Initial other-checks benchmark #431

rajlearner17 · 2022-06-29T14:48:21Z

Checklist

Issue(s) linked

Co-authored-by: Khushboo <khushboo@turbot.com>

…mpliance into extra-checks-control

cbruno10

@rajlearner17 I know this PR is still in draft, but I took an initial look as I know we're releasing this week. Please see comments, if any are already changed, please disregard, thanks!

cbruno10 · 2022-07-05T14:44:37Z

query/elb/elb_application_classic_network_lb_prohibit_public_access.sql

@@ -0,0 +1,44 @@
+with all_lb_details as (
+ 	select
+		arn,


@rajlearner17 Why is this query using tabs (along with others)?

cbruno10 · 2022-07-05T14:44:47Z

other_checks/other.sp

+}
+
+benchmark "other" {
+  title         = "Other"


Suggested change

title = "Other"

title = "Other Compliance Checks"

cbruno10 · 2022-07-05T14:45:13Z

other_checks/docs/other_checks_overview.md

@@ -0,0 +1 @@
+We are adding additional checks to improve the information gathering around other AWS compliance best practices, these checks are out of the scope of any predefined benchmarks for AWS but we consider them very helpful.


I'm currently writing some additional content for this doc, I'll add it later today

misraved · 2022-07-06T08:00:01Z

query/eks/eks_cluster_control_plane_audit_logging_enabled.sql

+with control_panel_audit_logging as (
+  select
+    distinct arn,
+    log -> 'Types'  as log_type


Suggested change

log -> 'Types' as log_type

log -> 'Types' as log_type

misraved · 2022-07-06T08:00:34Z

query/eks/eks_cluster_control_plane_audit_logging_enabled.sql

+    jsonb_array_elements(logging -> 'ClusterLogging') as log
+  where
+    log ->> 'Enabled' = 'true'
+    and (log -> 'Types') @> '["api","audit", "authenticator", "controllerManager","scheduler"]'


Suggested change

and (log -> 'Types') @> '["api","audit", "authenticator", "controllerManager","scheduler"]'

and (log -> 'Types') @> '["api", "audit", "authenticator", "controllerManager", "scheduler"]'

misraved · 2022-07-06T08:09:52Z

query/elb/elb_application_classic_lb_with_outbound_rule.sql

+  case
+    when l.security_groups is null then l.title || ' does not have security group attached.'
+    when s.num = 0 then l.title || ' does not have outbound rule.'
+    else l.title || ' have outbound rule(s).'


Can we add how many outbound rules are present?

misraved · 2022-07-06T08:10:15Z

query/elb/elb_classic_lb_unused.sql

+    aws_ec2_classic_load_balancer as c,
+    jsonb_array_elements(instances) as e
+    left join aws_ec2_instance as i on i.instance_id = e ->> 'InstanceId'
+


Suggested change

misraved · 2022-07-06T08:12:02Z

query/elb/elb_listener_use_secure_ssl_cipher.sql

@@ -0,0 +1,20 @@
+select
+ -- Required Columns


Suggested change

-- Required Columns

-- Required Columns

@khushboo9024 Could we update the alignment of the queries to maintain consistency?

misraved · 2022-07-06T08:14:48Z

query/glue/glue_data_catalog_encryption_settings_metadata_encryption_enabled.sql

+    else 'alarm'
+  end as "status",
+  case
+    when encryption_at_rest is not null and encryption_at_rest ->> 'CatalogEncryptionMode' != 'DISABLED' then 'enabled glue data catalog metadata encryption in ' || region


Suggested change

when encryption_at_rest is not null and encryption_at_rest ->> 'CatalogEncryptionMode' != 'DISABLED' then 'enabled glue data catalog metadata encryption in ' || region

when encryption_at_rest is not null and encryption_at_rest ->> 'CatalogEncryptionMode' != 'DISABLED' then 'glue data catalog metadata encryption is enabled in ' || region

misraved · 2022-07-06T08:15:15Z

query/glue/glue_data_catalog_encryption_settings_metadata_encryption_enabled.sql

+  end as "status",
+  case
+    when encryption_at_rest is not null and encryption_at_rest ->> 'CatalogEncryptionMode' != 'DISABLED' then 'enabled glue data catalog metadata encryption in ' || region
+    else 'disabled glue data catalog metadata encryption in ' || region


