API operation execution, reduced application performance, or potential security vulnerabilities. Hence, it emphasizes strong practice for correct and thorough API design and usage definitions.
Ensure that global schemes use 'https' protocol instead of 'http'- version 2.0 files
Ensure that global schemes use 'https' protocol instead of 'http'- version 2.0 files
- The policy ensures data privacy and integrity by transmitting data securely over the internet. Utilizing ‘https’ protocol instead of ‘http’ encrypts communication to protect sensitive data from being intercepted or tampered with during transit.
- It minimizes risk of exposure to attacks such as ‘man-in-the-middle’ where intruders can eavesdrop on communication. By enforcing ‘https’ use, the policy helps prevent unauthorized access to data during transmission.
- It improves user trust and the credibility of the infrastructure. ‘https’ protocol is considered a standard for secure communication, hence users interacting with any global scheme following the policy can have more confidence in the interaction.
- The policy also plays a critical role in meeting compliance standards. Many regulatory bodies require adherence to security best practices, including secure communication protocols, the usage of ‘https’ over ‘http’ aligns with many of these standards.
Ensure that global security scope is defined in securityDefinitions - version 2.0 files
Ensure that global security scope is defined in securityDefinitions - version 2.0 files
- This policy helps in clearly defining global security measures across all interfaces, ensuring consistent and comprehensive application of security processes throughout the system, thus enhancing its overall protection.
- By ensuring that global security scope is well defined in the securityDefinitions of version 2.0 files, it guarantees that all activities conform to the desired security standards, reducing the risk of any unauthorized access or data breaches.
- Absence of a defined global security scope in version 2.0 files could lead to inconsistencies in security provisions, areas unguarded by any security protocols, and easier breaches by potential attackers due to lack of clarity and uniformity.
- This policy when effectively implemented helps in regular security audits, providing a clear insight into the existing security measures and identifying any loopholes or vulnerabilities, thereby establishing a strong and uniform security infrastructure.
Ensure that API keys are not sent over cleartext
Ensure that API keys are not sent over cleartext
- Ensuring API keys are not sent over cleartext prevents potential unauthorized access to sensitive data. Cleartext transmission allows cybercriminals to easily intercept and decode API keys that serve as access credentials to applications and data.
- API keys sent in cleartext are easily readable and can be exploited to simulate genuine requests. This could lead to a breach of access controls, resulting in unauthorized changes to data or configurations within the resource paths.
- Observing this policy enhances the overall security posture of the Infrastructure as Code (IaC) implementation. It ensures that the access and authorization protocols laid out in OpenAPI, a commonly used tool for designing APIs, are upheld and not compromised.
- Failing to encrypt API keys can lead to non-compliance with data protection standards and regulations. Neglecting this policy might result in penalties, damaged reputation, and loss of trust among clients and partners who rely on the security of the platform.
Ensure that arrays have a maximum number of items
Ensure that arrays have a maximum number of items
- This policy ensures that array-based data structures do not exceed a set limit, hence preventing problems such as performance issues, memory overflow, or system crashes due to excessive usage of system resources.
- It helps in maintaining the expected structure of data by validating the number of items in an array at the API level, ensuring that the data stored and processed adheres to the specified format leading to less unexpected errors in the system.
- By limiting the number of items in arrays, it provides a safeguard against possible data abuse or Denial of Service (DoS) attacks, where an attacker might try to overload the system by inputting a massive number of array elements.
- This policy, when applied to ‘paths’ entities, specifically ensures efficient and safe handling of data related to URLs and endpoints in the system, enhancing the overall security of network communications within the infrastructure.
Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider
Ensure no hard coded OpenStack password, token, or application_credential_secret exists in provider
- Emphasizes the importance of security and data protection by avoiding the use of hard coded credentials within the OpenStack provider which, if exposed, could lead to unauthorised access or infiltration.
- Encourages the use of secure credential management practices, thereby preventing potential OpenStack security breaches and maintaining the integrity of the infrastructure.
- Specifically helps in avoiding risks associated with Infrastructure as Code (IaC) through Terraform, where hard coded credentials can accidentally be shared publicly or fall into wrong hands.
- Enforces best practices of secure programming in relation to the use of OpenStack, promoting overall system health and resilience against threats targeting the cloud infrastructure.
Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp)
Ensure no security groups allow ingress from 0.0.0.0:0 to port 22 (tcp / udp)
- This policy helps prevent unauthorized access or attacks on servers by restricting ingress from all IP addresses (0.0.0.0/0) to port 22, which is typically reserved for Secure Shell (SSH) connections.
- By implementing this policy using Infrastructure as Code (IaC), it’s possible to programmatically enforce secure configurations and avoid manual oversights, reducing human error and enhancing operational efficiency.
- This policy directly impacts resources openstack_compute_secgroup_v2 and openstack_networking_secgroup_rule_v2, ensuring that the ingress settings for these security group rules are correctly configured to protect OpenStack instances from potential cyber threats.
- Violation of this policy might lead to an open gateway for attackers to exploit, resulting in compromised systems, data breaches, and potentially significant financial and reputational damage.
Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp)
Ensure no security groups allow ingress from 0.0.0.0:0 to port 3389 (tcp / udp)
- This policy prevents unauthorized access to systems or applications by restricting ingress from all internet-facing interfaces (0.0.0.0:0) to port 3389, which is typically used for Remote Desktop Protocol (RDP) connections. This severely limits the potential for external malicious actors to infiltrate the system through this port.
- By implementing this rule, it strengthens security by ensuring that only designated, trusted sources can access systems through port 3389, assuming those sources are properly defined in the security group rules. This further decreases the attack surface that could be exploited by malicious actors.
- Failure to apply this policy can lead to exposure of sensitive information or critical system controls, resulting in potential compromise of system integrity, theft of data, or disruptive activities stemming from unauthorized remote control over the system.
- By utilizing Infrastructure as Code (IaC) through Terraform in enforcing this policy, changes can be consistently and reliably applied, audited, and rolled-back if necessary. This promotes a swift and secure change management process that minimizes human error and configuration drift.
Ensure that instance does not use basic credentials
Ensure that instance does not use basic credentials
- Ensuring that an instance doesn’t use basic credentials strengthens security by protecting against brute-force attacks, where attackers attempt to guess usernames and passwords in a systematic manner. Advanced authentication methods can provide a stronger barrier.
- This policy discourages the use of easily crackable credentials, thus reducing the risk of unauthorized access to the system. This protects sensitive data within the compute instance and maintains the integrity of the system.
- Adhering to this policy aids in meeting regulatory compliance standards that require advanced authentication measures. Non-compliance can lead to fines, reputational damage, and loss of customer trust.
- By not enabling basic credentials on an instance, the policy promotes stronger security practices such as multi-factor authentication or the use of cryptographic keys, increasing the difficulty for intruders to gain unauthorized access.
Ensure firewall rule set a destination IP
Ensure firewall rule set a destination IP
- Setting a destination IP in the firewall rule, as per the policy, ensures that network traffic is only directed to specific, authorized locations, mitigating the risk of inadvertently sending sensitive data to untrusted locations.
- This policy provides control and visibility over the routing of network traffic, making it easier to manage and analyze netflow data, troubleshoot network issues, and detect suspicious activity.
- It reduces the vulnerability of the entities (in this case,
openstack_fw_rule_v1) to cyberattacks as unauthorized access to data from unspecified destination IPs is restricted. - Not abiding by this infra security policy could lead to non-compliance with certain regulatory standards related to data security and privacy, potentially resulting in legal penalties, fines, and reputational damage.
Ensure no hard coded PAN-OS credentials exist in provider
Ensure no hard coded PAN-OS credentials exist in provider
- This policy mitigates the risk of unauthorized access to PAN-OS services by ensuring that no static credentials are hard-coded into the system. The impact of a security breach could potentially be severe, potentially leading to data theft, system manipulation, or other malicious activities.
- By ensuring no hard-coded PAN-OS credentials exist in a Terraform provider, the policy significantly reduces the potential for accidental credential disclosure. This common mistake might occur during code sharing or public repository syncing, exposing these sensitive details to potential attackers.
- This policy fosters good security hygiene by enforcing dynamic credential management. This results in regularly cycled, unique credentials which are far harder for malicious actors to compromise, as opposed to static, hardcoded credentials that rarely, if ever, change.
- Hardcoded credentials in PAN-OS can leave security gaps that could be exploited by internal threats. Implementation of this policy helps to protect the integrity of the infrastructure by preventing disgruntled employees or inside actors from leveraging these static credentials for malicious purposes.
Ensure plain-text management HTTP is not enabled for an Interface Management Profile
Ensure plain-text management HTTP is not enabled for an Interface Management Profile
- Ensuring plain-text management HTTP is not enabled for an Interface Management Profile increases the security of the network as sensitive information such as usernames, passwords, and other user data is not transferred in clear text, thus mitigating the risk of unauthorized access or data breaches.
- This policy plays a crucial role in maintaining the confidentiality and integrity of the network management data since enabling HTTP would make the data visible in transit and susceptible to interception, alteration, or manipulation by malicious entities.
- Implementing this policy helps to meet various security compliance standards, such as PCI DSS, HIPAA, and GDPR which mandate the transmission of sensitive data over secure, encrypted connections, thereby saving the organization from potential legal and reputation repercussions.
- Only allowing secure protocols for management communications enhances the overall network infrastructure security posture, thereby ensuring business continuity, minimizing downtime, and increasing trust among stakeholders and customers.
Ensure plain-text management Telnet is not enabled for an Interface Management Profile
Ensure plain-text management Telnet is not enabled for an Interface Management Profile
- This policy is important because it helps prevent unauthorized access to system resources. Using plain-text Telnet for interface management profile can expose sensitive information since the data is transmitted as plain text, making it vulnerable to eavesdropping attacks.
- The policy helps to ensure compliance with data protection regulations. Enabling plain-text Telnet could be a violation of certain regulations, such as GDPR or HIPAA, which require organizations to implement adequate security measures to protect data confidentiality and integrity.
- Not enabling plain-text Telnet reduces the surface area for potential cyber threats. By forcing the use of more secure protocols, the policy helps to mitigate the risk of intrusion attempts and brute force attacks.
- Adherence to this policy promotes the implementation of secure practices in the development process. Using Infrastructure as Code (IaC) with Terraform, this policy is programmatically enforced, encouraging developers to build secure systems from the start.
Ensure DSRI is not enabled within security policies
Ensure DSRI is not enabled within security policies
- Ensuring Data Sequence and Reuse Inspection (DSRI) is not enabled in security policies strengthens data security by allowing the firewall to effectively scrutinize the data transactions, aiding in the detection and prevention of potential security threats.
- With DSRI enabled, the firewall might bypass some stages of data inspection which can create blind spots in the data flow, increasing the risk of data breaches or intrusions.
- Compliance with this policy ensures the full utilization of the security infrastructure, especially the panos_security_policy and panos_security_rule_group, thus safeguarding the network against potential exploits.
- Disabling DSRI also maintains the integrity of tasks.paloaltonetworks.panos.panos_security_rule, allowing for comprehensive auditing and monitoring, which are critical for maintaining robust infrastructure security.
Ensure security rules do not have 'applications' set to 'any'
Ensure security rules do not have 'applications' set to 'any'
- Ensuring security rules do not have ‘applications’ set to ‘any’ is essential in limiting the exposure of system resources and minimizing potential points of access/attack for malicious entities.
- The policy positively impacts the granularity of access control, enabling entities to authorize or deny connections based on specific network traffic types without application-wide permissions.
- With Terraform, it is possible to implement infrastructure security policies across an entire fleet of resources, simplifying the process of management and enforcement of this rule on entities like panos_security_policy, panos_security_rule_group, and tasks.paloaltonetworks.panos.panos_security_rule.
- The rigorous implementation of this policy can improve the overall resilience and robustness of the security framework by promoting least privilege principles, improving regulatory compliance, and mitigating risks associated with unrestricted access, such as data leaks or improper utilization of resources.
Ensure security rules do not have 'services' set to 'any'
Ensure security rules do not have 'services' set to 'any'
- Limiting the ‘services’ in security rules to specific services, rather than setting it to ‘any’, significantly reduces the attack surface by only exposing necessary ports and services.
- Preserving this rule helps prevent potential unauthorized access and data breaches by tightening the control over what services can be accessed or manipulated under the security policy.
- Ensuring this policy can lead to a more secure and manageable infrastructure, as it promotes the principle of least privilege where services are only available to those that should have access, thus lowering the risk of insider threats.
- The disregard of this policy might lead to a potential non-compliance with regulatory standards as many require minimum necessary access to services, which could result in hefty financial penalties and damaged reputation.
Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any'
Ensure security rules do not have 'source_addresses' and 'destination_addresses' both containing values of 'any'
- This policy ensures that security rules don’t allow traffic from any source to any destination, minimizing the risk of unauthorized access or data leakage. By specifying source and destination addresses, it is possible to control who can access and transmit information.
- By limiting connectivity to only necessary addresses, it reduces the attack surface, making it more difficult for malicious actors to exploit vulnerabilities and launch successful attacks on the network or system.
- Having this policy in place promotes a principle of least privilege network design, thus improving overall network security. The idea here is to provide the fewest network privileges possible to prevent exploitation of those privileges.
- Violation of this policy can lead to potential compliance issues, as many data protection regulations and standards require specific controls over the flow of data. Adherence to this policy can help entities maintain regulatory compliance and avoid penalties.
Ensure description is populated within security policies
Ensure description is populated within security policies
- Ensuring a description is populated within security policies can provide context and insights regarding the purpose and function of the policy. This becomes crucial when multiple team members are working on the infrastructure, ensuring everyone understands the purpose of the policy.
- A well-written description can also help during audits or compliance checks, providing the necessary information to auditors and confirming the policy serves its designated purpose. This can make the audit process more efficient and less time-consuming.
- If an IT incident occurs, having detailed descriptions within our policies allows for quicker troubleshooting and remediation. It can provide immediate context to the incident responders about what the policy does and its impact.
- It facilitates better security management by reducing ambiguity, making policies more understandable and trackable. This facilitates the process of maintaining or updating policies as infrastructure evolves, since it’s easier to modify policies that are well-documented and where the purpose is clear.
Ensure a Log Forwarding Profile is selected for each security policy rule
Ensure a Log Forwarding Profile is selected for each security policy rule
- This policy ensures that all security-related actions and incidents are logged, providing a trail of activities to scrutinize during security audits, breach investigations or compliance reviews, thus improving incident response and resolution.
- By actively forwarding the logs, the policy enhances real-time monitoring and facilitates immediate action in the face of potential security threats to any of the specified entities.
- Fostering accountability, as it can aid in identifying any unauthorized access or changes made to the security policy rules, thus reducing the risk of internal threats and misuse.
- Implementing a Log Forwarding Profile for each security policy rule allows for granular control of network traffic, aiding in the detection and prevention of anomalies, hence enhancing the overall infrastructure security.
Ensure logging at session end is enabled within security policies
Ensure logging at session end is enabled within security policies
- Enabling logging at the end of each session provides a complete, chronological record of activities that occurred within that session, contributing to a robust cybersecurity infrastructure by helping identify, troubleshoot, and prevent security incidents.
- Without this function, unauthorized access, potential breaches, or other malevolent actions might go unnoticed, creating a critical security risk. The identification and therefore, the mitigation of such events heavily depends on log data.
- This policy also supports regulatory compliance and forensic investigation. Many regulations require certain types of logging and a specific retention period for log information, and not having session end logging could result in violations and potential fines.
- Additionally, the logging information can be used for system optimization, troubleshooting, capacity planning, and improving overall system efficiency. Without this data, these activities are significantly more challenging to perform, potentially leading to performance issues or interruptions in service.
Ensure IPsec profiles do not specify use of insecure encryption algorithms
Ensure IPsec profiles do not specify use of insecure encryption algorithms
- This policy is important as it ensures that the encryption algorithms specified in IPsec profiles are secure. This is essential for data integrity and confidentiality, as insecure algorithms can be easily broken, leading to unauthorized access to sensitive data during transit.
- It reduces the risk of cyber-attacks, such as man-in-the-middle (MITM) attacks, by explicitly barring the use of weak encryption algorithms. This helps maintain the confidentiality and integrity of data communicated over the network.
- It assists in regulatory compliance by enforcing the use of secure encryption algorithms. Many industry regulations and standards require the use of secure encryption to protect sensitive data.
- The policy ensures that infrastructure as code (IaC) with tools such as Terraform maintains the high security standards required for network communications inside a company’s cloud infrastructure. It therefore helps maintain the trust and confidence of clients and stakeholders.
Ensure IPsec profiles do not specify use of insecure authentication algorithms
Ensure IPsec profiles do not specify use of insecure authentication algorithms
- Ensuring IPsec profiles do not use insecure authentication algorithms is crucial in preventing potential unauthorized network access by cyber criminals, who could exploit vulnerabilities in weaker algorithms to decrypt secure data.
- Only using secure algorithms in IPsec profiles enhances the overall network security, reducing possibilities of cyber attacks such as man-in-the-middle attacks and eavesdropping which may lead to significant data breaches.
- Using secure authentication algorithms in IPsec profiles is considered an industry standard and aligns with best practice for infrastructure security, illuminating a commitment to maintaining robust security controls.
- Configuring IPsec profiles to avoid insecure authentication algorithms significantly lowers the risk of compromised data integrity and confidentiality, maintaining trust with clients and stakeholders who interact with the network infrastructure.
Ensure IPsec profiles do not specify use of insecure protocols
Ensure IPsec profiles do not specify use of insecure protocols
- Ensuring IPsec profiles do not specify use of insecure protocols minimizes the potential attack surface of your network by preventing hackers from exploiting vulnerabilities in those insecure protocols to gain unauthorized access to your system.
- It mitigates the risk of sensitive data being intercepted during transmission as these insecure protocols often lack robust encryption and integrity checks, rendering your data susceptible to eavesdropping and tampering.
- This rule can help organizations maintain compliance with data protection regulations which often require data-in-transit to be encrypted using secure and up-to-date protocols.
- The rule is intended for use with panos_ipsec_crypto_profile, panos_panorama_ipsec_crypto_profile and tasks.paloaltonetworks.panos.panos_ipsec_profile entities, signifying its applicability in diverse Palo Alto Networks products which provides scalability in maintaining security standards across different platforms and environments.
Ensure a Zone Protection Profile is defined within Security Zones
Ensure a Zone Protection Profile is defined within Security Zones
- Defining a Zone Protection Profile within Security Zones ensures security measures are put in place to control and monitor inter-zone and intra-zone traffic in different parts of the network, hence minimizing the risk of unauthorized data access or misuse.
- Leaving zones without protection profiles can expose the network to different types of attacks like reconnaissance, flooding, and other DoS or DDoS attacks, thereby compromising the infrastructure security.
- The ZoneProtectionProfile ensures alignment with security best practices by assessing the resource configuration in panos_panorama_zone, panos_zone, and panos_zone_entry, which enhances Terraform’s orchestrated infrastructure’s safety.
- Using this policy, tasks.paloaltonetworks.panos.panos_zone are assessed, ensuring that all tasks within the Palo Alto Networks Panorama are executed in a secured and protected manner, thereby bolstering overall system reliability.
Ensure an Include ACL is defined for a Zone when User-ID is enabled
Ensure an Include ACL is defined for a Zone when User-ID is enabled
- Defining an Include Access Control List (ACL) for a Zone when User-ID is enabled is critical as it dictates who has access rights and what these rights are for each user. This process enhances the security policy within a network infrastructure by defining and managing permissions for different users.
- The policy plays a fundamental role in preventing unauthorized access to critical resources within a zone. By ensuring an Include ACL, the policy ensures that potentially malicious activities are restricted and the network’s security integrity is maintained.
- This policy boosts the security of the network infrastructure by providing a systematic approach to user identification. By using an Include ACL with User-ID, it increases the accuracy of identifying each user’s activity, thus enhancing the organization’s ability to monitor, detect anomalies, and respond to potential security threats.
- The absence of such a security policy can lead to misconfigured zones which are susceptible to breaches and attacks. An Include ACL policy helps mitigate security incidents by enforcing strict access control and enhancing visibility in user activities.
Ensure logging at session start is disabled within security policies except for troubleshooting and long lived GRE tunnels
Ensure logging at session start is disabled within security policies except for troubleshooting and long lived GRE tunnels
- This policy ensures that sensitive information, such as user details and timestamps, which may be captured during session starts are not unnecessarily logged and potentially exposed to unauthorised individuals, thus reducing the risk of potential data breaches.
- Disabling session start logging, except during troubleshooting or for long-lived GRE tunnels, conserves system resources and improves overall network performance by not unnecessarily logging every session start.
- Enforcing this policy will contribute to adherence with regulations regarding data privacy and security, such as GDPR and the CCPA, which require minimisation of personal data collection and strong security measures to protect that data.
- The policy helps to prevent compliance issues with auditing standards that might be violated by excessive logging, ensuring that only necessary and lawful data handling activities are performed.
Ensure security rules do not have 'source_zone' and 'destination_zone' both containing values of 'any'
Ensure security rules do not have 'source_zone' and 'destination_zone' both containing values of 'any'
- The policy mitigates the risk of unwanted data traffic crossing between network zones, by mandating specific ‘source_zone’ and ‘destination_zone’ values instead of a broad ‘any’ term, which could allow unrestricted inter-zone traffic.
- Implementing this specific rule reduces the attack surface for potential intrusions, as security breaches are constrained to explicitly defined zones rather than being able to propagate freely across all zones.
- It helps ensure robust and consistent IaC through Ansible by enforcing a standardized configuration for ‘source_zone’ and ‘destination_zone’ in the ‘panos_security_rule’ task, reinforcing network segmentation and reducing the chance of configuration errors.
- ‘Any’ rule in the source or destination zones creates ambiguity and limits the ability to trace and monitor specific security incidents. Specificity enhances clarity, accountability and facilitates efficient troubleshooting and incident response.
Artifactory Credentials
Artifactory Credentials
- The Artifactory Credentials policy is important because it handles sensitive data, such as passwords and API keys, which are crucial for maintaining secure access to resources. Any breach of these credentials could lead to unauthorized access and potential data loss or manipulation.
- This policy aids in maintaining Infrastructure as Code (IaC) practices, which help to accelerate and streamline software deployment while reducing the risk of human error. Encrypting sensitive data, like Artifactory credentials, is a crucial component of IaC security measures.
- Implementing the policy ensures better compliance with established security standards and protocols, which may be required in certain regulated industries or for certain certifications. Lack of adherence may lead to legal penalties or damage to the company’s reputation.
- The risks associated with unsecured Artifactory credentials can include exposure of proprietary code or data, which could be exploited by malicious actors for various unethical or illegal activities such as identity theft, financial fraud, or industrial espionage.
AWS Access Key
AWS Access Key
- The policy for AWS Access Key is crucial as it safeguards sensitive data, such as username and passwords, from exposure and potential misuse by unauthorized individuals. If these details are exploited, it can lead to a security breach.
- It assures that AWS Access Keys are properly managed and protected in the secrets element of the Infrastructure as Code (IaC), reducing the likelihood of accidental exposure or negligent use of these vital credentials.
- The implementation of this policy helps in adhering to best practices for cloud security. It guides users about how to securely manage and utilize AWS Access Keys, which are critical for accessing and controlling AWS resources.
- Non-compliance with this policy could lead to major consequences for the organization, including potential loss of control over AWS resources, unauthorized access to sensitive data, and the potential for significant financial expenses related to resolving security breaches.
Azure Storage Account access key
Azure Storage Account access key
- The Azure Storage Account access key policy is crucial as it ensures the security of stored data by requiring authentication for data access, thus preventing unauthorized access and potential data breaches.
- This infra security policy allows for the generation and regular rotation of strong access keys, thereby making it harder for malicious actors to compromise the keys, supporting continuous security in the system.
- Adoption of this policy is vital for correctly provisioning Infrastructure as Code (IaC) secrets, which are sensitive in nature. The mismanagement of these secrets can lead to security vulnerabilities and significant impacts on the organization’s sensitive data.
- The policy plays a crucial role in setting the standards for Azure data storage security in alignment with the overall cybersecurity framework. This can further aid in compliance with various data protection regulations, hence mitigating legal and reputational risks.
Basic Auth Credentials
Basic Auth Credentials
- The Basic Auth Credentials policy is crucial as it helps in the protection and management of sensitive data such as usernames and passwords, preventing unauthorized access to key systems and resources.
- Improper management of these basic authentication credentials within Infrastructure as Code (IaC) secrets can lead to serious security breaches, which can disrupt service operations and potentially lead to data loss or theft.
- It provides a standardized approach for how credentials should be managed and stored within an organization, reducing the risk of inconsistencies or poor practices that can lead to vulnerabilities.
- Following this policy can help with regulatory compliance. Many regulations require that sensitive data like authentication credentials is securely managed. Non-compliance can result in penalties.
Cloudant Credentials
Cloudant Credentials
- The Cloudant Credentials policy is critical for reducing the risk of unauthorised access to cloud resources and databases, as it ensures that these sensitive credentials are securely managed.
- By enforcing the policy, it safeguards the integrity and confidentiality of business-critical and sensitive data stored in Cloudant NoSQL databases from potential threat actors or inadvertent errors by legitimate users.
- Non-compliance with the policy can lead to exposure of Cloudant Credentials which can be potentially exploited, leading to data breaches or other serious security incidents, including unauthorized modifications or deletions.
- This policy encourages Infrastructure as Code (IaC) practices, promoting the secure management of secrets, and increasing automation and repeatability, which reduces human error in the deployment and operation of cloud infrastructures.
Base64 High Entropy String
Base64 High Entropy String
- The Base64 High Entropy String policy is important as it provides an added layer of security by ensuring that the ‘secrets’ or sensitive information in Infrastructure as Code (IaC) implementations are not easily decipherable, thus reducing the risk of unauthorized access or data breaches.
- By enforcing high entropy for encoded data, it increases the complexity and randomness of the data stored, making it more difficult for hackers to decode it, thereby enhancing the security of sensitive information.
- The policy also impacts stability and integrity of the system as it makes the stored data less prone to brute force or pattern-based hacking attempts, thus maintaining the system’s overall reliability and confidence.
- Given that ‘secrets’ contain sensitive data such as passwords, API keys, or encryption keys, implementing this policy would ensure that these important pieces of information are well protected, supporting secure and compliant business operations.
IBM Cloud IAM Key
IBM Cloud IAM Key
- The IBM Cloud IAM Key security policy is crucial as it helps to enforce strong access management, aiding in the prevention of unauthorized access to IBM cloud resources, ensuring sensitive data security.
- This policy impacts the way your infrastructure is set up, as it requires you to use keys for IAM, promoting a higher level of security as it’s less vulnerable to brute force or dictionary attack, compared to password-based access.
- The IBM Cloud IAM Key is explicitly linked to the infrastructure as code ‘secrets’. This means it has a direct impact on the control, management, and security of secret details, such as API keys and passwords, making sure they’re strongly encrypted and securely stored.
- This security policy also influences development practices. By including the policy within your code (as in policy_metadata_integration.py), it binds security directly into the development process, promoting a DevSecOps culture improving security posture.
IBM COS HMAC Credentials
IBM COS HMAC Credentials
- The IBM COS HMAC Credentials policy ensures the secure storage and access of precious data by regulating the creation and usage of Hash-based Message Authentication Code.
- The policy promotes data integrity and authentication on cloud storage, indicating that messages and data have not been tampered with during transmission and that they are indeed from the claimed source.
- It impacts significantly in minimizing security vulnerabilities as it allows detecting any potential data alterations and forgeries during communication, thereby protecting sensitive data from cyber threats.
- The policy enhances the compliance level of the infrastructure to globally accepted security standards, contributing to the overall trust and reputation of the system.
JSON Web Token
JSON Web Token
- The JSON Web Token policy helps ensure the secure transmission of information between parties as this policy enables the encryption of sensitive data, reducing the risk of data exposure.
- Enablement of JSON Web Token mechanism provides a way of representing claims to be transferred between two parties, which is essential for identity verification and access control, hence ensuring user authenticity.
- By adhering to this policy, it minimizes the chance of unauthorized access to servers and databases as the secrets are securely managed; violating it might expose secrets that could potentially lead to a security breach.
- Following the JSON Web Token policy in infrastructure security can reduce the impact of a potential breach as the tokens can expire, limiting the timeframe an attacker can misuse the compromised token, which results in improving the overall system resilience against attacks.
Mailchimp Access Key
Mailchimp Access Key
- The Mailchimp Access Key policy helps prevent unauthorized access to a company’s email marketing campaigns, potentially protecting sensitive company information and customer data from being exploited by malicious actors.
- This policy facilitates Integrated Infrastructure as Code (IaC) security and compliance by ensuring secrets, like the Mailchimp Access Key, are correctly and securely managed, reducing the risk of access key leaks or misuse.
- It enables organizations to function in accordance with data protection regulations and cybersecurity standards by maintaining strict control over access to Mailchimp’s API.
- Implementation of this policy ensures service continuity by preventing accidental key exposure or key loss, as failing to adequately secure the access key might lead to service disruption, affecting customer communications.
NPM tokens
NPM tokens
- This policy is important as it mitigates against the risk of unauthorized access to Node.js packages, which can compromise the confidentiality, integrity, and availability of the application.
- It helps to prevent the unauthorized creation, deletion, or modification of a Node Package Manager (NPM) token that can cause severe disruptions to an application’s operational functionality, or could allow unauthorized access to sensitive data.
- Proper enforcement of this policy limits an attacker’s window of opportunity to perform illicit activities by detecting and alerting about mishandled or unauthorized NPM tokens, thereby ensuring a part of the infrastructure security.
- This policy aids in maintaining compliance with security best practices and regulations by ensuring that NPM tokens, integral to the management and distribution of Node.js packages, are securely handled, emphasizing the organization’s commitment to secure programming practices.
Private Key
Private Key
- This policy is important as it ensures the encryption and confidentiality of data by securely storing and managing private keys. Mismanaged or exposed private keys can lead to unauthorized access and data breaches.
- Adherence to this policy mitigates the risks associated with malicious activities such as data interception, tampering, and fraud. If the private keys are compromised, an attacker can impersonate the user entity and gain unauthorized access.
- This policy encourages secure architecture by ensuring the usage of Infrastructure as Code (IaC) for secreting private keys, which prevents hard-coding secrets and allows for better management and automation.
- The implementation of the Private Key policy reduces the vulnerabilities in your system, thereby strengthening the overall security posture and compliance with data protection regulations.
Slack Token
Slack Token
- Slack Tokens are unique identifiers for Slack authorization, and this policy ensures these tokens are properly secured, reducing the risk of unauthorized access to Slack, which could lead to information leakage or misuse.
- In Infrastructure as Code (IaC) environment, tracking and securing secrets such as Slack Tokens is crucial to prevent their exposure in the codebase, that could be exploited by cyber attackers to gain unauthorized access.
- The policy implementation using the ‘policy_metadata_integration.py’ script ensures that the Slack Tokens are automatically detected and secured, improving efficiency and reducing the risk of manual errors.
- Slack Token security policy affects the ‘secrets’ entities, which form the core confidential data resources in a network. Any compromise on these entities due to unprotected tokens can directly expose sensitive information and have severe consequences on the integrity and security of the entire network.
SoftLayer Credentials
SoftLayer Credentials
- This policy is critical in preventing unauthorized access to SoftLayer services, as exposing credentials could lead to potential data breaches and service disruptions.
- Enforcing this policy enables companies to maintain the confidentiality of their SoftLayer credentials by ensuring they are kept as secrets and not exposed in plain text or in configurations, which is crucial for maintaining the integrity and security of their cloud infrastructure.
- It reduces the risk of lateral movement within a system, whereby an attacker gaining access to one part of the network could utilize improperly stored credentials to obtain further access or permissions.
- The policy’s implementation in the form of Infrastructure as code (IaC) makes it scalable, auditable, and easy to manage, ensuring a consistent security posture across large scale, complex environments.
Square OAuth Secret
Square OAuth Secret
- The Square OAuth Secret policy ensures that only authorized applications can access specific Square APIs. This maintains the security and integrity of the system by preventing unauthorized access and potential misuse of sensitive data.
- The policy can protect from data breaches and leaks by effectively managing and protecting these ‘secrets’, which if exposed can lead to unauthorized access and compromise of sensitive data, causing financial and reputational damage to the company.
- It aids in compliance with industry regulations and best practices for securing sensitive data. In a regulatory environment that is increasingly focused on data privacy, conforming to the Square OAuth Secret policy could be essential in avoiding potential fines and penalties.
- This policy, applied through Infrastructure as Code (IaC) on ‘secrets’, increases automation and consequently the speed of security processes. This not only raises overall security level but also allows more efficient resource usage since manual control and checks are reduced.
Stripe Access Key
Stripe Access Key
- The Stripe Access Key policy ensures that the key, which is extremely sensitive information, is not exposed or accessible to unauthorized users, thus preventing misuse of the API key leading to potential financial or data loss.
- This policy contributes to the maintenance of the safety and integrity of transactions conducted through Stripe by securely storing access keys and limiting their exposure, thereby reducing the risk of fraudulent transactions.
- It assists in staying compliant with regulations and guidelines related to the handling of sensitive data, including payment processing information, therefore preventing legal and financial repercussions for non-compliance.
- The correct implementation of the policy via the provided script facilitates automated security checks, ensuring ongoing adherence to the Stripe Access Key policy and making it easier to maintain high levels of security within the infrastructure.
Twilio API Key
Twilio API Key
- The Twilio API Key infrastructure security policy ensures that API keys are secure and protected. This decreases the risk of unauthorized access to Twilio services, safeguarding the transfer of data and maintaining the integrity and confidentiality of communication.
- This policy has a significant impact on operational reliability. Using API keys that are not secure can lead to breakdowns in essential services. Ensuring the API keys are secure aids in maintaining uptime and reliability of services.
- It promotes good security practices in infrastructure as code (IaC) approach. The resources in questions are secrets, which essentially refers to sensitive data, such as API keys. Storing such sensitive data securely is crucial to minimize the risk of data breaches and misuse.
- An impact of this policy is the potential increase in complexity associated with keys management. With an obligation to secure and frequently rotate keys, the entities managing these secrets may require more sophisticated management systems or routines, and additional technical skills.
Hex High Entropy String
Hex High Entropy String
- This policy is crucial in detecting potentially unprotected sensitive data such as encryption keys or API tokens. High entropy strings, commonly seen in cryptographic secrets, may indicate exposure of such data.
- A Hex High Entropy String policy can help an organization identify instances where developers may have uploaded secrets in the infrastructure-as-code (IaC) files, presenting a significant security risk as this might provide unauthorized access to critical systems.
- It helps improve the overall security posture by maintaining the confidentiality of sensitive information, and ensuring that secrets are not embedded in the code.
- This policy can effectively help in the mitigation of security risks like data breaches, espionage or sabotage which can be detrimental to business continuity, financial loss, or reputational damage.
Ensure Terraform module sources use a commit hash
Ensure Terraform module sources use a commit hash
- Ensuring Terraform module sources use a commit hash increases the security and stability of automated infrastructure deployment by ensuring that only tested and verified versions of modules are utilized.
- Using a specific commit hash in the Terraform module source reference helps prevent the unexpected introduction of bugs or vulnerabilities due to changes in the module source, enforcing a predictable infrastructure behavior.
- Employing commit hash policy for Terraform module sources improves system traceability and accountability by allowing developers to identify exactly what version of code was used at any given deployment, facilitating efficient debugging and auditing.
- The policy inherently encourages good version control practices among developers, helping to predict and control the impacts of changes in the module source to the infrastructure, reducing the likelihood of infrastructural issues and breaches.
Ensure security group is assigned to database cluster.
Ensure security group is assigned to database cluster.
- Assigning a security group to a database cluster is essential for defining the access control to the database, which significantly contributes to the protection of sensitive data and prevention of unauthorized access.
- This policy helps to enforce best security practices by ensuring only desired traffic, whether ingress or egress from trusted sources, reaches the specified databases, reducing potential data breaches.
- Adopting this policy can lead to improved compliance with data protection regulations or corporate protocols. Violating requirements can lead to fines, penalties, or a loss of customer trust.
- Non-compliance to this policy may result in the database clusters being accessible to potential threats which may lead to data compromise, service disruption, and possible financial and reputation damage.
Ensure compute instance does not have public IP.
Ensure compute instance does not have public IP.
- The security policy prevents unauthorized access to compute instances by ensuring they do not have a publicly exposed IP, significantly decreasing the risk of data breaches or sensitive information loss.
- By enforcing this policy with Infrastructure as Code (IaC) tool like Terraform, consistent security measures are applied across all compute instances, enhancing the resilience and robustness of the entire system.
- The policy simplifies the network management by confining compute instances to a private network, making them only reachable through specific, controlled avenues, thus simplifying the auditing and monitoring process.
- By eliminating public IPs, attack vectors such as direct network hacking attempts, brute force attacks or Distributed Denial of Service (DDoS) attacks are severely reduced, improving the overall safety of the compute infrastructure.
Ensure storage bucket is encrypted.
Ensure storage bucket is encrypted.
- Ensuring storage bucket encryption is crucial for data protection as it prevents unauthorized entities from accessing sensitive information stored in the bucket. This decreases the risk of data breaches or leakages.
- With storage bucket encryption implemented, data transferred in and out of the bucket is encrypted, protecting information from being compromised during transmission. This enhances data security even when information is in transit.
- Violation of this policy might not only lead to potential vulnerability risks and data breach, but also non-compliance with regulatory requirements or standards such as GDPR, PCI DSS, or HIPAA which mandate data encryption.
- The application of encryption on storage buckets would add an additional layer of security, thereby limiting the potential impact of insider threats as even individuals with access to the storage bucket would require decryption keys to access the stored data.
Ensure compute instance does not have serial console enabled.
Ensure compute instance does not have serial console enabled.
- Disabling serial console in compute instances helps protect sensitive information. If the serial console is enabled, it could provide an unauthenticated access point to the instance and potentially reveal important system and user data.
- This policy prevents unauthorized command execution. If the serial console is enabled, it could be used to execute commands with system privileges, potentially causing damage or unauthorized changes to the system configuration.
- Implementing this security policy reinforces defense-in-depth strategies. Even if other security measures fail, a disabled serial console reduces the attack surface and makes it harder for potential intruders to gain access and control of the instance.
- Lastly, applying this rule ensures compliance with best-security practices and standards. Many regulatory bodies require organizations to disable unnecessary access points to privileged systems such as compute instances, hence this policy helps in meeting those compliance requirements.
Ensure Kubernetes cluster does not have public IP address.
Ensure Kubernetes cluster does not have public IP address.
- Ensuring Kubernetes cluster does not have public IP address prevents unauthorized access from external entities. This adds an extra layer of security, making it harder for hostile actors to gain control of the cluster.
- Not exposing Kubernetes cluster to public IPs reduces the surface area for attack, minimizing the potential threats and risks that the cluster could be exposed to such as DDoS attacks, IP spoofing or man-in-the-middle attacks.
- By following this policy, the traffic involving Kubernetes cluster is confined to the private network, which typically offers better traffic management and performance due to less network congestion.
- This policy, which is implementable through Terraform, facilitates more secure setup and configuration of yandex_kubernetes_cluster resources in IaC environments, promoting security best practices right from the development phase.
Ensure Kubernetes cluster node group does not have public IP addresses.
Ensure Kubernetes cluster node group does not have public IP addresses.
- This policy helps to prevent unauthorized access to the Kubernetes cluster node group by blocking public IP addresses, thereby reducing potential security risks from cyber threats.
- By limiting access to node groups, this policy restricts the possibility of harmful attacks like DDoS, data breaches, or system disruptions that could otherwise take advantage of publicly accessible node cluster.
- Ensuring the confidentiality of sensitive data associated with Kubernetes node group is maintained as the exposure to the broader internet community is limited, thereby also upholding regulatory compliance when it comes to data protection.
- Following this policy ensures that the infrastructure as code (IaC) practices are secure and robust. Utilizing tools like Terraform to enforce this rule is part of maintaining a well-structured and secure IT environment.
Ensure Kubernetes cluster auto-upgrade is enabled.
Ensure Kubernetes cluster auto-upgrade is enabled.
- Enabling auto-upgrade for Kubernetes clusters ensures that the clusters run on the latest versions with all security patches applied, reducing the risk of known vulnerabilities being exploited.
- The auto-upgrade process in Kubernetes clusters also handles any necessary node replacements eliminating the need for manual interventions, thus saving resources and time.
- Disabling auto-upgrade could potentially result in running outdated Kubernetes versions lagging in performance and vulnerability patches. This makes the clusters susceptible to slow response times and a heightened threat surface.
- The policy targets ‘yandex_kubernetes_cluster’ specifically, making it highly relevant for organizations and developers using the Yandex Cloud Platform for their Kubernetes deployments.
Ensure Kubernetes node group auto-upgrade is enabled.
Ensure Kubernetes node group auto-upgrade is enabled.
- Enabling Kubernetes node group auto-upgrade ensures that your cluster is always running the most recent and secure version of Kubernetes, helping to keep your infrastructure safe from any vulnerabilities that have been patched in newer versions.
- Auto-upgrades for Kubernetes node groups reduce downtime risks associated with manual upgrades. The automation process runs smoothly and does not require user intervention, causing less business disruption.
- Utilizing this policy can improve operational efficiency of the infrastructure as it frees the IT team from constantly monitoring and manually initiating the upgrade process, allowing them to focus on other critical tasks.
- This policy aligns with infrastructure-as-code (IaC) best practices in maintaining stability and reliability. By leveraging the Terraform tool, developers can easily enable the auto-upgrade feature across multiple node groups and ensure policy coherence across environments.
Ensure KMS symmetric key is rotated.
Ensure KMS symmetric key is rotated.
- Rotating the KMS symmetric key minimizes the risk of the key being compromised by regularly changing it, increasing the security level of resources protected with this key.
- By continuously updating the key in Yandex KMS Symmetric Key, you ensure that even if old data is stolen, it becomes useless as the decryption key is already changed or retired.
- Non-rotation of keys creates a potential threat and opens the route for a single key to be valid indefinitely and be exploited for unauthorized access, data breach, or loss.
- Implementing this policy using Terraform allows automated checks and systematic key rotations, reducing the potential of human error and considerably increasing the efficacy of resource management.
Ensure etcd database is encrypted with KMS key.
Ensure etcd database is encrypted with KMS key.
- Encrypting etcd database with a KMS key ensures that the data is unreadable to those who don’t possess the decryption key, thereby enhancing the security, privacy, and compliance of the data stored within the Kubernetes cluster.
- A KMS key provides heavy-duty hardware security modules that manage encryption keys on behalf of the user, preventing unauthorized access, even by root administrators, thus securing sensitive information.
- Enforcing this policy will help meet industry-wide security and compliance standards such as PCI-DSS, HIPAA, and GDPR that require encryption of sensitive data at rest.
- Failure to encrypt the etcd database with a KMS key could expose sensitive information like secrets and config maps, and leave the system vulnerable to data breaches, resulting in reputational damage, regulatory fines, and possible legal action.
Ensure security group is assigned to network interface.
Ensure security group is assigned to network interface.
- Assigning a security group to a network interface ensures that a specific set of protocols and port ranges are allowed, helping restrict the type of traffic that can interact with the system or service underneath.
- The allocation of security groups to network interfaces on yandex_compute_instance provides an extra level of granularity, allowing different rules for different elements of an instance, thus ensuring more effective segmentation and secure communication between various components.
- Without assigning a security group to a network interface, the entity instances could be exposed to security threats such as open ports or unrestricted access, leading to possible breaches or unwanted data leakage.
- This policy can be easily implemented by using Terraform infrastructure as code (IaC) according to the provided resource link. The use of IaC makes configuration management more efficient and reduces the risk of manual errors that could compromise security.
Ensure public IP is not assigned to database cluster.
Ensure public IP is not assigned to database cluster.
- This policy prevents potential unauthorized access to the database clusters by ensuring they don’t have public IP addresses that are openly accessible to the internet, thus limiting vulnerabilities to cyber attacks such as data breaches and DDoS attacks.
- By enforcing this policy, sensitive and critical data stored within the database clusters are kept protected, maintaining the integrity and confidentiality of the data and potentially preventing costly data infringements.
- The policy supports the principle of least privilege by advocating for database clusters to only be accessible within a secure and private network unless explicitly needed for specific use-cases, thereby minimizing the attack surface and risk exposure.
- With Infrastructure as Code (IaC) like Terraform, this policy can be easily and consistently applied across multiple database clusters, promoting standardization and reducing human error in infrastructure setup. This aids in maintaining compliance with the best practices for infrastructure security.
Ensure cloud member does not have elevated access.
Ensure cloud member does not have elevated access.
- Ensuring that cloud members do not have elevated access minimizes the risk of unauthorized access or misuse of resources, which is crucial in adhering to the principle of least privilege.
- The policy can limit potential damages from security incidents by confining the capability of each member to the minimal threshold necessary to perform their job duties, reducing their ability to inadvertently or intentionally harm the system or data.
- It ensures strong segregation of duties, preventing conflict of interest and the potential for malicious activities, as no single individual could have full control over a particular function.
- Implementing this policy via Infrastructure as Code (IaC) tool like Terraform not just automates security controls but also ensures consistent application of these controls, aiding in the maintenance of a secure cloud environment.
Ensure security group is assigned to Kubernetes cluster.
Ensure security group is assigned to Kubernetes cluster.
- Ensuring a security group is assigned to a Kubernetes cluster can help isolate individual services within the cluster and restrict unauthorized network access, helping to better control traffic flows and reduce the attack surface.
- The appropriate configuration of the security group for the Kubernetes cluster is crucial in meeting compliance requirements and ensuring the resilience of the infrastructure to potential malicious attacks.
- Applying security groups to the Kubernetes cluster can help protect the underlying infrastructure and user data, which can become compromised if exposed to security vulnerabilities.
- Using Infrastructure as Code (IaC) tools like Terraform can automate the process of applying security groups, increasing operational efficiency, and ensuring consistency in policy implementation across the infrastructure.
Ensure security group is assigned to Kubernetes node group.
Ensure security group is assigned to Kubernetes node group.
- Assigning a security group to Kubernetes node group ensures that only authorized network traffic can access the nodes, thereby providing an additional layer of security and minimizing potential attack surfaces.
- This policy helps in maintaining the principle of least privilege, as a dedicated security group can make sure the nodes can only communicate with the components they need to, preventing unnecessary and potentially harmful communications.
- The policy’s enforcement via Terraform, an Infrastructure as Code tool, enables consistency, repeatability, and scalability across multiple nodes and environments. This also reduces the risk of configuration errors.
- Neglecting to adhere to this policy could lead to nodes being exposed to unauthorized network traffic, leading to potential breaches and compromising the integrity, confidentiality, and availability of the Kubernetes application running on Yandex Cloud.
Ensure network policy is assigned to Kubernetes cluster.
Ensure network policy is assigned to Kubernetes cluster.
- Assigning a network policy to a Kubernetes cluster in Yandex cloud ensures that only authorized network traffic is allowed in and out of pods, preventing potential breaches due to unmonitored or unregulated traffic.
- This policy enforces good practices in secure network configurations and aids in compliance with data security and privacy standards by carefully managing access to resources within the cluster.
- Without a network policy, the Kubernetes cluster may be vulnerable to attacks like Denial of Service (DoS) or unauthorized data access, possibly leading to significant data loss or service disruption.
- Using Infrastructure as Code (IaC) tool like Terraform, it allows rapid, repeatable, and consistent implementation of this security measure, simplifying the maintenance and enforcement of the policy across multiple environments.
Ensure storage bucket does not have public access permissions.
Ensure storage bucket does not have public access permissions.
- Restricting public access to storage buckets helps protect sensitive data stored within the bucket from unauthorized users, mitigating risks such as data breaches and exposure.
- Not implementing this policy could possibly lead to data tampering or deletion, which would compromise the integrity and availability of your stored data.
- As the policy is implemented using Terraform, Infrastructure as Code (IaC) practices can be used. This enables automated deployment and configuration of the policy, ensuring consistent application across multiple infrastructure setups.
- The resource link provided leads to a specific Python script, this script is used to apply the policy to the Yandex storage bucket. Therefore, this policy is specific to resources on the Yandex Cloud platform.
Ensure compute instance group does not have public IP.
Ensure compute instance group does not have public IP.
- The policy ensures that the compute instance groups within the Yandex.cloud infrastructure are not directly exposed to the public internet, reducing potential attack surfaces that can be exploited by malicious entities.
- By restricting public IP assignments to compute instance groups, the policy helps to maintain a controlled network environment and reduce the threat of unauthorized access and data breaches.
- This policy can help the organization to comply with information security regulatory requirements like the GDPR and ISO 27001, which necessitate strict controls over access to compute resources containing sensitive data.
- The use of Infrastructure as Code (IaC) tool like Terraform can automate the implement of this policy across multiple environments, ensuring consistent and predictable security configurations, thus minimizing risks associated with human errors.
Ensure security group does not contain allow-all rules.
Ensure security group does not contain allow-all rules.
- This policy ensures that no user can gain unrestricted access to a network, preventing unauthorized access to sensitive data that may be stored within a yandex_vpc_security_group.
- By restricting rules that allow any access, the policy creates a more granular control over who can access network resources, which can reduce the likelihood of a successful cyber attack.
- The policy aids in implementing a least privilege strategy by ensuring that only required network ports and IP ranges have access within the yandex_vpc_security_group.
- A failure to enforce this policy could lead to an exposure of all network resources and services to potential threats, which could result in data breaches or service disruptions.
Ensure security group rule is not allow-all.
Ensure security group rule is not allow-all.
- The policy ‘Ensure security rule is not allow-all’ is important to minimize the attack surface of a resource. If a yandex_vpc_security_group_rule allows all traffic, it becomes highly vulnerable to uncontrolled access, DDoS attacks, and other types of security breaches.
- Defining specific traffic rules helps to keep your infrastructure limit the type of traffic that can flow in and out of your resources. The correct implementation of this policy can protect your resources from unwanted exposure and improve your control over the traffic flowing towards it.
- By ensuring that the “allow-all” rule isn’t in effect, the policy reduces the chances of internal and external breaches. Even if an attacker gains access to an internal resource in the network, they wouldn’t have unrestricted access to other resources.
- Not having this policy in place essentially leaves the door open to threats by overexposing your resources. Ensuring security group rules do not allow all traffic enhances monitoring capabilities and helps maintain a stronger security posture.
Ensure organization member does not have elevated access.
Ensure organization member does not have elevated access.
- This policy helps to limit potential security breaches by ensuring that no organization member has elevated access, which could otherwise be exploited to gain unauthorized access to sensitive resources or data.
- Implementing this policy can prevent unwanted changes and operations. Elevated access means a user can perform actions beyond their supposed scope, such as modifying resource configurations or deleting critical data, which could disrupt normal operations or lead to data loss.
- By restricting elevated access to any organization member, it minimizes the risk of insider threats. Users with elevated access could potentially misuse their permissions for malicious intent or unintentionally cause a security incident.
- The policy is particularly important for larger organizations with multiple team members where tracking individual users and their access level can be challenging. Automating the control of access rights through such policies helps maintain a standard security posture across the organization.
Ensure compute instance group has security group assigned.
Ensure compute instance group has security group assigned.
- Ensuring a compute instance group has a security group assigned helps to control inbound and outbound traffic. This can help to prevent unauthorized access and protect the resources within the group.
- Security groups effectively function as a firewall for the instance group, adding another necessary layer of defense, which ultimately helps protect the organization’s data and maintain the integrity of its systems.
- Without a security group assigned, compute instance groups can be vulnerable to a range of cyber attacks including denial-of-service or man-in-the-middle attacks, leading to possible data theft, corruption, or even complete system takeover.
- Using Terraform for infrastructure as code can automate the process of assigning security groups to compute instance groups, reducing human error and making it faster and easier to implement proper security protocols.
Ensure folder member does not have elevated access.
Ensure folder member does not have elevated access.
- This policy helps maintain the principle of least privilege by ensuring that folder members within the Yandex Cloud infrastructure do not possess access rights beyond what they need for their specific roles. This reduces the risk of data breaches due to misuse or compromise of powerful permissions.
- It prevents malicious activities by limiting the scope of access rights for each member. This ensures that even if an account is compromised, the attacker cannot access or modify resources beyond the set permissions for that particular folder member.
- This policy provides a robust control mechanism to regulate access at the folder level in the cloud environment. Not adhering to this policy may lead to uncontrolled access permissions, potentially affecting the integrity, availability, and confidentiality of resources.
- It reinforces an organization’s compliance with best practices and regulatory requirements regarding information security and data privacy. Non-compliance could lead to substantial penalties or damage to the organization’s reputation.
Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible.
Ensure passport account is not used for assignment. Use service accounts and federated accounts where possible.
- This policy is important because it promotes the use of service accounts and federated accounts instead of passport accounts. Service accounts are non-user accounts that can be used for services that need to authenticate or be granted access to resources. Federated accounts, on the other hand, allow users to use the same login credentials across different systems.
- The policy ensures that specific account types with minimal privileges required to perform a task are used. This limits the potential damage that could be done if the account were to be compromised, adhering to the principle of least privilege.
- Using passport accounts for assignment can lead to a lack of control and visibility over who is accessing what resources. Implementing this policy enables better monitoring and auditing of the accounts and reduces the risk of unauthorized access.
- This policy also enhances the ability to manage and control access to resources within the Yandex Cloud environment. It provides a way of tracking and controlling how permissions are assigned, providing an added level of security for resources.