Suggested change

else 'disabled glue data catalog metadata encryption in ' || region

else 'glue data catalog metadata encryption is disabled in ' || region

misraved · 2022-07-06T08:15:48Z

query/glue/glue_data_catalog_encryption_settings_password_encryption_enabled.sql

+    else 'alarm'
+  end as "status",
+  case
+    when connection_password_encryption is not null and connection_password_encryption ->> 'ReturnConnectionPasswordEncrypted' != 'false' then 'enabled glue data catalog connection password encryption in ' || region


Please make changes as per the above suggestion

misraved · 2022-07-06T08:16:53Z

query/glue/glue_dev_endpoint_s3_encryption_enabled.sql

+    else 'alarm'
+  end as "status",
+  case
+    when e is not null and e ->> 'S3EncryptionMode' != 'DISABLED' then d.title || ' s3 encryption enabled.'


Suggested change

when e is not null and e ->> 'S3EncryptionMode' != 'DISABLED' then d.title || ' s3 encryption enabled.'

when e is not null and e ->> 'S3EncryptionMode' != 'DISABLED' then d.title || ' S3 encryption enabled.'

misraved · 2022-07-06T08:17:07Z

query/glue/glue_dev_endpoint_s3_encryption_enabled.sql

+  end as "status",
+  case
+    when e is not null and e ->> 'S3EncryptionMode' != 'DISABLED' then d.title || ' s3 encryption enabled.'
+    else d.title || ' s3 encryption disabled.'


Suggested change

else d.title || ' s3 encryption disabled.'

else d.title || ' S3 encryption disabled.'

misraved · 2022-07-06T08:18:38Z

query/glue/glue_job_s3_encryption_enabled.sql

+    else 'alarm'
+  end as status,
+  case
+    when e is not null and e ->> 'S3EncryptionMode' != 'DISABLED' then j.title || ' enabled s3 encryption.'


Can we update the reason to follow a single pattern as mentioned in -
https://github.com/turbot/steampipe-mod-aws-compliance/pull/431/files#r914552035

misraved · 2022-07-06T08:19:07Z

query/iam/iam_policy_custom_no_assume_role.sql

+    else 'ok'
+  end as status,
+  case
+    when fu.user_id is not null then u.name || ' custom policies allows STS Role assumption.'


Suggested change

when fu.user_id is not null then u.name || ' custom policies allows STS Role assumption.'

when fu.user_id is not null then u.name || ' custom policies allow STS Role assumption.'

misraved · 2022-07-06T08:20:05Z

query/iam/iam_user_with_administrator_access_mfa_enabled.sql

+  end as status,
+  case
+    when au.user_id is null then u.name || ' does not have administrator access.'
+    when au.user_id is not null and u.mfa_enabled then u.name || ' have MFA token enabled.'


Suggested change

when au.user_id is not null and u.mfa_enabled then u.name || ' have MFA token enabled.'

when au.user_id is not null and u.mfa_enabled then u.name || ' has MFA token enabled.'

…te other check overview page

karanpopat and others added 15 commits June 15, 2022 17:14

Add extra check queries (#416)

816c2a1

Co-authored-by: Khushboo <khushboo@turbot.com>

added initial controls

2399247

update

d1a4eeb

Add queries for extra checks (#417)

fb8658e

Merge branch 'extra-checks' of github.com:turbot/steampipe-mod-aws-co…

8750e94

…mpliance into extra-checks-control

update

b1bc8c8

update

461ee5b

update

bba84cd

update

90a322b

Add extra checks glue queries (#426)

7143dce

Merge branch 'extra-checks' of github.com:turbot/steampipe-mod-aws-co…

94f9cc1

…mpliance into extra-checks-control

added glue controls

213af3f

added new controls

7423cc9

update

1d352e8

Update to consolidate to a single benchmark

7e48ad2

rajlearner17 changed the title ~~Extra checks design2~~ Initial other-checks benchmark Jun 29, 2022

rajlearner17 marked this pull request as draft June 29, 2022 14:49

Base automatically changed from release/v0.37 to main June 30, 2022 06:45

rajlearner17 changed the base branch from main to release/v0.38 June 30, 2022 14:58

khushboo9024 added 5 commits July 5, 2022 11:42

added new queries

b0acd46

merge conflict

c14b96a

updated tags

b6dbf08

added new controls

6d89d90

added new control

354978b

cbruno10 requested changes Jul 5, 2022

View reviewed changes

khushboo9024 marked this pull request as ready for review July 6, 2022 05:41

updated query format

95326de

misraved reviewed Jul 6, 2022

View reviewed changes

khushboo9024 and others added 16 commits July 6, 2022 14:24

made suggested changes

0dae643

Tidy control description and queries

de1b0df

update

1de16cd

updated

3123aba

Update route53.sp

b24a443

Update eks.sp

09071fd

Update es.sp

2f7cd94

Update es.sp

3b643dd

Update acm.sp

f0e5ce5

Update ecr.sp

aec15b8

Update ecs.sp

eafb02c

Update s3.sp

7dde9ca

Update vpc.sp

1404bbf

Add back in new note for FFIEC, remove security hub other check, upda…

b1baa4b

…te other check overview page

Update other_checks tag

34a649e

Update glue.sp

b86c90e

cbruno10 approved these changes Jul 6, 2022

View reviewed changes

cbruno10 merged commit 44ae3ee into release/v0.38 Jul 6, 2022

cbruno10 deleted the extra-checks-design2 branch July 6, 2022 17:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Initial other-checks benchmark #431

Initial other-checks benchmark #431

rajlearner17 commented Jun 29, 2022

cbruno10 left a comment

cbruno10 Jul 5, 2022

cbruno10 Jul 5, 2022

cbruno10 Jul 5, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

misraved Jul 6, 2022

		@@ -0,0 +1 @@
		We are adding additional checks to improve the information gathering around other AWS compliance best practices, these checks are out of the scope of any predefined benchmarks for AWS but we consider them very helpful.

	and (log -> 'Types') @> '["api","audit", "authenticator", "controllerManager","scheduler"]'
	and (log -> 'Types') @> '["api", "audit", "authenticator", "controllerManager", "scheduler"]'

	when encryption_at_rest is not null and encryption_at_rest ->> 'CatalogEncryptionMode' != 'DISABLED' then 'enabled glue data catalog metadata encryption in ' \|\| region
	when encryption_at_rest is not null and encryption_at_rest ->> 'CatalogEncryptionMode' != 'DISABLED' then 'glue data catalog metadata encryption is enabled in ' \|\| region

	else 'disabled glue data catalog metadata encryption in ' \|\| region
	else 'glue data catalog metadata encryption is disabled in ' \|\| region

	when e is not null and e ->> 'S3EncryptionMode' != 'DISABLED' then d.title \|\| ' s3 encryption enabled.'
	when e is not null and e ->> 'S3EncryptionMode' != 'DISABLED' then d.title \|\| ' S3 encryption enabled.'

	else d.title \|\| ' s3 encryption disabled.'
	else d.title \|\| ' S3 encryption disabled.'

	when fu.user_id is not null then u.name \|\| ' custom policies allows STS Role assumption.'
	when fu.user_id is not null then u.name \|\| ' custom policies allow STS Role assumption.'

	when au.user_id is not null and u.mfa_enabled then u.name \|\| ' have MFA token enabled.'
	when au.user_id is not null and u.mfa_enabled then u.name \|\| ' has MFA token enabled.'

Initial other-checks benchmark #431

Initial other-checks benchmark #431

Conversation

rajlearner17 commented Jun 29, 2022

Checklist

cbruno10 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment