From 81495a9ed8ea28c59877942a56a35a98cf679c22 Mon Sep 17 00:00:00 2001 From: Cesar Rodriguez Date: Thu, 19 Aug 2021 22:11:07 -0400 Subject: [PATCH] Revert "update resource type to map[string]bool (#992)" (#1001) This reverts commit 3e8d964da2bd2bef0730200a6ff74cf6cc7ca545. --- pkg/filters/filter-specs.go | 11 +- pkg/filters/filters_test.go | 10 +- ....Encryption&KeyManagement.Medium.0688.json | 4 +- .../AWS.AMI.NS.Medium.1040.json | 4 +- .../AWS.APGM.IS.LOW.0056.json | 8 +- .../AWS.API Gateway.Logging.Medium.0569.json | 4 +- .../AWS.APIGateway.Medium.0568.json | 4 +- ...IGateway.Network Security.Medium.0570.json | 4 +- .../AWS.APGRAP.IAM.HIGH.0064.json | 8 +- .../AWS.API Gateway.Logging.Medium.0567.json | 5 +- .../AWS.API Gateway.Logging.Medium.0571.json | 4 +- .../AWS.API Gateway.Logging.Medium.0572.json | 4 +- ... Gateway.Network Security.Medium.0565.json | 4 +- ...atewayV2Api.AccessControl.Medium.0630.json | 8 +- ...WS.ApiGatewayV2Stage.Logging.Low.0630.json | 8 +- .../AWS.ADB.DP.MEDIUM.016.json | 8 +- .../AWS.CloudFormation.Medium.0599.json | 8 +- .../AWS.CloudFormation.Medium.0603.json | 4 +- .../AWS.CloudFormation.Medium.0604.json | 8 +- .../AWS.CloudFormation.Medium.0605.json | 5 +- .../AC-AW-IS-CD-M-0026.json | 4 +- .../AC-AW-IS-CD-M-1186.json | 4 +- ....EncryptionandKeyManagement.High.0407.json | 4 +- ....EncryptionandKeyManagement.High.0408.json | 4 +- .../AWS.CloudFront.Logging.Medium.0567.json | 4 +- .../AWS.CloudTrail.LM.MEDIUM.0087.json | 8 +- .../AWS.CloudTrail.Logging.High.0399.json | 4 +- .../AWS.CloudTrail.Logging.Low.009.json | 9 +- .../AWS.CloudTrail.Logging.Low.0559.json | 4 +- .../AWS.CloudTrail.Logging.Medium.004.json | 8 +- .../AWS.CloudTrail.Logging.Medium.008.json | 9 +- .../AWS.CloudTrail.Logging.Medium.0460.json | 4 +- .../AWS.Config.Logging.Medium.0590.json | 9 +- ....EncryptionandKeyManagement.High.0632.json | 9 +- .../AWS.CloudWatch.Logging.Medium.0631.json | 5 +- .../AWS.ACLG.LM.MEDIUM.0068.json | 8 +- ....Encryption&KeyManagement.Medium.0660.json | 4 +- .../AWS.Config.Logging.HIGH.0590.json | 4 +- .../AWS.ADC.DP.MEDIUM.0021.json | 10 +- .../AWS.ADI.LM.MEDIUM.0076.json | 8 +- .../aws_db_instance/AWS.RDS.DS.High.1041.json | 4 +- .../aws_db_instance/AWS.RDS.DS.High.1042.json | 4 +- .../AWS.RDS.DataSecurity.High.0414.json | 4 +- .../AWS.RDS.DataSecurity.High.0577.json | 4 +- .../aws_db_instance/AWS.RDS.NS.High.0101.json | 4 +- .../AWS.RDS.NetworkSecurity.High.0101.json | 4 +- .../AWS.RDS.NetworkSecurity.High.0102.json | 4 +- .../AWS.RDS.NetworkSecurity.High.0103.json | 4 +- .../AWS.ADC.DP.MEDIUM.0022.json | 8 +- .../AWS.ADC.DP.MEDIUM.0069.json | 8 +- .../AWS.ADT.DP.MEDIUM.0025.json | 8 +- .../AWS.DynamoDb.Logging.Medium.007.json | 8 +- .../AWS.EBS.DataSecurity.High.0580.json | 4 +- .../AWS.EBS.EKM.Medium.0682.json | 9 +- ....EncryptionandKeyManagement.High.0413.json | 8 +- .../AWS.AER.DP.MEDIUM.0026.json | 8 +- .../AWS.AER.DP.MEDIUM.0058.json | 8 +- .../AWS.ECR.DataSecurity.High.0578.json | 4 +- .../AWS.ECR.DataSecurity.High.0579.json | 4 +- .../aws_ecs_service/AWS.ECS.High.0436.json | 4 +- .../AWS.AETD.IS.MEDIUM.0043.json | 8 +- ....EcsCluster.NetworkSecurity.High.0104.json | 4 +- ...hConfiguration.DataSecurity.High.0101.json | 4 +- ....EncryptionandKeyManagement.High.0409.json | 4 +- ....EncryptionandKeyManagement.High.0410.json | 4 +- .../AWS.AEFSP.IAM.HIGH.0059.json | 8 +- .../AWS.AEC.LM.MEDIUM.0071.json | 8 +- ...WS.ElastiCache.DataSecurity.High.0424.json | 4 +- ...WS.ElastiCache.DataSecurity.High.0425.json | 4 +- ...stiCache.HighAvailability.Medium.0757.json | 4 +- .../AWS.AERG.DP.MEDIUM.0027.json | 8 +- .../AWS.AERG.DP.MEDIUM.0044.json | 8 +- .../AWS.ElasticSearch.EKM.Medium.0768.json | 4 +- .../AWS.ElasticSearch.EKM.Medium.0778.json | 4 +- .../AWS.ElasticSearch.IS.MEDIUM.0045.json | 8 +- ...AWS.Elasticsearch.Logging.Medium.0573.json | 4 +- .../AWS.AEDP.IAM.HIGH.0060.json | 8 +- .../aws/aws_elb/AWS.ELB.LM.MEDIUM.0072.json | 8 +- ...AWS.ELB.NetworkPortsSecurity.Low.0563.json | 4 +- .../AWS.AGA.LM.LOW.0073.json | 8 +- ...uardDuty Enabled.Security.Medium.0575.json | 4 +- .../AWS.IamUser.IAM.High.0390.json | 4 +- .../AWS.IamUser.IAM.High.0391.json | 4 +- .../AWS.Iam.IAM.Low.0539.json | 8 +- .../AWS.Iam.IAM.Low.0540.json | 4 +- .../AWS.Iam.IAM.Medium.0454.json | 4 +- .../AWS.Iam.IAM.Medium.0455.json | 4 +- .../AWS.Iam.IAM.Medium.0456.json | 4 +- .../AWS.Iam.IAM.Medium.0457.json | 4 +- .../AWS.Iam.IAM.Medium.0458.json | 4 +- .../AWS.Iam.IAM.Medium.0495.json | 4 +- .../aws_iam_group_policy/AC-AW-IA-H-0392.json | 4 +- .../aws/aws_iam_policy/AC-AW-IA-H-1187.json | 4 +- .../aws/aws_iam_role/AC-AW-IA-H-1188.json | 4 +- .../aws_iam_role_policy/AC-AW-IA-H-1189.json | 4 +- .../AWS.AIRP.IAM.HIGH.0051.json | 8 +- .../AWS.Iam.IAM.High.0391.json | 4 +- .../aws_iam_user_policy/AC-AW-IA-H-1190.json | 8 +- .../AWS.AIUP.IAM.MEDIUM.0049.json | 8 +- .../AWS.IamUser.IAM.High.0387.json | 4 +- .../AWS.IamUser.IAM.High.0388.json | 4 +- .../AWS.IamUser.IAM.High.0389.json | 4 +- .../AWS.AIUPA.IAM.MEDIUM.0050.json | 8 +- .../aws/aws_instance/AC-AW-IA-IN-H-0442.json | 10 +- .../aws/aws_instance/AC-AW-IS-IN-H-0443.json | 12 +- .../aws/aws_instance/AC-AW-IS-IN-M-0144.json | 4 +- .../aws/aws_instance/AC-AWS-NS-IN-M-1172.json | 8 +- .../aws/aws_instance/AWS.AI.LM.HIGH.0070.json | 8 +- ....EncryptionandKeyManagement.High.0411.json | 4 +- ....EncryptionandKeyManagement.High.0412.json | 4 +- .../aws/aws_kms_key/AWS.AKK.DP.HIGH.0012.json | 4 +- .../aws_kms_key/AWS.AKK.IAM.HIGH.0012.json | 8 +- .../aws_kms_key/AWS.AKK.IAM.HIGH.0082.json | 8 +- .../AWS.KMS.NetworkSecurity.High.0566.json | 4 +- ....EncryptionandKeyManagement.High.0471.json | 8 +- .../AWS.LambdaFunction.LM.MEIDUM.0063.json | 8 +- .../AWS.LambdaFunction.Logging.0470.json | 4 +- .../AWS.LambdaFunction.Logging.Low.0470.json | 8 +- .../AWS.LambdaFunction.Logging.Low.0472.json | 8 +- .../AC-AW-CA-LC-H-0439.json | 8 +- .../AC-AW-IA-LC-M-0441.json | 8 +- .../AC-AW-IS-LC-H-0438.json | 8 +- .../AC-AW-LM-LC-M-0440.json | 8 +- ....EncryptionandKeyManagement.High.0413.json | 4 +- ...hConfiguration.DataSecurity.High.0101.json | 4 +- ...hConfiguration.DataSecurity.High.0102.json | 4 +- .../AWS.ALL.IS.MEDIUM.0046.json | 8 +- .../AWS.ALTG.IS.MEDIUM.0042.json | 8 +- ....EncryptionandKeyManagement.High.0401.json | 4 +- ....EncryptionandKeyManagement.High.0403.json | 4 +- ...AWS.ElasticSearch.Logging.Medium.0885.json | 4 +- ...ticSearch.NetworkSecurity.Medium.0887.json | 4 +- .../AWS.ANC.DP.MEDIUM.0030.json | 8 +- .../AWS.ANC.LM.MEDIUM.0075.json | 8 +- ....EncryptionandKeyManagement.High.0414.json | 4 +- .../AWS.RDS.RE.MEDIUM.0013.json | 8 +- ....EncryptionandKeyManagement.High.0415.json | 4 +- .../AWS.Redshift.Logging.Medium.0565.json | 4 +- ...WS.Redshift.NetworkSecurity.HIGH.0564.json | 4 +- ...oute53 query logs.Logging.Medium.0574.json | 4 +- ...e53HostedZone.DNSManagement.High.0422.json | 4 +- .../AWS.S3Bucket.DS.High.1043.json | 4 +- ....EncryptionandKeyManagement.High.0405.json | 4 +- .../AWS.S3Bucket.IAM.HIGH.0065.json | 8 +- .../AWS.S3Bucket.IAM.High.0370.json | 4 +- .../AWS.S3Bucket.IAM.High.0377.json | 4 +- .../AWS.S3Bucket.IAM.High.0378.json | 4 +- .../AWS.S3Bucket.IAM.High.0379.json | 4 +- .../AWS.S3Bucket.IAM.High.0381.json | 4 +- .../AWS.S3Bucket.LM.MEDIUM.0078.json | 8 +- ...WS.S3Bucket.NetworkSecurity.High.0417.json | 4 +- .../AWS.ASBO.DP.MEDIUM.0034.json | 8 +- .../AWS.IamPolicy.IAM.High.0373.json | 4 +- .../AWS.IamPolicy.IAM.High.0374.json | 4 +- .../AWS.IamPolicy.IAM.High.0375.json | 4 +- .../AWS.IamPolicy.IAM.High.0376.json | 4 +- .../AWS.S3Bucket.IAM.High.0371.json | 4 +- .../AWS.S3Bucket.IAM.High.0372.json | 4 +- .../AWS.ASNI.DP.MEDIUM.0035.json | 8 +- ...S.SecretsManagerSecret.DP.MEDIUM.0036.json | 8 +- .../AWS.ASSP.IAM.HIGH.0066.json | 8 +- .../aws/aws_security_group/AC_AWS_0227.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0228.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0229.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0230.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0231.json | 35 +++--- .../aws/aws_security_group/AC_AWS_0232.json | 33 +++-- .../aws/aws_security_group/AC_AWS_0233.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0234.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0235.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0236.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0237.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0238.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0239.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0240.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0241.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0242.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0243.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0244.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0245.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0246.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0247.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0248.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0249.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0250.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0251.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0252.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0253.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0254.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0255.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0256.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0257.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0258.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0259.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0260.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0261.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0262.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0263.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0264.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0265.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0266.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0267.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0268.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0269.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0270.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0271.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0272.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0273.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0274.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0275.json | 33 +++-- .../aws/aws_security_group/AC_AWS_0276.json | 113 +++++++++--------- .../aws/aws_security_group/AC_AWS_0277.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0278.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0279.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0280.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0281.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0282.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0283.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0284.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0285.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0286.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0287.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0288.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0289.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0290.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0291.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0292.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0293.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0294.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0295.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0296.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0297.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0298.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0299.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0300.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0301.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0302.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0303.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0304.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0305.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0306.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0307.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0308.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0309.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0310.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0311.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0312.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0313.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0314.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0315.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0316.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0317.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0318.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0319.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0320.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0321.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0322.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0323.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0324.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0325.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0326.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0327.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0328.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0329.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0330.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0331.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0332.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0333.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0334.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0335.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0336.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0337.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0338.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0339.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0340.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0341.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0342.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0343.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0344.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0345.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0346.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0347.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0348.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0349.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0350.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0351.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0352.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0353.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0354.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0355.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0356.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0357.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0358.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0359.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0360.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0361.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0362.json | 39 +++--- .../aws/aws_security_group/AC_AWS_0363.json | 39 +++--- .../aws_sns_topic/AWS.AST.DP.MEDIUM.0037.json | 8 +- .../aws_sns_topic/AWS.SNS.NS.Medium.1044.json | 4 +- .../AWS.SQS.NetworkSecurity.High.0569.json | 4 +- .../AWS.SQS.NetworkSecurity.High.0570.json | 4 +- .../aws_vpc/AWS.VPC.Logging.Medium.0470.json | 5 +- .../aws_vpc/AWS.VPC.Logging.Medium.0471.json | 4 +- .../AWS.AWW.DP.MEDIUM.040.json | 8 +- .../AWS.AWW.DP.MEDIUM.041.json | 8 +- .../accurics.azure.NS.147.json | 4 +- .../accurics.azure.AKS.3.json | 5 +- .../accurics.azure.EKM.164.json | 4 +- .../accurics.azure.CAM.162.json | 4 +- .../accurics.azure.NS.32.json | 4 +- .../accurics.azure.EKM.164.json | 5 +- .../accurics.azure.EKM.20.json | 4 +- .../accurics.azure.EKM.25.json | 4 +- .../accurics.azure.EKM.26.json | 4 +- .../accurics.azure.NS.382.json | 4 +- .../accurics.azure.NS.383.json | 4 +- .../accurics.azure.EKM.156.json | 6 +- .../accurics.azure.LOG.357.json | 4 +- .../accurics.azure.MON.355.json | 4 +- .../accurics.azure.NS.361.json | 4 +- .../AC_AZURE_0270.json | 39 +++--- .../AC_AZURE_0271.json | 39 +++--- .../AC_AZURE_0272.json | 39 +++--- .../AC_AZURE_0273.json | 39 +++--- .../AC_AZURE_0274.json | 39 +++--- .../AC_AZURE_0275.json | 39 +++--- .../AC_AZURE_0276.json | 39 +++--- .../AC_AZURE_0285.json | 39 +++--- .../AC_AZURE_0286.json | 39 +++--- .../AC_AZURE_0287.json | 39 +++--- .../AC_AZURE_0342.json | 39 +++--- .../AC_AZURE_0357.json | 39 +++--- .../AC_AZURE_0421.json | 33 +++-- .../AC_AZURE_0422.json | 39 +++--- .../AC_AZURE_0423.json | 39 +++--- .../AC_AZURE_0424.json | 39 +++--- .../AC_AZURE_0425.json | 39 +++--- .../AC_AZURE_0426.json | 39 +++--- .../AC_AZURE_0427.json | 39 +++--- .../AC_AZURE_0428.json | 39 +++--- .../AC_AZURE_0429.json | 39 +++--- .../AC_AZURE_0430.json | 39 +++--- .../AC_AZURE_0431.json | 39 +++--- .../AC_AZURE_0432.json | 39 +++--- .../AC_AZURE_0433.json | 39 +++--- .../AC_AZURE_0434.json | 39 +++--- .../AC_AZURE_0435.json | 39 +++--- .../AC_AZURE_0436.json | 39 +++--- .../AC_AZURE_0437.json | 39 +++--- .../AC_AZURE_0438.json | 39 +++--- .../AC_AZURE_0439.json | 39 +++--- .../AC_AZURE_0440.json | 39 +++--- .../AC_AZURE_0441.json | 39 +++--- .../AC_AZURE_0442.json | 39 +++--- .../AC_AZURE_0443.json | 39 +++--- .../AC_AZURE_0444.json | 39 +++--- .../AC_AZURE_0445.json | 39 +++--- .../AC_AZURE_0446.json | 39 +++--- .../AC_AZURE_0447.json | 39 +++--- .../AC_AZURE_0448.json | 39 +++--- .../AC_AZURE_0449.json | 39 +++--- .../AC_AZURE_0450.json | 39 +++--- .../AC_AZURE_0451.json | 39 +++--- .../AC_AZURE_0452.json | 39 +++--- .../AC_AZURE_0453.json | 39 +++--- .../AC_AZURE_0454.json | 39 +++--- .../AC_AZURE_0455.json | 39 +++--- .../AC_AZURE_0456.json | 39 +++--- .../AC_AZURE_0457.json | 39 +++--- .../AC_AZURE_0458.json | 39 +++--- .../AC_AZURE_0459.json | 39 +++--- .../AC_AZURE_0460.json | 39 +++--- .../AC_AZURE_0461.json | 39 +++--- .../AC_AZURE_0462.json | 39 +++--- .../AC_AZURE_0463.json | 39 +++--- .../AC_AZURE_0464.json | 39 +++--- .../AC_AZURE_0465.json | 39 +++--- .../AC_AZURE_0466.json | 39 +++--- .../AC_AZURE_0467.json | 39 +++--- .../AC_AZURE_0468.json | 39 +++--- .../AC_AZURE_0469.json | 39 +++--- .../AC_AZURE_0470.json | 39 +++--- .../AC_AZURE_0471.json | 39 +++--- .../AC_AZURE_0472.json | 39 +++--- .../AC_AZURE_0473.json | 39 +++--- .../AC_AZURE_0474.json | 39 +++--- .../AC_AZURE_0475.json | 39 +++--- .../AC_AZURE_0476.json | 39 +++--- .../AC_AZURE_0477.json | 39 +++--- .../AC_AZURE_0478.json | 39 +++--- .../AC_AZURE_0479.json | 39 +++--- .../AC_AZURE_0480.json | 39 +++--- .../AC_AZURE_0481.json | 39 +++--- .../AC_AZURE_0482.json | 39 +++--- .../AC_AZURE_0483.json | 39 +++--- .../AC_AZURE_0484.json | 39 +++--- .../AC_AZURE_0485.json | 39 +++--- .../AC_AZURE_0486.json | 39 +++--- .../AC_AZURE_0487.json | 39 +++--- .../AC_AZURE_0488.json | 39 +++--- .../AC_AZURE_0489.json | 39 +++--- .../AC_AZURE_0490.json | 39 +++--- .../AC_AZURE_0491.json | 39 +++--- .../AC_AZURE_0492.json | 39 +++--- .../AC_AZURE_0493.json | 39 +++--- .../AC_AZURE_0494.json | 39 +++--- .../AC_AZURE_0495.json | 39 +++--- .../AC_AZURE_0496.json | 39 +++--- .../AC_AZURE_0497.json | 39 +++--- .../AC_AZURE_0498.json | 39 +++--- .../AC_AZURE_0499.json | 39 +++--- .../AC_AZURE_0500.json | 39 +++--- .../AC_AZURE_0501.json | 39 +++--- .../AC_AZURE_0502.json | 39 +++--- .../AC_AZURE_0503.json | 39 +++--- .../AC_AZURE_0504.json | 39 +++--- .../AC_AZURE_0505.json | 39 +++--- .../AC_AZURE_0506.json | 39 +++--- .../AC_AZURE_0507.json | 39 +++--- .../AC_AZURE_0508.json | 39 +++--- .../AC_AZURE_0509.json | 39 +++--- .../AC_AZURE_0510.json | 39 +++--- .../AC_AZURE_0511.json | 39 +++--- .../AC_AZURE_0512.json | 39 +++--- .../AC_AZURE_0513.json | 39 +++--- .../AC_AZURE_0514.json | 39 +++--- .../AC_AZURE_0515.json | 39 +++--- .../AC_AZURE_0516.json | 39 +++--- .../AC_AZURE_0517.json | 39 +++--- .../AC_AZURE_0518.json | 39 +++--- .../AC_AZURE_0519.json | 39 +++--- .../AC_AZURE_0520.json | 39 +++--- .../AC_AZURE_0521.json | 39 +++--- .../AC_AZURE_0522.json | 39 +++--- .../AC_AZURE_0523.json | 39 +++--- .../AC_AZURE_0524.json | 39 +++--- .../AC_AZURE_0525.json | 39 +++--- .../AC_AZURE_0526.json | 39 +++--- .../AC_AZURE_0527.json | 39 +++--- .../AC_AZURE_0528.json | 39 +++--- .../AC_AZURE_0529.json | 39 +++--- .../AC_AZURE_0530.json | 39 +++--- .../AC_AZURE_0531.json | 39 +++--- .../AC_AZURE_0532.json | 39 +++--- .../AC_AZURE_0533.json | 39 +++--- .../AC_AZURE_0534.json | 39 +++--- .../AC_AZURE_0535.json | 39 +++--- .../AC_AZURE_0536.json | 39 +++--- .../AC_AZURE_0537.json | 39 +++--- .../accurics.azure.NS.11.json | 4 +- .../accurics.azure.NS.342.json | 4 +- .../accurics.azure.LOG.151.json | 4 +- .../accurics.azure.LOG.152.json | 4 +- .../accurics.azure.LOG.153.json | 4 +- .../accurics.azure.LOG.154.json | 4 +- .../accurics.azure.LOG.155.json | 4 +- .../accurics.azure.LOG.364.json | 4 +- .../accurics.azure.BDR.163.json | 4 +- .../accurics.azure.EKM.1.json | 4 +- .../accurics.azure.EKM.23.json | 4 +- .../accurics.azure.NS.13.json | 4 +- .../accurics.azure.NS.166.json | 4 +- .../accurics.azure.NS.30.json | 5 +- .../accurics.azure.NS.31.json | 5 +- .../accurics.azure.NS.272.json | 5 +- .../accurics.azure.IAM.388.json | 4 +- .../accurics.azure.MON.353.json | 4 +- .../accurics.azure.OPS.349.json | 4 +- .../accurics.azure.IAM.137.json | 4 +- .../accurics.azure.MON.157.json | 4 +- .../accurics.azure.NS.169.json | 4 +- .../accurics.azure.NS.21.json | 4 +- .../accurics.azure.NS.5.json | 4 +- .../accurics.azure.IAM.10.json | 4 +- .../accurics.azure.IAM.138.json | 6 +- .../accurics.azure.LOG.356.json | 4 +- .../accurics.azure.MON.354.json | 4 +- .../accurics.azure.EKM.7.json | 4 +- .../accurics.azure.NS.2.json | 4 +- .../accurics.azure.NS.4.json | 4 +- .../accurics.azure.NS.370.json | 4 +- .../accurics.azure.IAM.368.json | 4 +- .../accurics.azure.NS.161.json | 4 +- .../docker/docker_expose/AC_DOCKER_0011.json | 12 +- .../docker/docker_from/AC_DOCKER_0001.json | 12 +- .../docker/docker_run/AC_DOCKER_0002.json | 12 +- .../docker/docker_run/AC_DOCKER_0003.json | 12 +- .../docker/docker_run/AC_DOCKER_0004.json | 12 +- .../docker/docker_run/AC_DOCKER_0005.json | 12 +- .../docker/docker_run/AC_DOCKER_0007.json | 8 +- .../docker/docker_run/AC_DOCKER_0009.json | 8 +- .../docker/docker_run/AC_DOCKER_0010.json | 8 +- .../docker/docker_workdir/AC_DOCKER_0013.json | 12 +- .../accurics.gcp.IAM.145.json | 4 +- .../accurics.gcp.IAM.106.json | 4 +- .../accurics.gcp.EKM.131.json | 4 +- .../google_compute_firewall/AC_GCP_0042.json | 8 +- .../google_compute_firewall/AC_GCP_0043.json | 8 +- .../google_compute_firewall/AC_GCP_0044.json | 8 +- .../google_compute_firewall/AC_GCP_0045.json | 8 +- .../google_compute_firewall/AC_GCP_0046.json | 8 +- .../google_compute_firewall/AC_GCP_0047.json | 8 +- .../google_compute_firewall/AC_GCP_0048.json | 8 +- .../google_compute_firewall/AC_GCP_0049.json | 8 +- .../google_compute_firewall/AC_GCP_0050.json | 8 +- .../google_compute_firewall/AC_GCP_0051.json | 8 +- .../google_compute_firewall/AC_GCP_0052.json | 8 +- .../google_compute_firewall/AC_GCP_0053.json | 8 +- .../google_compute_firewall/AC_GCP_0054.json | 8 +- .../google_compute_firewall/AC_GCP_0055.json | 8 +- .../google_compute_firewall/AC_GCP_0056.json | 8 +- .../google_compute_firewall/AC_GCP_0057.json | 8 +- .../google_compute_firewall/AC_GCP_0058.json | 8 +- .../google_compute_firewall/AC_GCP_0059.json | 8 +- .../google_compute_firewall/AC_GCP_0060.json | 8 +- .../google_compute_firewall/AC_GCP_0061.json | 8 +- .../google_compute_firewall/AC_GCP_0062.json | 8 +- .../google_compute_firewall/AC_GCP_0063.json | 8 +- .../google_compute_firewall/AC_GCP_0064.json | 8 +- .../google_compute_firewall/AC_GCP_0065.json | 8 +- .../google_compute_firewall/AC_GCP_0066.json | 8 +- .../google_compute_firewall/AC_GCP_0067.json | 8 +- .../google_compute_firewall/AC_GCP_0068.json | 8 +- .../google_compute_firewall/AC_GCP_0069.json | 8 +- .../google_compute_firewall/AC_GCP_0070.json | 8 +- .../google_compute_firewall/AC_GCP_0071.json | 8 +- .../google_compute_firewall/AC_GCP_0072.json | 8 +- .../google_compute_firewall/AC_GCP_0073.json | 8 +- .../google_compute_firewall/AC_GCP_0074.json | 8 +- .../google_compute_firewall/AC_GCP_0075.json | 8 +- .../google_compute_firewall/AC_GCP_0076.json | 8 +- .../google_compute_firewall/AC_GCP_0077.json | 8 +- .../google_compute_firewall/AC_GCP_0078.json | 8 +- .../google_compute_firewall/AC_GCP_0079.json | 8 +- .../google_compute_firewall/AC_GCP_0080.json | 8 +- .../google_compute_firewall/AC_GCP_0081.json | 8 +- .../google_compute_firewall/AC_GCP_0082.json | 8 +- .../google_compute_firewall/AC_GCP_0083.json | 8 +- .../google_compute_firewall/AC_GCP_0084.json | 8 +- .../google_compute_firewall/AC_GCP_0085.json | 8 +- .../google_compute_firewall/AC_GCP_0086.json | 8 +- .../google_compute_firewall/AC_GCP_0087.json | 8 +- .../google_compute_firewall/AC_GCP_0088.json | 8 +- .../google_compute_firewall/AC_GCP_0089.json | 8 +- .../google_compute_firewall/AC_GCP_0090.json | 8 +- .../google_compute_firewall/AC_GCP_0091.json | 8 +- .../google_compute_firewall/AC_GCP_0092.json | 8 +- .../google_compute_firewall/AC_GCP_0093.json | 8 +- .../google_compute_firewall/AC_GCP_0094.json | 8 +- .../google_compute_firewall/AC_GCP_0095.json | 8 +- .../google_compute_firewall/AC_GCP_0096.json | 8 +- .../google_compute_firewall/AC_GCP_0097.json | 8 +- .../google_compute_firewall/AC_GCP_0098.json | 8 +- .../google_compute_firewall/AC_GCP_0099.json | 8 +- .../google_compute_firewall/AC_GCP_0100.json | 8 +- .../google_compute_firewall/AC_GCP_0101.json | 8 +- .../google_compute_firewall/AC_GCP_0102.json | 8 +- .../google_compute_firewall/AC_GCP_0103.json | 8 +- .../google_compute_firewall/AC_GCP_0104.json | 8 +- .../google_compute_firewall/AC_GCP_0105.json | 8 +- .../google_compute_firewall/AC_GCP_0106.json | 8 +- .../google_compute_firewall/AC_GCP_0107.json | 8 +- .../google_compute_firewall/AC_GCP_0108.json | 8 +- .../google_compute_firewall/AC_GCP_0109.json | 8 +- .../google_compute_firewall/AC_GCP_0110.json | 8 +- .../google_compute_firewall/AC_GCP_0111.json | 8 +- .../google_compute_firewall/AC_GCP_0112.json | 8 +- .../google_compute_firewall/AC_GCP_0113.json | 8 +- .../google_compute_firewall/AC_GCP_0114.json | 8 +- .../google_compute_firewall/AC_GCP_0115.json | 8 +- .../google_compute_firewall/AC_GCP_0116.json | 8 +- .../google_compute_firewall/AC_GCP_0117.json | 8 +- .../google_compute_firewall/AC_GCP_0118.json | 8 +- .../google_compute_firewall/AC_GCP_0119.json | 8 +- .../google_compute_firewall/AC_GCP_0120.json | 8 +- .../google_compute_firewall/AC_GCP_0121.json | 8 +- .../google_compute_firewall/AC_GCP_0122.json | 8 +- .../google_compute_firewall/AC_GCP_0123.json | 8 +- .../google_compute_firewall/AC_GCP_0124.json | 8 +- .../google_compute_firewall/AC_GCP_0125.json | 8 +- .../google_compute_firewall/AC_GCP_0126.json | 8 +- .../google_compute_firewall/AC_GCP_0127.json | 8 +- .../google_compute_firewall/AC_GCP_0128.json | 8 +- .../google_compute_firewall/AC_GCP_0129.json | 8 +- .../google_compute_firewall/AC_GCP_0130.json | 8 +- .../google_compute_firewall/AC_GCP_0131.json | 8 +- .../google_compute_firewall/AC_GCP_0132.json | 8 +- .../google_compute_firewall/AC_GCP_0133.json | 8 +- .../google_compute_firewall/AC_GCP_0134.json | 8 +- .../google_compute_firewall/AC_GCP_0135.json | 8 +- .../google_compute_firewall/AC_GCP_0136.json | 8 +- .../google_compute_firewall/AC_GCP_0137.json | 8 +- .../google_compute_firewall/AC_GCP_0138.json | 8 +- .../google_compute_firewall/AC_GCP_0139.json | 8 +- .../google_compute_firewall/AC_GCP_0140.json | 8 +- .../google_compute_firewall/AC_GCP_0141.json | 8 +- .../google_compute_firewall/AC_GCP_0142.json | 8 +- .../google_compute_firewall/AC_GCP_0143.json | 8 +- .../google_compute_firewall/AC_GCP_0144.json | 8 +- .../google_compute_firewall/AC_GCP_0145.json | 8 +- .../google_compute_firewall/AC_GCP_0146.json | 8 +- .../google_compute_firewall/AC_GCP_0147.json | 8 +- .../google_compute_firewall/AC_GCP_0148.json | 8 +- .../google_compute_firewall/AC_GCP_0149.json | 8 +- .../google_compute_firewall/AC_GCP_0150.json | 8 +- .../google_compute_firewall/AC_GCP_0151.json | 8 +- .../google_compute_firewall/AC_GCP_0152.json | 8 +- .../google_compute_firewall/AC_GCP_0153.json | 8 +- .../google_compute_firewall/AC_GCP_0154.json | 8 +- .../google_compute_firewall/AC_GCP_0155.json | 8 +- .../google_compute_firewall/AC_GCP_0156.json | 8 +- .../google_compute_firewall/AC_GCP_0157.json | 8 +- .../google_compute_firewall/AC_GCP_0158.json | 8 +- .../google_compute_firewall/AC_GCP_0159.json | 8 +- .../google_compute_firewall/AC_GCP_0160.json | 8 +- .../google_compute_firewall/AC_GCP_0161.json | 8 +- .../google_compute_firewall/AC_GCP_0162.json | 8 +- .../google_compute_firewall/AC_GCP_0163.json | 8 +- .../google_compute_firewall/AC_GCP_0164.json | 8 +- .../google_compute_firewall/AC_GCP_0165.json | 8 +- .../google_compute_firewall/AC_GCP_0166.json | 8 +- .../google_compute_firewall/AC_GCP_0167.json | 8 +- .../google_compute_firewall/AC_GCP_0168.json | 8 +- .../google_compute_firewall/AC_GCP_0169.json | 8 +- .../google_compute_firewall/AC_GCP_0170.json | 8 +- .../google_compute_firewall/AC_GCP_0171.json | 8 +- .../google_compute_firewall/AC_GCP_0172.json | 8 +- .../google_compute_firewall/AC_GCP_0173.json | 8 +- .../google_compute_firewall/AC_GCP_0174.json | 8 +- .../google_compute_firewall/AC_GCP_0175.json | 8 +- .../google_compute_firewall/AC_GCP_0176.json | 8 +- .../google_compute_firewall/AC_GCP_0177.json | 8 +- .../google_compute_firewall/AC_GCP_0178.json | 8 +- .../google_compute_firewall/AC_GCP_0179.json | 8 +- .../google_compute_firewall/AC_GCP_0180.json | 8 +- .../google_compute_firewall/AC_GCP_0181.json | 8 +- .../google_compute_firewall/AC_GCP_0182.json | 8 +- .../google_compute_firewall/AC_GCP_0183.json | 8 +- .../google_compute_firewall/AC_GCP_0184.json | 8 +- .../google_compute_firewall/AC_GCP_0185.json | 8 +- .../google_compute_firewall/AC_GCP_0186.json | 8 +- .../google_compute_firewall/AC_GCP_0187.json | 8 +- .../google_compute_firewall/AC_GCP_0188.json | 8 +- .../google_compute_firewall/AC_GCP_0189.json | 8 +- .../google_compute_firewall/AC_GCP_0190.json | 8 +- .../google_compute_firewall/AC_GCP_0191.json | 8 +- .../google_compute_firewall/AC_GCP_0192.json | 8 +- .../google_compute_firewall/AC_GCP_0193.json | 8 +- .../google_compute_firewall/AC_GCP_0194.json | 8 +- .../google_compute_firewall/AC_GCP_0196.json | 8 +- .../google_compute_firewall/AC_GCP_0197.json | 8 +- .../google_compute_firewall/AC_GCP_0198.json | 8 +- .../google_compute_firewall/AC_GCP_0199.json | 8 +- .../google_compute_firewall/AC_GCP_0200.json | 8 +- .../google_compute_firewall/AC_GCP_0201.json | 8 +- .../google_compute_firewall/AC_GCP_0202.json | 8 +- .../google_compute_firewall/AC_GCP_0203.json | 8 +- .../google_compute_firewall/AC_GCP_0204.json | 8 +- .../google_compute_firewall/AC_GCP_0205.json | 8 +- .../google_compute_firewall/AC_GCP_0206.json | 8 +- .../google_compute_firewall/AC_GCP_0207.json | 8 +- .../google_compute_firewall/AC_GCP_0208.json | 8 +- .../google_compute_firewall/AC_GCP_0209.json | 8 +- .../google_compute_firewall/AC_GCP_0210.json | 8 +- .../google_compute_firewall/AC_GCP_0211.json | 8 +- .../google_compute_firewall/AC_GCP_0212.json | 8 +- .../google_compute_firewall/AC_GCP_0213.json | 8 +- .../google_compute_firewall/AC_GCP_0214.json | 8 +- .../google_compute_firewall/AC_GCP_0215.json | 8 +- .../google_compute_firewall/AC_GCP_0216.json | 8 +- .../google_compute_firewall/AC_GCP_0217.json | 8 +- .../google_compute_firewall/AC_GCP_0218.json | 8 +- .../google_compute_firewall/AC_GCP_0219.json | 8 +- .../google_compute_firewall/AC_GCP_0220.json | 8 +- .../google_compute_firewall/AC_GCP_0221.json | 8 +- .../google_compute_firewall/AC_GCP_0222.json | 8 +- .../google_compute_firewall/AC_GCP_0223.json | 8 +- .../google_compute_firewall/AC_GCP_0224.json | 8 +- .../google_compute_firewall/AC_GCP_0225.json | 8 +- .../google_compute_firewall/AC_GCP_0226.json | 8 +- .../google_compute_firewall/AC_GCP_0227.json | 8 +- .../google_compute_firewall/AC_GCP_0228.json | 8 +- .../accurics.gcp.EKM.132.json | 6 +- .../accurics.gcp.IAM.124.json | 4 +- .../accurics.gcp.IAM.128.json | 4 +- .../accurics.gcp.NS.125.json | 4 +- .../accurics.gcp.NS.126.json | 5 +- .../accurics.gcp.NS.129.json | 5 +- .../accurics.gcp.NS.130.json | 4 +- .../accurics.gcp.NS.133.json | 4 +- .../accurics.gcp.IAM.127.json | 8 +- .../accurics.gcp.EKM.134.json | 4 +- .../accurics.gcp.LOG.118.json | 4 +- .../AC-GC-IS-CC-M-0367.json | 8 +- .../accurics.gcp.IAM.104.json | 4 +- .../accurics.gcp.IAM.110.json | 4 +- .../accurics.gcp.IAM.142.json | 4 +- .../accurics.gcp.LOG.100.json | 4 +- .../accurics.gcp.MON.143.json | 4 +- .../accurics.gcp.NS.103.json | 8 +- .../accurics.gcp.NS.109.json | 4 +- .../accurics.gcp.NS.112.json | 4 +- .../accurics.gcp.NS.117.json | 8 +- .../accurics.gcp.OPS.113.json | 4 +- .../accurics.gcp.OPS.115.json | 4 +- .../accurics.gcp.OPS.116.json | 4 +- .../accurics.gcp.OPS.101.json | 4 +- .../accurics.gcp.OPS.114.json | 4 +- .../accurics.gcp.OPS.144.json | 4 +- .../accurics.gcp.EKM.108.json | 4 +- .../accurics.gcp.NS.107.json | 4 +- .../accurics.gcp.EKM.007.json | 4 +- .../accurics.gcp.EKM.139.json | 4 +- .../google_project/accurics.gcp.NS.119.json | 4 +- .../accurics.gcp.LOG.010.json | 4 +- .../accurics.gcp.IAM.136.json | 4 +- .../accurics.gcp.IAM.150.json | 4 +- .../accurics.gcp.IAM.137.json | 4 +- .../accurics.gcp.IAM.138.json | 4 +- .../accurics.gcp.BDR.105.json | 4 +- .../accurics.gcp.EKM.141.json | 4 +- .../accurics.gcp.NS.102.json | 8 +- .../accurics.gcp.IAM.122.json | 4 +- .../accurics.gcp.LOG.146.json | 4 +- .../accurics.gcp.LOG.147.json | 4 +- .../accurics.gcp.IAM.121.json | 4 +- .../accurics.gcp.IAM.120.json | 4 +- .../accurics.github.EKM.1.json | 8 +- .../accurics.github.IAM.1.json | 8 +- .../accurics.github.EKM2.json | 8 +- .../AC_K8S_0113.json | 8 +- .../AC-K8-NS-IN-H-0020.json | 4 +- .../AC-K8-OE-NS-L-0128.json | 7 +- .../kubernetes_pod/AC-K8-CA-PO-H-0165.json | 9 +- .../kubernetes_pod/AC-K8-DS-PO-M-0143.json | 9 +- .../kubernetes_pod/AC-K8-DS-PO-M-0176.json | 9 +- .../kubernetes_pod/AC-K8-DS-PO-M-0177.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-H-0106.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-H-0137.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-H-0138.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-H-0168.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-M-0105.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-M-0135.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-M-0139.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-M-0140.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-M-0141.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-M-0143.json | 9 +- .../kubernetes_pod/AC-K8-IA-PO-M-0162.json | 9 +- .../kubernetes_pod/AC-K8-IA-PS-M-0112.json | 9 +- .../kubernetes_pod/AC-K8-NS-PO-H-0117.json | 9 +- .../kubernetes_pod/AC-K8-NS-PO-H-0170.json | 9 +- .../kubernetes_pod/AC-K8-NS-PO-M-0122.json | 9 +- .../kubernetes_pod/AC-K8-NS-PO-M-0133.json | 9 +- .../kubernetes_pod/AC-K8-NS-PO-M-0163.json | 9 +- .../kubernetes_pod/AC-K8-NS-PO-M-0164.json | 9 +- .../kubernetes_pod/AC-K8-NS-PO-M-0171.json | 9 +- .../kubernetes_pod/AC-K8-NS-PO-M-0182.json | 9 +- .../kubernetes_pod/AC-K8-OE-PK-M-0034.json | 9 +- .../kubernetes_pod/AC-K8-OE-PK-M-0155.json | 9 +- .../kubernetes_pod/AC-K8-OE-PK-M-0156.json | 9 +- .../kubernetes_pod/AC-K8-OE-PK-M-0157.json | 9 +- .../kubernetes_pod/AC-K8-OE-PK-M-0158.json | 9 +- .../kubernetes_pod/AC-K8-OE-PO-L-0129.json | 9 +- .../kubernetes_pod/AC-K8-OE-PO-L-0130.json | 9 +- .../kubernetes_pod/AC-K8-OE-PO-L-0134.json | 9 +- .../kubernetes_pod/AC-K8-OE-PO-M-0166.json | 9 +- .../kubernetes_role/AC-K8-IA-RO-H-0104.json | 6 +- .../AC-K8-NS-SE-M-0185.json | 4 +- .../AC-K8-NS-SE-M-0188.json | 4 +- .../AC-K8-NS-SV-L-0132.json | 4 +- .../k8s/kubernetes_service/AC_K8S_0114.json | 4 +- .../cve_2020_8554/AC-K8-NS-SE-M-0188.json | 4 +- .../cve_2020_8554/ensurePrivateIP.rego | 2 +- pkg/policies/opa/rego/policy_test.go | 2 +- pkg/policy/types.go | 2 +- test/e2e/scan/scan_docker_file_test.go | 2 +- test/e2e/scan/scan_k8s_files_test.go | 2 +- test/e2e/scan/scan_remote_test.go | 4 +- test/e2e/scan/scan_test.go | 2 +- test/e2e/scan/scan_tf_files_test.go | 6 +- .../docker/docker_from/AC_DOCKER_0001.json | 12 +- 782 files changed, 5908 insertions(+), 7905 deletions(-) diff --git a/pkg/filters/filter-specs.go b/pkg/filters/filter-specs.go index f4b0bcc74..019d11aef 100644 --- a/pkg/filters/filter-specs.go +++ b/pkg/filters/filter-specs.go @@ -17,6 +17,8 @@ package filters import ( + "strings" + "github.com/accurics/terrascan/pkg/policy" "github.com/accurics/terrascan/pkg/utils" "go.uber.org/zap" @@ -49,7 +51,14 @@ func (rs ResourceTypeFilterSpecification) IsSatisfied(r *policy.RegoMetadata) bo return true } - return r.ResourceType[rs.resourceType] + // temporary fix for kubernetes policies (https://github.com/accurics/terrascan/issues/946) + // TODO: modification in policy metadata (resource type (string) => resource type (map", - "name": "port22OpenToInternet", - "portNumber": 22, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - (SSH,22)", - "reference_id": "AC_AWS_0227", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0227" + "name": "port22OpenToInternet", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port22OpenToInternet", + "portNumber": 22, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - (SSH,22)", + "reference_id": "AC_AWS_0227", + "id": "AC_AWS_0227", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0228.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0228.json index b8795d09e..9e0cacc69 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0228.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0228.json @@ -1,23 +1,20 @@ { - "name": "port80OpenToInternet", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port80OpenToInternet", - "portNumber": 80, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - (HTTP,80)", - "reference_id": "AC_AWS_0228", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0228" + "name": "port80OpenToInternet", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port80OpenToInternet", + "portNumber": 80, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - (HTTP,80)", + "reference_id": "AC_AWS_0228", + "id": "AC_AWS_0228", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0229.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0229.json index c48bfd6b7..906bb8efd 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0229.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0229.json @@ -1,23 +1,20 @@ { - "name": "port443OpenToInternet", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port443OpenToInternet", - "portNumber": 443, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Security Groups - Unrestricted Specific Ports - (HTTPS,443)", - "reference_id": "AC_AWS_0229", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0229" + "name": "port443OpenToInternet", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port443OpenToInternet", + "portNumber": 443, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Security Groups - Unrestricted Specific Ports - (HTTPS,443)", + "reference_id": "AC_AWS_0229", + "id": "AC_AWS_0229", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0230.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0230.json index 1b12b844d..f7009ea47 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0230.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0230.json @@ -1,23 +1,20 @@ { - "name": "port3389OpenToInternet", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port3389OpenToInternet", - "portNumber": 3389, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - remote desktop port (TCP,3389)", - "reference_id": "AC_AWS_0230", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0230" + "name": "port3389OpenToInternet", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port3389OpenToInternet", + "portNumber": 3389, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - remote desktop port (TCP,3389)", + "reference_id": "AC_AWS_0230", + "id": "AC_AWS_0230", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0231.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0231.json index 12c7040ca..bbffa0e75 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0231.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0231.json @@ -1,21 +1,18 @@ { - "name": "unrestrictedIngressAccess", - "file": "unrestrictedIngressAccess.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "unrestrictedIngressAccess", - "prefix": "", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure no security groups allow ingress from 0.0.0.0/0 to ALL ports and protocols", - "reference_id": "AC_AWS_0231", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0231" + "name": "unrestrictedIngressAccess", + "file": "unrestrictedIngressAccess.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "unrestrictedIngressAccess", + "prefix": "", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure no security groups allow ingress from 0.0.0.0/0 to ALL ports and protocols", + "reference_id": "AC_AWS_0231", + "id": "AC_AWS_0231", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0232.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0232.json index 8ff7dd051..3e7f628cc 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0232.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0232.json @@ -1,20 +1,17 @@ { - "name": "defaultSGNotRestrictsAllTraffic", - "file": "defaultSGNotRestrictsAllTraffic.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "name": "defaultSGNotRestrictsAllTraffic", - "prefix": "", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure no default security groups are used as they allow ingress from 0.0.0.0/0 to ALL ports and protocols", - "reference_id": "AC_AWS_0232", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0232" + "name": "defaultSGNotRestrictsAllTraffic", + "file": "defaultSGNotRestrictsAllTraffic.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "name": "defaultSGNotRestrictsAllTraffic", + "prefix": "", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure no default security groups are used as they allow ingress from 0.0.0.0/0 to ALL ports and protocols", + "reference_id": "AC_AWS_0232", + "id": "AC_AWS_0232", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0233.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0233.json index 4037995af..38bf86bec 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0233.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0233.json @@ -1,23 +1,20 @@ { - "name": "port4505AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port4505AlbNetworkPortSecurity", - "portNumber": 4505, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - SaltStack Master (TCP,4505)", - "reference_id": "AC_AWS_0233", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0233" + "name": "port4505AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port4505AlbNetworkPortSecurity", + "portNumber": 4505, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - SaltStack Master (TCP,4505)", + "reference_id": "AC_AWS_0233", + "id": "AC_AWS_0233", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0234.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0234.json index c206c3a43..57847ec3f 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0234.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0234.json @@ -1,23 +1,20 @@ { - "name": "port9200AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port9200AlbNetworkPortSecurity", - "portNumber": 9200, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Elasticsearch (TCP,9200)", - "reference_id": "AC_AWS_0234", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0234" + "name": "port9200AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port9200AlbNetworkPortSecurity", + "portNumber": 9200, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Elasticsearch (TCP,9200)", + "reference_id": "AC_AWS_0234", + "id": "AC_AWS_0234", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0235.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0235.json index beb804f5e..dfdbe7bc2 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0235.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0235.json @@ -1,23 +1,20 @@ { - "name": "port9300AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port9300AlbNetworkPortSecurity", - "portNumber": 9300, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Elasticsearch (TCP,9300)", - "reference_id": "AC_AWS_0235", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0235" + "name": "port9300AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port9300AlbNetworkPortSecurity", + "portNumber": 9300, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Elasticsearch (TCP,9300)", + "reference_id": "AC_AWS_0235", + "id": "AC_AWS_0235", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0236.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0236.json index a8f48d705..409b71b51 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0236.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0236.json @@ -1,23 +1,20 @@ { - "name": "port4506AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port4506AlbNetworkPortSecurity", - "portNumber": 4506, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - SaltStack Master (TCP,4506)", - "reference_id": "AC_AWS_0236", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0236" + "name": "port4506AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port4506AlbNetworkPortSecurity", + "portNumber": 4506, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - SaltStack Master (TCP,4506)", + "reference_id": "AC_AWS_0236", + "id": "AC_AWS_0236", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0237.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0237.json index 9e53db7b9..089bc8369 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0237.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0237.json @@ -1,23 +1,20 @@ { - "name": "port3020AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port3020AlbNetworkPortSecurity", - "portNumber": 3020, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - CIFS / SMB (TCP,3020)", - "reference_id": "AC_AWS_0237", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0237" + "name": "port3020AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port3020AlbNetworkPortSecurity", + "portNumber": 3020, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - CIFS / SMB (TCP,3020)", + "reference_id": "AC_AWS_0237", + "id": "AC_AWS_0237", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0238.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0238.json index e636ab215..faf15eccf 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0238.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0238.json @@ -1,23 +1,20 @@ { - "name": "port61621AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port61621AlbNetworkPortSecurity", - "portNumber": 61621, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Cassandra OpsCenter agent (TCP,61621)", - "reference_id": "AC_AWS_0238", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0238" + "name": "port61621AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port61621AlbNetworkPortSecurity", + "portNumber": 61621, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Cassandra OpsCenter agent (TCP,61621)", + "reference_id": "AC_AWS_0238", + "id": "AC_AWS_0238", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0239.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0239.json index 8334c2253..c4341fca3 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0239.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0239.json @@ -1,23 +1,20 @@ { - "name": "port7001AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port7001AlbNetworkPortSecurity", - "portNumber": 7001, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Cassandra (TCP,7001)", - "reference_id": "AC_AWS_0239", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0239" + "name": "port7001AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port7001AlbNetworkPortSecurity", + "portNumber": 7001, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Cassandra (TCP,7001)", + "reference_id": "AC_AWS_0239", + "id": "AC_AWS_0239", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0240.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0240.json index de1af0cc2..09abb54e3 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0240.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0240.json @@ -1,23 +1,20 @@ { - "name": "port9000AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port9000AlbNetworkPortSecurity", - "portNumber": 9000, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Hadoop Name Node (TCP,9000)", - "reference_id": "AC_AWS_0240", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0240" + "name": "port9000AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port9000AlbNetworkPortSecurity", + "portNumber": 9000, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Hadoop Name Node (TCP,9000)", + "reference_id": "AC_AWS_0240", + "id": "AC_AWS_0240", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0241.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0241.json index 0ad6e2114..286d01f8c 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0241.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0241.json @@ -1,23 +1,20 @@ { - "name": "port8000AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port8000AlbNetworkPortSecurity", - "portNumber": 8000, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Known internal web port (TCP,8000)", - "reference_id": "AC_AWS_0241", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0241" + "name": "port8000AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port8000AlbNetworkPortSecurity", + "portNumber": 8000, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Known internal web port (TCP,8000)", + "reference_id": "AC_AWS_0241", + "id": "AC_AWS_0241", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0242.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0242.json index e0394a1ee..dfa642c2f 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0242.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0242.json @@ -1,23 +1,20 @@ { - "name": "port8080AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port8080AlbNetworkPortSecurity", - "portNumber": 8080, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Known internal web port (TCP,8080)", - "reference_id": "AC_AWS_0242", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0242" + "name": "port8080AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port8080AlbNetworkPortSecurity", + "portNumber": 8080, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Known internal web port (TCP,8080)", + "reference_id": "AC_AWS_0242", + "id": "AC_AWS_0242", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0243.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0243.json index 6965a3862..0dcd75787 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0243.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0243.json @@ -1,23 +1,20 @@ { - "name": "port636AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port636AlbNetworkPortSecurity", - "portNumber": 636, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - LDAP SSL (TCP,636)", - "reference_id": "AC_AWS_0243", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0243" + "name": "port636AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port636AlbNetworkPortSecurity", + "portNumber": 636, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - LDAP SSL (TCP,636)", + "reference_id": "AC_AWS_0243", + "id": "AC_AWS_0243", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0244.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0244.json index b1d6d1511..c431cecc4 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0244.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0244.json @@ -1,23 +1,20 @@ { - "name": "port1434AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port1434AlbNetworkPortSecurity", - "portNumber": 1434, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - MSSQL Admin (TCP,1434)", - "reference_id": "AC_AWS_0244", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0244" + "name": "port1434AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port1434AlbNetworkPortSecurity", + "portNumber": 1434, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - MSSQL Admin (TCP,1434)", + "reference_id": "AC_AWS_0244", + "id": "AC_AWS_0244", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0245.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0245.json index 542498099..9a9fccd38 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0245.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0245.json @@ -1,23 +1,20 @@ { - "name": "port1434UdpAlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port1434UdpAlbNetworkPortSecurity", - "portNumber": 1434, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - MSSQL Browser Service (UDP,1434)", - "reference_id": "AC_AWS_0245", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0245" + "name": "port1434UdpAlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port1434UdpAlbNetworkPortSecurity", + "portNumber": 1434, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - MSSQL Browser Service (UDP,1434)", + "reference_id": "AC_AWS_0245", + "id": "AC_AWS_0245", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0246.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0246.json index 69aaa8bc8..057e4cb81 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0246.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0246.json @@ -1,23 +1,20 @@ { - "name": "port135AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port135AlbNetworkPortSecurity", - "portNumber": 135, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - MSSQL Debugger (TCP,135)", - "reference_id": "AC_AWS_0246", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0246" + "name": "port135AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port135AlbNetworkPortSecurity", + "portNumber": 135, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - MSSQL Debugger (TCP,135)", + "reference_id": "AC_AWS_0246", + "id": "AC_AWS_0246", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0247.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0247.json index 1aea890c5..ce7d2365b 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0247.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0247.json @@ -1,23 +1,20 @@ { - "name": "port1433AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port1433AlbNetworkPortSecurity", - "portNumber": 1433, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - MSSQL Server (TCP,1433)", - "reference_id": "AC_AWS_0247", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0247" + "name": "port1433AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port1433AlbNetworkPortSecurity", + "portNumber": 1433, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - MSSQL Server (TCP,1433)", + "reference_id": "AC_AWS_0247", + "id": "AC_AWS_0247", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0248.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0248.json index 9623aeed8..ffb94886f 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0248.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0248.json @@ -1,23 +1,20 @@ { - "name": "port11214AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port11214AlbNetworkPortSecurity", - "portNumber": 11214, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Memcached SSL (TCP,11214)", - "reference_id": "AC_AWS_0248", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0248" + "name": "port11214AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port11214AlbNetworkPortSecurity", + "portNumber": 11214, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Memcached SSL (TCP,11214)", + "reference_id": "AC_AWS_0248", + "id": "AC_AWS_0248", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0249.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0249.json index 4614ef93a..bc95a74b0 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0249.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0249.json @@ -1,23 +1,20 @@ { - "name": "port11215AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port11215AlbNetworkPortSecurity", - "portNumber": 11215, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Memcached SSL (TCP,11215)", - "reference_id": "AC_AWS_0249", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0249" + "name": "port11215AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port11215AlbNetworkPortSecurity", + "portNumber": 11215, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Memcached SSL (TCP,11215)", + "reference_id": "AC_AWS_0249", + "id": "AC_AWS_0249", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0250.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0250.json index 9c7654935..aa6c6c12a 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0250.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0250.json @@ -1,23 +1,20 @@ { - "name": "port11214UdpAlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port11214UdpAlbNetworkPortSecurity", - "portNumber": 11214, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Memcached SSL (UDP,11214)", - "reference_id": "AC_AWS_0250", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0250" + "name": "port11214UdpAlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port11214UdpAlbNetworkPortSecurity", + "portNumber": 11214, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Memcached SSL (UDP,11214)", + "reference_id": "AC_AWS_0250", + "id": "AC_AWS_0250", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0251.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0251.json index cbb6b48e8..fb2b716b7 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0251.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0251.json @@ -1,23 +1,20 @@ { - "name": "port11215UdpAlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port11215UdpAlbNetworkPortSecurity", - "portNumber": 11215, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Memcached SSL (UDP,11215)", - "reference_id": "AC_AWS_0251", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0251" + "name": "port11215UdpAlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port11215UdpAlbNetworkPortSecurity", + "portNumber": 11215, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Memcached SSL (UDP,11215)", + "reference_id": "AC_AWS_0251", + "id": "AC_AWS_0251", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0252.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0252.json index e0f4c1a28..1ca722981 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0252.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0252.json @@ -1,23 +1,20 @@ { - "name": "port27018AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port27018AlbNetworkPortSecurity", - "portNumber": 27018, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Mongo Web Portal (TCP,27018)", - "reference_id": "AC_AWS_0252", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0252" + "name": "port27018AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port27018AlbNetworkPortSecurity", + "portNumber": 27018, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Mongo Web Portal (TCP,27018)", + "reference_id": "AC_AWS_0252", + "id": "AC_AWS_0252", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0253.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0253.json index 7de09cf56..3b77e7359 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0253.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0253.json @@ -1,23 +1,20 @@ { - "name": "port3306AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port3306AlbNetworkPortSecurity", - "portNumber": 3306, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - MySQL (TCP,3306)", - "reference_id": "AC_AWS_0253", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0253" + "name": "port3306AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port3306AlbNetworkPortSecurity", + "portNumber": 3306, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - MySQL (TCP,3306)", + "reference_id": "AC_AWS_0253", + "id": "AC_AWS_0253", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0254.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0254.json index 708472d69..769736bf3 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0254.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0254.json @@ -1,23 +1,20 @@ { - "name": "port137AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port137AlbNetworkPortSecurity", - "portNumber": 137, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Name Service (TCP,137)", - "reference_id": "AC_AWS_0254", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0254" + "name": "port137AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port137AlbNetworkPortSecurity", + "portNumber": 137, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Name Service (TCP,137)", + "reference_id": "AC_AWS_0254", + "id": "AC_AWS_0254", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0255.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0255.json index a97f85a07..6e5b15ec7 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0255.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0255.json @@ -1,23 +1,20 @@ { - "name": "port137UdpAlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port137UdpAlbNetworkPortSecurity", - "portNumber": 137, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Name Service (UDP,137)", - "reference_id": "AC_AWS_0255", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0255" + "name": "port137UdpAlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port137UdpAlbNetworkPortSecurity", + "portNumber": 137, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Name Service (UDP,137)", + "reference_id": "AC_AWS_0255", + "id": "AC_AWS_0255", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0256.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0256.json index 69d78b657..f726703bb 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0256.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0256.json @@ -1,23 +1,20 @@ { - "name": "port138AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port138AlbNetworkPortSecurity", - "portNumber": 138, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Datagram Service (TCP,138)", - "reference_id": "AC_AWS_0256", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0256" + "name": "port138AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port138AlbNetworkPortSecurity", + "portNumber": 138, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Datagram Service (TCP,138)", + "reference_id": "AC_AWS_0256", + "id": "AC_AWS_0256", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0257.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0257.json index 61f078f6c..b0d7857a2 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0257.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0257.json @@ -1,23 +1,20 @@ { - "name": "port138UdpAlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port138UdpAlbNetworkPortSecurity", - "portNumber": 138, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Datagram Service (UDP,138)", - "reference_id": "AC_AWS_0257", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0257" + "name": "port138UdpAlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port138UdpAlbNetworkPortSecurity", + "portNumber": 138, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Datagram Service (UDP,138)", + "reference_id": "AC_AWS_0257", + "id": "AC_AWS_0257", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0258.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0258.json index 68259eb6a..8d8874aa3 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0258.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0258.json @@ -1,23 +1,20 @@ { - "name": "port139AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port139AlbNetworkPortSecurity", - "portNumber": 139, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Session Service (TCP,139)", - "reference_id": "AC_AWS_0258", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0258" + "name": "port139AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port139AlbNetworkPortSecurity", + "portNumber": 139, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Session Service (TCP,139)", + "reference_id": "AC_AWS_0258", + "id": "AC_AWS_0258", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0259.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0259.json index c6debcffb..462a134f0 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0259.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0259.json @@ -1,23 +1,20 @@ { - "name": "port139UdpAlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port139UdpAlbNetworkPortSecurity", - "portNumber": 139, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Session Service (UDP,139)", - "reference_id": "AC_AWS_0259", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0259" + "name": "port139UdpAlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port139UdpAlbNetworkPortSecurity", + "portNumber": 139, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - NetBIOS Session Service (UDP,139)", + "reference_id": "AC_AWS_0259", + "id": "AC_AWS_0259", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0260.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0260.json index 61b0b563d..19db0fb92 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0260.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0260.json @@ -1,23 +1,20 @@ { - "name": "port2484AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port2484AlbNetworkPortSecurity", - "portNumber": 2484, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Oracle DB SSL (TCP,2484)", - "reference_id": "AC_AWS_0260", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0260" + "name": "port2484AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port2484AlbNetworkPortSecurity", + "portNumber": 2484, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Oracle DB SSL (TCP,2484)", + "reference_id": "AC_AWS_0260", + "id": "AC_AWS_0260", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0261.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0261.json index 10bfbac55..ba908b5fc 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0261.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0261.json @@ -1,23 +1,20 @@ { - "name": "port2484UdpAlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port2484UdpAlbNetworkPortSecurity", - "portNumber": 2484, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Oracle DB SSL (UDP,2484)", - "reference_id": "AC_AWS_0261", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0261" + "name": "port2484UdpAlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port2484UdpAlbNetworkPortSecurity", + "portNumber": 2484, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Oracle DB SSL (UDP,2484)", + "reference_id": "AC_AWS_0261", + "id": "AC_AWS_0261", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0262.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0262.json index f4d207960..716783c77 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0262.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0262.json @@ -1,23 +1,20 @@ { - "name": "port5432AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port5432AlbNetworkPortSecurity", - "portNumber": 5432, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Postgres SQL (TCP,5432)", - "reference_id": "AC_AWS_0262", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0262" + "name": "port5432AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port5432AlbNetworkPortSecurity", + "portNumber": 5432, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Postgres SQL (TCP,5432)", + "reference_id": "AC_AWS_0262", + "id": "AC_AWS_0262", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0263.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0263.json index 592348d57..3eacdcd27 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0263.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0263.json @@ -1,23 +1,20 @@ { - "name": "port5432UdpAlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port5432UdpAlbNetworkPortSecurity", - "portNumber": 5432, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Postgres SQL (UDP,5432)", - "reference_id": "AC_AWS_0263", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0263" + "name": "port5432UdpAlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port5432UdpAlbNetworkPortSecurity", + "portNumber": 5432, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Postgres SQL (UDP,5432)", + "reference_id": "AC_AWS_0263", + "id": "AC_AWS_0263", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0264.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0264.json index 54acb4751..09af243c3 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0264.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0264.json @@ -1,23 +1,20 @@ { - "name": "port3000AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port3000AlbNetworkPortSecurity", - "portNumber": 3000, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Prevalent known internal port (TCP,3000)", - "reference_id": "AC_AWS_0264", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0264" + "name": "port3000AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port3000AlbNetworkPortSecurity", + "portNumber": 3000, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Prevalent known internal port (TCP,3000)", + "reference_id": "AC_AWS_0264", + "id": "AC_AWS_0264", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0265.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0265.json index 8f4034cd5..2f1be6d7b 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0265.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0265.json @@ -1,23 +1,20 @@ { - "name": "port8140AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port8140AlbNetworkPortSecurity", - "portNumber": 8140, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Puppet Master (TCP,8140)", - "reference_id": "AC_AWS_0265", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0265" + "name": "port8140AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port8140AlbNetworkPortSecurity", + "portNumber": 8140, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Puppet Master (TCP,8140)", + "reference_id": "AC_AWS_0265", + "id": "AC_AWS_0265", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0266.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0266.json index 9b138be31..8ed6291b9 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0266.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0266.json @@ -1,23 +1,20 @@ { - "name": "port161UdpAlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port161UdpAlbNetworkPortSecurity", - "portNumber": 161, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - SNMP (UDP,161)", - "reference_id": "AC_AWS_0266", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0266" + "name": "port161UdpAlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port161UdpAlbNetworkPortSecurity", + "portNumber": 161, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - SNMP (UDP,161)", + "reference_id": "AC_AWS_0266", + "id": "AC_AWS_0266", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0267.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0267.json index 2020c4369..cc799c8bc 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0267.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0267.json @@ -1,23 +1,20 @@ { - "name": "port2382AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port2382AlbNetworkPortSecurity", - "portNumber": 2382, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - SQL Server Analysis Service browser (TCP,2382)", - "reference_id": "AC_AWS_0267", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0267" + "name": "port2382AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port2382AlbNetworkPortSecurity", + "portNumber": 2382, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - SQL Server Analysis Service browser (TCP,2382)", + "reference_id": "AC_AWS_0267", + "id": "AC_AWS_0267", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0268.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0268.json index e9d3e941e..d14541fa8 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0268.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0268.json @@ -1,23 +1,20 @@ { - "name": "port2383AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port2383AlbNetworkPortSecurity", - "portNumber": 2383, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - SQL Server Analysis Services (TCP,2383)", - "reference_id": "AC_AWS_0268", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0268" + "name": "port2383AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port2383AlbNetworkPortSecurity", + "portNumber": 2383, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - SQL Server Analysis Services (TCP,2383)", + "reference_id": "AC_AWS_0268", + "id": "AC_AWS_0268", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0269.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0269.json index 1f8e2ec0f..536761abc 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0269.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0269.json @@ -1,23 +1,20 @@ { - "name": "port4505AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port4505AlbNetworkPortSecurity", - "portNumber": 4505, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - SaltStack Master (TCP,4505)", - "reference_id": "AC_AWS_0269", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0269" + "name": "port4505AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port4505AlbNetworkPortSecurity", + "portNumber": 4505, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - SaltStack Master (TCP,4505)", + "reference_id": "AC_AWS_0269", + "id": "AC_AWS_0269", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0270.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0270.json index b95ddad1c..23f081b3d 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0270.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0270.json @@ -1,23 +1,20 @@ { - "name": "port1521AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port1521AlbNetworkPortSecurity", - "portNumber": 1521, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Oracle Database Server (TCP,1521)", - "reference_id": "AC_AWS_0270", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0270" + "name": "port1521AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port1521AlbNetworkPortSecurity", + "portNumber": 1521, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Oracle Database Server (TCP,1521)", + "reference_id": "AC_AWS_0270", + "id": "AC_AWS_0270", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0271.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0271.json index ca802ee49..01e8a93f8 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0271.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0271.json @@ -1,23 +1,20 @@ { - "name": "port23AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port23AlbNetworkPortSecurity", - "portNumber": 23, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - Telnet (TCP,23)", - "reference_id": "AC_AWS_0271", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0271" + "name": "port23AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port23AlbNetworkPortSecurity", + "portNumber": 23, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - Telnet (TCP,23)", + "reference_id": "AC_AWS_0271", + "id": "AC_AWS_0271", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0272.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0272.json index f47a90b11..96622e45c 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0272.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0272.json @@ -1,23 +1,20 @@ { - "name": "port25AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port25AlbNetworkPortSecurity", - "portNumber": 25, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - SMTP (TCP,25)", - "reference_id": "AC_AWS_0272", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0272" + "name": "port25AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port25AlbNetworkPortSecurity", + "portNumber": 25, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - SMTP (TCP,25)", + "reference_id": "AC_AWS_0272", + "id": "AC_AWS_0272", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0273.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0273.json index dfc248273..7125f3ea6 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0273.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0273.json @@ -1,23 +1,20 @@ { - "name": "port445AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port445AlbNetworkPortSecurity", - "portNumber": 445, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - CIFS for file/printer (TCP,445)", - "reference_id": "AC_AWS_0273", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0273" + "name": "port445AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port445AlbNetworkPortSecurity", + "portNumber": 445, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - CIFS for file/printer (TCP,445)", + "reference_id": "AC_AWS_0273", + "id": "AC_AWS_0273", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0274.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0274.json index 4b9f62d0e..771a6b27b 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0274.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0274.json @@ -1,23 +1,20 @@ { - "name": "port27017AlbNetworkPortSecurity", - "file": "portOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port27017AlbNetworkPortSecurity", - "portNumber": 27017, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Security Groups - Unrestricted Specific Ports - MongoDB (TCP,27017)", - "reference_id": "AC_AWS_0274", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0274" + "name": "port27017AlbNetworkPortSecurity", + "file": "portOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port27017AlbNetworkPortSecurity", + "portNumber": 27017, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Security Groups - Unrestricted Specific Ports - MongoDB (TCP,27017)", + "reference_id": "AC_AWS_0274", + "id": "AC_AWS_0274", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0275.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0275.json index 1fbfb8e5b..541eef341 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0275.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0275.json @@ -1,20 +1,17 @@ { - "name": "portWideOpenToPublic", - "file": "portWideOpenToPublic.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "name": "portWideOpenToPublic", - "prefix": "", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure no security groups is wide open to public, that is, allows traffic from 0.0.0.0/0 to ALL ports and protocols", - "reference_id": "AC_AWS_0275", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0275" + "name": "portWideOpenToPublic", + "file": "portWideOpenToPublic.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "name": "portWideOpenToPublic", + "prefix": "", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure no security groups is wide open to public, that is, allows traffic from 0.0.0.0/0 to ALL ports and protocols", + "reference_id": "AC_AWS_0275", + "id": "AC_AWS_0275", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0276.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0276.json index f5a85756c..6ae6b13a4 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0276.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0276.json @@ -1,60 +1,57 @@ { - "name": "unknownPortOpenToInternet", - "file": "unknownPortOpenToInternet.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "known_ports": [ - "0", - "22", - "23", - "25", - "80", - "443", - "445", - "3389", - "4505", - "4506", - "3020", - "61621", - "7001", - "9000", - "8000", - "8080", - "636", - "1434", - "135", - "1433", - "11214", - "11215", - "27017", - "27018", - "3306", - "137", - "138", - "139", - "2484", - "5432", - "3000", - "8140", - "161", - "2382", - "2383", - "9300", - "9200" - ], - "name": "unknownPortOpenToInternet", - "prefix": "", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Unknown Port is not exposed to the entire internet", - "reference_id": "AC_AWS_0276", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0276" + "name": "unknownPortOpenToInternet", + "file": "unknownPortOpenToInternet.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "known_ports": [ + "0", + "22", + "23", + "25", + "80", + "443", + "445", + "3389", + "4505", + "4506", + "3020", + "61621", + "7001", + "9000", + "8000", + "8080", + "636", + "1434", + "135", + "1433", + "11214", + "11215", + "27017", + "27018", + "3306", + "137", + "138", + "139", + "2484", + "5432", + "3000", + "8140", + "161", + "2382", + "2383", + "9300", + "9200" + ], + "name": "unknownPortOpenToInternet", + "prefix": "", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Unknown Port is not exposed to the entire internet", + "reference_id": "AC_AWS_0276", + "id": "AC_AWS_0276", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0277.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0277.json index 033b8914a..1e23c3c01 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0277.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0277.json @@ -1,23 +1,20 @@ { - "name": "port4505AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port4505AlbNetworkPortSecurityPublicScope", - "portNumber": 4505, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SaltStack Master (TCP,4505) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0277", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0277" + "name": "port4505AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port4505AlbNetworkPortSecurityPublicScope", + "portNumber": 4505, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SaltStack Master (TCP,4505) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0277", + "id": "AC_AWS_0277", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0278.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0278.json index 31e09e93e..75bb9d2a9 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0278.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0278.json @@ -1,23 +1,20 @@ { - "name": "port4506AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port4506AlbNetworkPortSecurityPublicScope", - "portNumber": 4506, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SaltStack Master (TCP,4506) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0278", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0278" + "name": "port4506AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port4506AlbNetworkPortSecurityPublicScope", + "portNumber": 4506, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SaltStack Master (TCP,4506) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0278", + "id": "AC_AWS_0278", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0279.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0279.json index 4f3ae3e43..03beebdd3 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0279.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0279.json @@ -1,23 +1,20 @@ { - "name": "port3020AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port3020AlbNetworkPortSecurityPublicScope", - "portNumber": 3020, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure CIFS / SMB (TCP,3020) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0279", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0279" + "name": "port3020AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port3020AlbNetworkPortSecurityPublicScope", + "portNumber": 3020, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure CIFS / SMB (TCP,3020) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0279", + "id": "AC_AWS_0279", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0280.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0280.json index aa9d44cda..2cf8d79c0 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0280.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0280.json @@ -1,23 +1,20 @@ { - "name": "port61621AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port61621AlbNetworkPortSecurityPublicScope", - "portNumber": 61621, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Cassandra OpsCenter agent port (TCP,61621) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0280", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0280" + "name": "port61621AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port61621AlbNetworkPortSecurityPublicScope", + "portNumber": 61621, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Cassandra OpsCenter agent port (TCP,61621) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0280", + "id": "AC_AWS_0280", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0281.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0281.json index 81116e051..a36faedc1 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0281.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0281.json @@ -1,23 +1,20 @@ { - "name": "port7001AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port7001AlbNetworkPortSecurityPublicScope", - "portNumber": 7001, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Cassandra (TCP,7001) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0281", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0281" + "name": "port7001AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port7001AlbNetworkPortSecurityPublicScope", + "portNumber": 7001, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Cassandra (TCP,7001) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0281", + "id": "AC_AWS_0281", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0282.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0282.json index 54676c1c4..cd433f0b0 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0282.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0282.json @@ -1,23 +1,20 @@ { - "name": "port9000AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port9000AlbNetworkPortSecurityPublicScope", - "portNumber": 9000, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Hadoop Name Node (TCP,9000) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0282", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0282" + "name": "port9000AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port9000AlbNetworkPortSecurityPublicScope", + "portNumber": 9000, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Hadoop Name Node (TCP,9000) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0282", + "id": "AC_AWS_0282", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0283.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0283.json index 7c6f9e398..4fd307104 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0283.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0283.json @@ -1,23 +1,20 @@ { - "name": "port8000AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port8000AlbNetworkPortSecurityPublicScope", - "portNumber": 8000, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Known internal web port (TCP,8000) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0283", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0283" + "name": "port8000AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port8000AlbNetworkPortSecurityPublicScope", + "portNumber": 8000, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Known internal web port (TCP,8000) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0283", + "id": "AC_AWS_0283", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0284.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0284.json index 1763a5cf7..bd79de749 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0284.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0284.json @@ -1,23 +1,20 @@ { - "name": "port8080AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port8080AlbNetworkPortSecurityPublicScope", - "portNumber": 8080, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Known internal web port (TCP,8080) is not accessible by a CIDR block range", - "reference_id": "AC_AWS_0284", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0284" + "name": "port8080AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port8080AlbNetworkPortSecurityPublicScope", + "portNumber": 8080, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Known internal web port (TCP,8080) is not accessible by a CIDR block range", + "reference_id": "AC_AWS_0284", + "id": "AC_AWS_0284", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0285.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0285.json index d5ad100b3..154be0539 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0285.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0285.json @@ -1,23 +1,20 @@ { - "name": "port636AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port636AlbNetworkPortSecurityPublicScope", - "portNumber": 636, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure LDAP SSL (TCP,636) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0285", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0285" + "name": "port636AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port636AlbNetworkPortSecurityPublicScope", + "portNumber": 636, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure LDAP SSL (TCP,636) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0285", + "id": "AC_AWS_0285", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0286.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0286.json index 3c4a3dfb8..bbf5d4524 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0286.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0286.json @@ -1,23 +1,20 @@ { - "name": "port1434AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port1434AlbNetworkPortSecurityPublicScope", - "portNumber": 1434, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure MSSQL Admin (TCP,1434) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0286", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0286" + "name": "port1434AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port1434AlbNetworkPortSecurityPublicScope", + "portNumber": 1434, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure MSSQL Admin (TCP,1434) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0286", + "id": "AC_AWS_0286", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0287.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0287.json index 972f9663f..278f00ebb 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0287.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0287.json @@ -1,23 +1,20 @@ { - "name": "port1434UdpAlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port1434UdpAlbNetworkPortSecurityPublicScope", - "portNumber": 1434, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure MSSQL Browser Service (UDP,1434) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0287", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0287" + "name": "port1434UdpAlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port1434UdpAlbNetworkPortSecurityPublicScope", + "portNumber": 1434, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure MSSQL Browser Service (UDP,1434) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0287", + "id": "AC_AWS_0287", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0288.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0288.json index 7fa80bf44..e40cbca1b 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0288.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0288.json @@ -1,23 +1,20 @@ { - "name": "port135AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port135AlbNetworkPortSecurityPublicScope", - "portNumber": 135, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure MSSQL Debugger (TCP,135) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0288", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0288" + "name": "port135AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port135AlbNetworkPortSecurityPublicScope", + "portNumber": 135, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure MSSQL Debugger (TCP,135) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0288", + "id": "AC_AWS_0288", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0289.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0289.json index 32e6703eb..e9c86f7a1 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0289.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0289.json @@ -1,23 +1,20 @@ { - "name": "port1433AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port1433AlbNetworkPortSecurityPublicScope", - "portNumber": 1433, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure MSSQL Server (TCP,1433) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0289", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0289" + "name": "port1433AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port1433AlbNetworkPortSecurityPublicScope", + "portNumber": 1433, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure MSSQL Server (TCP,1433) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0289", + "id": "AC_AWS_0289", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0290.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0290.json index 5b51128ad..cf1bbb268 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0290.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0290.json @@ -1,23 +1,20 @@ { - "name": "port11214AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port11214AlbNetworkPortSecurityPublicScope", - "portNumber": 11214, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Memcached SSL (TCP,11214) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0290", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0290" + "name": "port11214AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port11214AlbNetworkPortSecurityPublicScope", + "portNumber": 11214, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Memcached SSL (TCP,11214) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0290", + "id": "AC_AWS_0290", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0291.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0291.json index fc7a40734..fbf28b943 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0291.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0291.json @@ -1,23 +1,20 @@ { - "name": "port11215AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port11215AlbNetworkPortSecurityPublicScope", - "portNumber": 11215, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Memcached SSL (TCP,11215) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0291", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0291" + "name": "port11215AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port11215AlbNetworkPortSecurityPublicScope", + "portNumber": 11215, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Memcached SSL (TCP,11215) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0291", + "id": "AC_AWS_0291", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0292.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0292.json index 1f14f81aa..171fe6fdd 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0292.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0292.json @@ -1,23 +1,20 @@ { - "name": "port11214UdpAlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port11214UdpAlbNetworkPortSecurityPublicScope", - "portNumber": 11214, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Memcached SSL (UDP,11214) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0292", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0292" + "name": "port11214UdpAlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port11214UdpAlbNetworkPortSecurityPublicScope", + "portNumber": 11214, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Memcached SSL (UDP,11214) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0292", + "id": "AC_AWS_0292", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0293.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0293.json index 841d9472c..8dcf4a3ae 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0293.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0293.json @@ -1,23 +1,20 @@ { - "name": "port11215UdpAlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port11215UdpAlbNetworkPortSecurityPublicScope", - "portNumber": 11215, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Memcached SSL (UDP,11215) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0293", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0293" + "name": "port11215UdpAlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port11215UdpAlbNetworkPortSecurityPublicScope", + "portNumber": 11215, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Memcached SSL (UDP,11215) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0293", + "id": "AC_AWS_0293", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0294.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0294.json index 0cbb839a6..a7905b3de 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0294.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0294.json @@ -1,23 +1,20 @@ { - "name": "port27018AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port27018AlbNetworkPortSecurityPublicScope", - "portNumber": 27018, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Mongo Web Portal (TCP,27018) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0294", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0294" + "name": "port27018AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port27018AlbNetworkPortSecurityPublicScope", + "portNumber": 27018, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Mongo Web Portal (TCP,27018) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0294", + "id": "AC_AWS_0294", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0295.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0295.json index 56cb815e6..ef8242dfe 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0295.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0295.json @@ -1,23 +1,20 @@ { - "name": "port3306AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port3306AlbNetworkPortSecurityPublicScope", - "portNumber": 3306, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure MySQL (TCP,3306) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0295", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0295" + "name": "port3306AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port3306AlbNetworkPortSecurityPublicScope", + "portNumber": 3306, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure MySQL (TCP,3306) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0295", + "id": "AC_AWS_0295", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0296.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0296.json index 629555171..7285bc5d8 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0296.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0296.json @@ -1,23 +1,20 @@ { - "name": "port137AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port137AlbNetworkPortSecurityPublicScope", - "portNumber": 137, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBIOS Name Service (TCP,137) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0296", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0296" + "name": "port137AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port137AlbNetworkPortSecurityPublicScope", + "portNumber": 137, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBIOS Name Service (TCP,137) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0296", + "id": "AC_AWS_0296", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0297.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0297.json index 5f9aef860..60ed6aa4f 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0297.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0297.json @@ -1,23 +1,20 @@ { - "name": "port137UdpAlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port137UdpAlbNetworkPortSecurityPublicScope", - "portNumber": 137, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBIOS Name Service (UDP,137) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0297", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0297" + "name": "port137UdpAlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port137UdpAlbNetworkPortSecurityPublicScope", + "portNumber": 137, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBIOS Name Service (UDP,137) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0297", + "id": "AC_AWS_0297", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0298.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0298.json index 1ddeb7989..66f150580 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0298.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0298.json @@ -1,23 +1,20 @@ { - "name": "port138AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port138AlbNetworkPortSecurityPublicScope", - "portNumber": 138, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBios Datagram Service (TCP,138) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0298", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0298" + "name": "port138AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port138AlbNetworkPortSecurityPublicScope", + "portNumber": 138, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBios Datagram Service (TCP,138) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0298", + "id": "AC_AWS_0298", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0299.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0299.json index a984bb423..d67f5a100 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0299.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0299.json @@ -1,23 +1,20 @@ { - "name": "port138UdpAlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port138UdpAlbNetworkPortSecurityPublicScope", - "portNumber": 138, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBios Datagram Service (UDP,138) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0299", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0299" + "name": "port138UdpAlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port138UdpAlbNetworkPortSecurityPublicScope", + "portNumber": 138, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBios Datagram Service (UDP,138) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0299", + "id": "AC_AWS_0299", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0300.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0300.json index be44e24aa..0d1f1855a 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0300.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0300.json @@ -1,23 +1,20 @@ { - "name": "port139AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port139AlbNetworkPortSecurityPublicScope", - "portNumber": 139, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBios Session Service (TCP,139) is not accessible by a CIDR block range", - "reference_id": "AC_AWS_0300", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0300" + "name": "port139AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port139AlbNetworkPortSecurityPublicScope", + "portNumber": 139, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBios Session Service (TCP,139) is not accessible by a CIDR block range", + "reference_id": "AC_AWS_0300", + "id": "AC_AWS_0300", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0301.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0301.json index 5c7655e59..99bd4c95d 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0301.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0301.json @@ -1,23 +1,20 @@ { - "name": "port139UdpAlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port139UdpAlbNetworkPortSecurityPublicScope", - "portNumber": 139, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBios Session Service (UDP,139) is not accessible by a CIDR block range", - "reference_id": "AC_AWS_0301", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0301" + "name": "port139UdpAlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port139UdpAlbNetworkPortSecurityPublicScope", + "portNumber": 139, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBios Session Service (UDP,139) is not accessible by a CIDR block range", + "reference_id": "AC_AWS_0301", + "id": "AC_AWS_0301", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0302.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0302.json index 6dbbb1432..77ec78aff 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0302.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0302.json @@ -1,23 +1,20 @@ { - "name": "port2484AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port2484AlbNetworkPortSecurityPublicScope", - "portNumber": 2484, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Oracle DB SSL (TCP,2484) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0302", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0302" + "name": "port2484AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port2484AlbNetworkPortSecurityPublicScope", + "portNumber": 2484, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Oracle DB SSL (TCP,2484) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0302", + "id": "AC_AWS_0302", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0303.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0303.json index 4cda03fe2..d1425bed0 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0303.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0303.json @@ -1,23 +1,20 @@ { - "name": "port2484UdpAlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port2484UdpAlbNetworkPortSecurityPublicScope", - "portNumber": 2484, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Oracle DB SSL (UDP,2484) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0303", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0303" + "name": "port2484UdpAlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port2484UdpAlbNetworkPortSecurityPublicScope", + "portNumber": 2484, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Oracle DB SSL (UDP,2484) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0303", + "id": "AC_AWS_0303", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0304.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0304.json index cb7d50db6..f8afc5698 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0304.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0304.json @@ -1,23 +1,20 @@ { - "name": "port5432AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port5432AlbNetworkPortSecurityPublicScope", - "portNumber": 5432, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Postgres SQL (TCP,5432) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0304", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0304" + "name": "port5432AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port5432AlbNetworkPortSecurityPublicScope", + "portNumber": 5432, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Postgres SQL (TCP,5432) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0304", + "id": "AC_AWS_0304", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0305.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0305.json index 90aa8201f..d25dd9cfc 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0305.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0305.json @@ -1,23 +1,20 @@ { - "name": "port5432UdpAlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port5432UdpAlbNetworkPortSecurityPublicScope", - "portNumber": 5432, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Postgres SQL (UDP,5432) is not accessible by a CIDR block range", - "reference_id": "AC_AWS_0305", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0305" + "name": "port5432UdpAlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port5432UdpAlbNetworkPortSecurityPublicScope", + "portNumber": 5432, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Postgres SQL (UDP,5432) is not accessible by a CIDR block range", + "reference_id": "AC_AWS_0305", + "id": "AC_AWS_0305", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0306.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0306.json index 2fa57636b..2e4eaaf89 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0306.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0306.json @@ -1,23 +1,20 @@ { - "name": "port3000AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port3000AlbNetworkPortSecurityPublicScope", - "portNumber": 3000, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Prevalent known internal port (TCP,3000) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0306", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0306" + "name": "port3000AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port3000AlbNetworkPortSecurityPublicScope", + "portNumber": 3000, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Prevalent known internal port (TCP,3000) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0306", + "id": "AC_AWS_0306", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0307.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0307.json index 1b784ef2f..49b5ab7e3 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0307.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0307.json @@ -1,23 +1,20 @@ { - "name": "port8140AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port8140AlbNetworkPortSecurityPublicScope", - "portNumber": 8140, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Puppet Master (TCP:8140) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0307", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0307" + "name": "port8140AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port8140AlbNetworkPortSecurityPublicScope", + "portNumber": 8140, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Puppet Master (TCP:8140) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0307", + "id": "AC_AWS_0307", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0308.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0308.json index eebe76f64..5a396dd50 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0308.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0308.json @@ -1,23 +1,20 @@ { - "name": "port161UdpAlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port161UdpAlbNetworkPortSecurityPublicScope", - "portNumber": 161, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SNMP (UDP,161) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0308", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0308" + "name": "port161UdpAlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port161UdpAlbNetworkPortSecurityPublicScope", + "portNumber": 161, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SNMP (UDP,161) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0308", + "id": "AC_AWS_0308", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0309.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0309.json index 39bf2cf42..6518c8eff 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0309.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0309.json @@ -1,23 +1,20 @@ { - "name": "port2382AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port2382AlbNetworkPortSecurityPublicScope", - "portNumber": 2382, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SQL Server Analysis Service browser (TCP,2382) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0309", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0309" + "name": "port2382AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port2382AlbNetworkPortSecurityPublicScope", + "portNumber": 2382, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SQL Server Analysis Service browser (TCP,2382) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0309", + "id": "AC_AWS_0309", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0310.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0310.json index 5bb905c30..558d2ca8c 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0310.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0310.json @@ -1,23 +1,20 @@ { - "name": "port2383AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port2383AlbNetworkPortSecurityPublicScope", - "portNumber": 2383, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SQL Server Analysis Services (TCP,2383) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0310", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0310" + "name": "port2383AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port2383AlbNetworkPortSecurityPublicScope", + "portNumber": 2383, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SQL Server Analysis Services (TCP,2383) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0310", + "id": "AC_AWS_0310", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0311.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0311.json index 9492bc0cd..e6cd49e50 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0311.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0311.json @@ -1,23 +1,20 @@ { - "name": "port4505AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port4505AlbNetworkPortSecurityPublicScope", - "portNumber": 4505, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SaltStack Master (TCP,4505) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0311", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0311" + "name": "port4505AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port4505AlbNetworkPortSecurityPublicScope", + "portNumber": 4505, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SaltStack Master (TCP,4505) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0311", + "id": "AC_AWS_0311", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0312.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0312.json index 601bb3160..201bae32e 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0312.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0312.json @@ -1,23 +1,20 @@ { - "name": "port1521AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port1521AlbNetworkPortSecurityPublicScope", - "portNumber": 1521, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Oracle Database Server (TCP,1521) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0312", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0312" + "name": "port1521AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port1521AlbNetworkPortSecurityPublicScope", + "portNumber": 1521, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Oracle Database Server (TCP,1521) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0312", + "id": "AC_AWS_0312", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0313.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0313.json index 51fbf3274..7256dc800 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0313.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0313.json @@ -1,23 +1,20 @@ { - "name": "port23AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port23AlbNetworkPortSecurityPublicScope", - "portNumber": 23, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Telnet (TCP,23) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0313", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0313" + "name": "port23AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port23AlbNetworkPortSecurityPublicScope", + "portNumber": 23, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Telnet (TCP,23) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0313", + "id": "AC_AWS_0313", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0314.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0314.json index bda92c1f5..ace459c8f 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0314.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0314.json @@ -1,23 +1,20 @@ { - "name": "port25AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port25AlbNetworkPortSecurityPublicScope", - "portNumber": 25, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure SMTP (TCP,25) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0314", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0314" + "name": "port25AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port25AlbNetworkPortSecurityPublicScope", + "portNumber": 25, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure SMTP (TCP,25) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0314", + "id": "AC_AWS_0314", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0315.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0315.json index 4c8b3b760..135a55d89 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0315.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0315.json @@ -1,23 +1,20 @@ { - "name": "port445AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port445AlbNetworkPortSecurityPublicScope", - "portNumber": 445, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure CIFS for file/printer (TCP,445) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0315", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0315" + "name": "port445AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port445AlbNetworkPortSecurityPublicScope", + "portNumber": 445, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure CIFS for file/printer (TCP,445) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0315", + "id": "AC_AWS_0315", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0316.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0316.json index ce3cb55b7..b47697d1b 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0316.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0316.json @@ -1,23 +1,20 @@ { - "name": "port27017AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port27017AlbNetworkPortSecurityPublicScope", - "portNumber": 27017, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure MongoDB (TCP,27017) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0316", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0316" + "name": "port27017AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port27017AlbNetworkPortSecurityPublicScope", + "portNumber": 27017, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure MongoDB (TCP,27017) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0316", + "id": "AC_AWS_0316", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0317.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0317.json index 05c2a9c07..03c7ae2ab 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0317.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0317.json @@ -1,23 +1,20 @@ { - "name": "port9200AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port9200AlbNetworkPortSecurityPublicScope", - "portNumber": 9200, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Elasticsearch (TCP,9200) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0317", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0317" + "name": "port9200AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port9200AlbNetworkPortSecurityPublicScope", + "portNumber": 9200, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Elasticsearch (TCP,9200) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0317", + "id": "AC_AWS_0317", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0318.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0318.json index b60e3d428..dbbd64ba1 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0318.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0318.json @@ -1,23 +1,20 @@ { - "name": "port9300AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port9300AlbNetworkPortSecurityPublicScope", - "portNumber": 9300, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Elasticsearch (TCP,9300) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0318", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0318" + "name": "port9300AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port9300AlbNetworkPortSecurityPublicScope", + "portNumber": 9300, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Elasticsearch (TCP,9300) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0318", + "id": "AC_AWS_0318", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0319.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0319.json index 47413232e..7677c8011 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0319.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0319.json @@ -1,23 +1,20 @@ { - "name": "port22AlbNetworkPortSecurityPublicScope", - "file": "portsAlbNetworkPortSecurityPublicScope.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "port22AlbNetworkPortSecurityPublicScope", - "portNumber": 22, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SSH (TCP,22) is not accessible by a public CIDR block range", - "reference_id": "AC_AWS_0319", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0319" + "name": "port22AlbNetworkPortSecurityPublicScope", + "file": "portsAlbNetworkPortSecurityPublicScope.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "port22AlbNetworkPortSecurityPublicScope", + "portNumber": 22, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SSH (TCP,22) is not accessible by a public CIDR block range", + "reference_id": "AC_AWS_0319", + "id": "AC_AWS_0319", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0320.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0320.json index b3261f369..0e82dcbf6 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0320.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0320.json @@ -1,23 +1,20 @@ { - "name": "networkPort22ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort22ExposedToprivate", - "portNumber": 22, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports SSH (TCP,22) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0320", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0320" + "name": "networkPort22ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort22ExposedToprivate", + "portNumber": 22, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports SSH (TCP,22) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0320", + "id": "AC_AWS_0320", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0321.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0321.json index 0cd50a00f..11b6a7e09 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0321.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0321.json @@ -1,23 +1,20 @@ { - "name": "networkPort80ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort80ExposedToprivate", - "portNumber": 80, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports http (TCP,80) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0321", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0321" + "name": "networkPort80ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort80ExposedToprivate", + "portNumber": 80, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports http (TCP,80) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0321", + "id": "AC_AWS_0321", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0322.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0322.json index b432142ee..a74d396b3 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0322.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0322.json @@ -1,23 +1,20 @@ { - "name": "networkPort443ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort443ExposedToprivate", - "portNumber": 443, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports https (TCP,443) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0322", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0322" + "name": "networkPort443ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort443ExposedToprivate", + "portNumber": 443, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports https (TCP,443) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0322", + "id": "AC_AWS_0322", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0323.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0323.json index e2579f5ec..8bf75c081 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0323.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0323.json @@ -1,23 +1,20 @@ { - "name": "networkPort3389ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3389ExposedToprivate", - "portNumber": 3389, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports remote desktop port (TCP,3389) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0323", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0323" + "name": "networkPort3389ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort3389ExposedToprivate", + "portNumber": 3389, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports remote desktop port (TCP,3389) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0323", + "id": "AC_AWS_0323", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0324.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0324.json index 1f78ad2ef..98dfcb7c5 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0324.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0324.json @@ -1,23 +1,20 @@ { - "name": "networkPort9200ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort9200ExposedToprivate", - "portNumber": 9200, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports Elasticsearch (TCP,9200) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0324", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0324" + "name": "networkPort9200ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort9200ExposedToprivate", + "portNumber": 9200, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports Elasticsearch (TCP,9200) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0324", + "id": "AC_AWS_0324", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0325.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0325.json index 9e71e3a81..3d2a4dc4c 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0325.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0325.json @@ -1,23 +1,20 @@ { - "name": "networkPort4506ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort4506ExposedToprivate", - "portNumber": 4506, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports SaltStackMaster (TCP,4506) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0325", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0325" + "name": "networkPort4506ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort4506ExposedToprivate", + "portNumber": 4506, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports SaltStackMaster (TCP,4506) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0325", + "id": "AC_AWS_0325", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0326.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0326.json index 59c355569..37eebe846 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0326.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0326.json @@ -1,23 +1,20 @@ { - "name": "networkPort61621ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort61621ExposedToprivate", - "portNumber": 61621, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports CassandraOpsCenteragent (TCP,61621) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0326", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0326" + "name": "networkPort61621ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort61621ExposedToprivate", + "portNumber": 61621, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports CassandraOpsCenteragent (TCP,61621) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0326", + "id": "AC_AWS_0326", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0327.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0327.json index 7e5876638..5940564f8 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0327.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0327.json @@ -1,23 +1,20 @@ { - "name": "networkPort8080ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8080ExposedToprivate", - "portNumber": 8080, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports Knowninternalwebport (TCP,8080) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0327", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0327" + "name": "networkPort8080ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort8080ExposedToprivate", + "portNumber": 8080, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports Knowninternalwebport (TCP,8080) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0327", + "id": "AC_AWS_0327", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0328.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0328.json index 7fc908291..669d77c82 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0328.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0328.json @@ -1,23 +1,20 @@ { - "name": "networkPort1434ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1434ExposedToprivate", - "portNumber": 1434, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports MSSQLAdmin (TCP,1434) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0328", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0328" + "name": "networkPort1434ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort1434ExposedToprivate", + "portNumber": 1434, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports MSSQLAdmin (TCP,1434) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0328", + "id": "AC_AWS_0328", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0329.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0329.json index 925e019cb..204dae356 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0329.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0329.json @@ -1,23 +1,20 @@ { - "name": "networkPort1434ExposedToprivateU", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1434ExposedToprivateU", - "portNumber": 1434, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports MSSQLBrowserService (UDP,1434) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0329", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0329" + "name": "networkPort1434ExposedToprivateU", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort1434ExposedToprivateU", + "portNumber": 1434, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports MSSQLBrowserService (UDP,1434) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0329", + "id": "AC_AWS_0329", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0330.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0330.json index feb4fca8f..5f65d11d7 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0330.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0330.json @@ -1,23 +1,20 @@ { - "name": "networkPort135ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort135ExposedToprivate", - "portNumber": 135, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports MSSQLDebugger (TCP,135) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0330", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0330" + "name": "networkPort135ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort135ExposedToprivate", + "portNumber": 135, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports MSSQLDebugger (TCP,135) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0330", + "id": "AC_AWS_0330", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0331.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0331.json index 708fd4b39..e8023245f 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0331.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0331.json @@ -1,23 +1,20 @@ { - "name": "networkPort1433ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1433ExposedToprivate", - "portNumber": 1433, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports MSSQLServer (TCP,1433) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0331", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0331" + "name": "networkPort1433ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort1433ExposedToprivate", + "portNumber": 1433, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports MSSQLServer (TCP,1433) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0331", + "id": "AC_AWS_0331", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0332.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0332.json index b7788b648..568848f94 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0332.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0332.json @@ -1,23 +1,20 @@ { - "name": "networkPort11214ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11214ExposedToprivate", - "portNumber": 11214, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports MemcachedSSL (TCP,11214) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0332", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0332" + "name": "networkPort11214ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort11214ExposedToprivate", + "portNumber": 11214, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports MemcachedSSL (TCP,11214) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0332", + "id": "AC_AWS_0332", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0333.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0333.json index 14a8951cb..0c209713f 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0333.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0333.json @@ -1,23 +1,20 @@ { - "name": "networkPort11215ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11215ExposedToprivate", - "portNumber": 11215, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports MemcachedSSL (TCP,11215) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0333", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0333" + "name": "networkPort11215ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort11215ExposedToprivate", + "portNumber": 11215, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports MemcachedSSL (TCP,11215) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0333", + "id": "AC_AWS_0333", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0334.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0334.json index 72c750da6..9046e3433 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0334.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0334.json @@ -1,23 +1,20 @@ { - "name": "networkPort11214ExposedToprivateU", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11214ExposedToprivateU", - "portNumber": 11214, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports MemcachedSSL (UDP,11214) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0334", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0334" + "name": "networkPort11214ExposedToprivateU", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort11214ExposedToprivateU", + "portNumber": 11214, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports MemcachedSSL (UDP,11214) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0334", + "id": "AC_AWS_0334", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0335.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0335.json index e9c5e43e3..7bb6d8c39 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0335.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0335.json @@ -1,23 +1,20 @@ { - "name": "networkPort11215ExposedToprivateU", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11215ExposedToprivateU", - "portNumber": 11215, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports MemcachedSSL (UDP,11215) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0335", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0335" + "name": "networkPort11215ExposedToprivateU", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort11215ExposedToprivateU", + "portNumber": 11215, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports MemcachedSSL (UDP,11215) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0335", + "id": "AC_AWS_0335", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0336.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0336.json index 7438e75a6..3faeb7e44 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0336.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0336.json @@ -1,23 +1,20 @@ { - "name": "networkPort3306ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3306ExposedToprivate", - "portNumber": 3306, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Security Groups Unrestricted Specific Ports MySQL (TCP,3306) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0336", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0336" + "name": "networkPort3306ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort3306ExposedToprivate", + "portNumber": 3306, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Security Groups Unrestricted Specific Ports MySQL (TCP,3306) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0336", + "id": "AC_AWS_0336", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0337.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0337.json index 7c9716577..ce2e06fa5 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0337.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0337.json @@ -1,23 +1,20 @@ { - "name": "networkPort3020ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3020ExposedToprivate", - "portNumber": 3020, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure CIFS/SMB' (TCP,3020) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0337", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0337" + "name": "networkPort3020ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort3020ExposedToprivate", + "portNumber": 3020, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure CIFS/SMB' (TCP,3020) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0337", + "id": "AC_AWS_0337", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0338.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0338.json index 81395a574..c2b24fa6d 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0338.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0338.json @@ -1,23 +1,20 @@ { - "name": "networkPort7001ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort7001ExposedToprivate", - "portNumber": 7001, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Cassandra' (TCP,7001) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0338", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0338" + "name": "networkPort7001ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort7001ExposedToprivate", + "portNumber": 7001, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Cassandra' (TCP,7001) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0338", + "id": "AC_AWS_0338", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0339.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0339.json index 6c46696a2..63bb850da 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0339.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0339.json @@ -1,23 +1,20 @@ { - "name": "networkPort9000ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort9000ExposedToprivate", - "portNumber": 9000, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure HadoopNameNode' (TCP,9000) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0339", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0339" + "name": "networkPort9000ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort9000ExposedToprivate", + "portNumber": 9000, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure HadoopNameNode' (TCP,9000) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0339", + "id": "AC_AWS_0339", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0340.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0340.json index 23ed84bfd..353263215 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0340.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0340.json @@ -1,23 +1,20 @@ { - "name": "networkPort8000ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8000ExposedToprivate", - "portNumber": 8000, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Knowninternalwebport' (TCP,8000) not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0340", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0340" + "name": "networkPort8000ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort8000ExposedToprivate", + "portNumber": 8000, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Knowninternalwebport' (TCP,8000) not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0340", + "id": "AC_AWS_0340", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0341.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0341.json index 54b08da57..82d669558 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0341.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0341.json @@ -1,23 +1,20 @@ { - "name": "networkPort636ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort636ExposedToprivate", - "portNumber": 636, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure LDAPSSL' (TCP,636) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0341", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0341" + "name": "networkPort636ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort636ExposedToprivate", + "portNumber": 636, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure LDAPSSL' (TCP,636) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0341", + "id": "AC_AWS_0341", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0342.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0342.json index 52dfaa402..35d227aa7 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0342.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0342.json @@ -1,23 +1,20 @@ { - "name": "networkPort27018ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort27018ExposedToprivate", - "portNumber": 27018, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure MongoWebPortal' (TCP,27018) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0342", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0342" + "name": "networkPort27018ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort27018ExposedToprivate", + "portNumber": 27018, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure MongoWebPortal' (TCP,27018) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0342", + "id": "AC_AWS_0342", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0343.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0343.json index d0ddbc752..45910fb4b 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0343.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0343.json @@ -1,23 +1,20 @@ { - "name": "networkPort137ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort137ExposedToprivate", - "portNumber": 137, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOSNameService' (TCP,137) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0343", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0343" + "name": "networkPort137ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort137ExposedToprivate", + "portNumber": 137, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOSNameService' (TCP,137) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0343", + "id": "AC_AWS_0343", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0344.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0344.json index cf97ba458..bfa148185 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0344.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0344.json @@ -1,23 +1,20 @@ { - "name": "networkPort137ExposedToprivateU", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort137ExposedToprivateU", - "portNumber": 137, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOSNameService' (UDP,137) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0344", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0344" + "name": "networkPort137ExposedToprivateU", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort137ExposedToprivateU", + "portNumber": 137, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOSNameService' (UDP,137) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0344", + "id": "AC_AWS_0344", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0345.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0345.json index aff70c34f..66981e670 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0345.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0345.json @@ -1,23 +1,20 @@ { - "name": "networkPort138ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort138ExposedToprivate", - "portNumber": 138, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOSNameService' (UDP,137) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0345", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0345" + "name": "networkPort138ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort138ExposedToprivate", + "portNumber": 138, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOSNameService' (UDP,137) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0345", + "id": "AC_AWS_0345", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0346.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0346.json index 9ea3ed66c..17aefb65d 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0346.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0346.json @@ -1,23 +1,20 @@ { - "name": "networkPort138ExposedToprivateU", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort138ExposedToprivateU", - "portNumber": 138, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOSDatagramService' (UDP,138) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0346", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0346" + "name": "networkPort138ExposedToprivateU", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort138ExposedToprivateU", + "portNumber": 138, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOSDatagramService' (UDP,138) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0346", + "id": "AC_AWS_0346", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0347.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0347.json index c5de2e8ee..db7590056 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0347.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0347.json @@ -1,23 +1,20 @@ { - "name": "networkPort139ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort139ExposedToprivate", - "portNumber": 139, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOSSessionService' (TCP,139) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0347", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0347" + "name": "networkPort139ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort139ExposedToprivate", + "portNumber": 139, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOSSessionService' (TCP,139) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0347", + "id": "AC_AWS_0347", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0348.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0348.json index f26f01a4d..6254a081a 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0348.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0348.json @@ -1,23 +1,20 @@ { - "name": "networkPort139ExposedToprivateU", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort139ExposedToprivateU", - "portNumber": 139, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOSSessionService' (UDP,139) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0348", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0348" + "name": "networkPort139ExposedToprivateU", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort139ExposedToprivateU", + "portNumber": 139, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOSSessionService' (UDP,139) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0348", + "id": "AC_AWS_0348", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0349.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0349.json index df08f8b4e..16ba8e1c6 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0349.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0349.json @@ -1,23 +1,20 @@ { - "name": "networkPort2484ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2484ExposedToprivate", - "portNumber": 2484, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure OracleDBSSL' (TCP,2484) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0349", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0349" + "name": "networkPort2484ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort2484ExposedToprivate", + "portNumber": 2484, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure OracleDBSSL' (TCP,2484) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0349", + "id": "AC_AWS_0349", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0350.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0350.json index cb8c01df4..939420ea9 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0350.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0350.json @@ -1,23 +1,20 @@ { - "name": "networkPort2484ExposedToprivateU", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2484ExposedToprivateU", - "portNumber": 2484, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure OracleDBSSL' (UDP,2484) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0350", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0350" + "name": "networkPort2484ExposedToprivateU", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort2484ExposedToprivateU", + "portNumber": 2484, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure OracleDBSSL' (UDP,2484) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0350", + "id": "AC_AWS_0350", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0351.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0351.json index afae9a1dc..e9263adcf 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0351.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0351.json @@ -1,23 +1,20 @@ { - "name": "networkPort5432ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5432ExposedToprivate", - "portNumber": 5432, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure PostgresSQL' (TCP,5432) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0351", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0351" + "name": "networkPort5432ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort5432ExposedToprivate", + "portNumber": 5432, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure PostgresSQL' (TCP,5432) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0351", + "id": "AC_AWS_0351", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0352.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0352.json index 28a4e4e7e..73449f8bd 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0352.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0352.json @@ -1,23 +1,20 @@ { - "name": "networkPort5432ExposedToprivateU", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5432ExposedToprivateU", - "portNumber": 5432, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure PostgresSQL' (UDP,5432) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0352", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0352" + "name": "networkPort5432ExposedToprivateU", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort5432ExposedToprivateU", + "portNumber": 5432, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure PostgresSQL' (UDP,5432) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0352", + "id": "AC_AWS_0352", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0353.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0353.json index 89535b90d..916a85dd6 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0353.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0353.json @@ -1,23 +1,20 @@ { - "name": "networkPort3000ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3000ExposedToprivate", - "portNumber": 3000, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Prevalentknowninternalport' (TCP,3000) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0353", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0353" + "name": "networkPort3000ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort3000ExposedToprivate", + "portNumber": 3000, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Prevalentknowninternalport' (TCP,3000) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0353", + "id": "AC_AWS_0353", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0354.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0354.json index 1fbf850d7..08e183e8c 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0354.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0354.json @@ -1,23 +1,20 @@ { - "name": "networkPort8140ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8140ExposedToprivate", - "portNumber": 8140, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure PuppetMaster' (TCP,8140) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0354", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0354" + "name": "networkPort8140ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort8140ExposedToprivate", + "portNumber": 8140, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure PuppetMaster' (TCP,8140) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0354", + "id": "AC_AWS_0354", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0355.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0355.json index b9b654d75..7d89f3a79 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0355.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0355.json @@ -1,23 +1,20 @@ { - "name": "networkPort161ExposedToprivateU", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort161ExposedToprivateU", - "portNumber": 161, - "prefix": "", - "protocol": "udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SNMP' (UDP,161) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0355", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0355" + "name": "networkPort161ExposedToprivateU", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort161ExposedToprivateU", + "portNumber": 161, + "prefix": "", + "protocol": "udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SNMP' (UDP,161) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0355", + "id": "AC_AWS_0355", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0356.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0356.json index 272238bb3..10f884575 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0356.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0356.json @@ -1,23 +1,20 @@ { - "name": "networkPort2382ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2382ExposedToprivate", - "portNumber": 2382, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SQLServerAnalysisServicebrowser' (TCP,2382) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0356", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0356" + "name": "networkPort2382ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort2382ExposedToprivate", + "portNumber": 2382, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SQLServerAnalysisServicebrowser' (TCP,2382) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0356", + "id": "AC_AWS_0356", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0357.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0357.json index d1f98c9b5..d88dfb52f 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0357.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0357.json @@ -1,23 +1,20 @@ { - "name": "networkPort2383ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2383ExposedToprivate", - "portNumber": 2383, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SQLServerAnalysisServices' (TCP,2383) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0357", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0357" + "name": "networkPort2383ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort2383ExposedToprivate", + "portNumber": 2383, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SQLServerAnalysisServices' (TCP,2383) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0357", + "id": "AC_AWS_0357", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0358.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0358.json index 00a0192f9..0c7414a8f 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0358.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0358.json @@ -1,23 +1,20 @@ { - "name": "networkPort1521ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1521ExposedToprivate", - "portNumber": 1521, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure OracleDatabaseServer' (TCP,521) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0358", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0358" + "name": "networkPort1521ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort1521ExposedToprivate", + "portNumber": 1521, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure OracleDatabaseServer' (TCP,521) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0358", + "id": "AC_AWS_0358", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0359.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0359.json index 68e95c6c4..ac121dd03 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0359.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0359.json @@ -1,23 +1,20 @@ { - "name": "networkPort23ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort23ExposedToprivate", - "portNumber": 23, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Telnet' (TCP,23) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0359", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0359" + "name": "networkPort23ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort23ExposedToprivate", + "portNumber": 23, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Telnet' (TCP,23) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0359", + "id": "AC_AWS_0359", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0360.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0360.json index 68808b982..74004e7b3 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0360.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0360.json @@ -1,23 +1,20 @@ { - "name": "networkPort25ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort25ExposedToprivate", - "portNumber": 25, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SMTP' (TCP,25) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0360", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0360" + "name": "networkPort25ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort25ExposedToprivate", + "portNumber": 25, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SMTP' (TCP,25) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0360", + "id": "AC_AWS_0360", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0361.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0361.json index c6e4ad5ca..13157aa23 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0361.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0361.json @@ -1,23 +1,20 @@ { - "name": "networkPort445ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort445ExposedToprivate", - "portNumber": 445, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure CIFSforfile/printer' (TCP,445) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0361", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0361" + "name": "networkPort445ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort445ExposedToprivate", + "portNumber": 445, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure CIFSforfile/printer' (TCP,445) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0361", + "id": "AC_AWS_0361", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0362.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0362.json index 6fd7456e1..eb8297df9 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0362.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0362.json @@ -1,23 +1,20 @@ { - "name": "networkPort27017ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort27017ExposedToprivate", - "portNumber": 27017, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure MongoDB' (TCP,27017) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0362", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0362" + "name": "networkPort27017ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort27017ExposedToprivate", + "portNumber": 27017, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure MongoDB' (TCP,27017) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0362", + "id": "AC_AWS_0362", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0363.json b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0363.json index 74f53092a..a06615061 100755 --- a/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0363.json +++ b/pkg/policies/opa/rego/aws/aws_security_group/AC_AWS_0363.json @@ -1,23 +1,20 @@ { - "name": "networkPort9300ExposedToprivate", - "file": "networkPortExposedToPrivate.rego", - "policy_type": "aws", - "resource_type": { - "aws_security_group": true, - "aws_security_group_rule": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort9300ExposedToprivate", - "portNumber": 9300, - "prefix": "", - "protocol": "tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Elasticsearch' (TCP,9300) is not exposed to private hosts more than 32", - "reference_id": "AC_AWS_0363", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AWS_0363" + "name": "networkPort9300ExposedToprivate", + "file": "networkPortExposedToPrivate.rego", + "policy_type": "aws", + "resource_type": "aws_security_group", + "template_args": { + "defaultValue": "", + "name": "networkPort9300ExposedToprivate", + "portNumber": 9300, + "prefix": "", + "protocol": "tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Elasticsearch' (TCP,9300) is not exposed to private hosts more than 32", + "reference_id": "AC_AWS_0363", + "id": "AC_AWS_0363", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_sns_topic/AWS.AST.DP.MEDIUM.0037.json b/pkg/policies/opa/rego/aws/aws_sns_topic/AWS.AST.DP.MEDIUM.0037.json index 7db54fb1f..b129468e5 100644 --- a/pkg/policies/opa/rego/aws/aws_sns_topic/AWS.AST.DP.MEDIUM.0037.json +++ b/pkg/policies/opa/rego/aws/aws_sns_topic/AWS.AST.DP.MEDIUM.0037.json @@ -2,9 +2,7 @@ "name": "notEncryptedSns", "file": "notEncryptedSns.rego", "policy_type": "aws", - "resource_type": { - "aws_sns_topic": true - }, + "resource_type": "aws_sns_topic", "template_args": { "prefix": "" }, @@ -12,6 +10,6 @@ "description": "Ensure SNS topic is Encrypted using KMS master key", "reference_id": "AWS.AST.DP.MEDIUM.0037", "category": "Data Protection", - "version": 2, - "id": "AC_AWS_0502" + "id": "AC_AWS_0502", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_sns_topic/AWS.SNS.NS.Medium.1044.json b/pkg/policies/opa/rego/aws/aws_sns_topic/AWS.SNS.NS.Medium.1044.json index f61e34af2..89475cb41 100755 --- a/pkg/policies/opa/rego/aws/aws_sns_topic/AWS.SNS.NS.Medium.1044.json +++ b/pkg/policies/opa/rego/aws/aws_sns_topic/AWS.SNS.NS.Medium.1044.json @@ -2,9 +2,7 @@ "name": "snsPublicAccess", "file": "snsPublicAccess.rego", "policy_type": "aws", - "resource_type": { - "aws_sns_topic": true - }, + "resource_type": "aws_sns_topic", "template_args": { "prefix": "" }, diff --git a/pkg/policies/opa/rego/aws/aws_sqs_queue/AWS.SQS.NetworkSecurity.High.0569.json b/pkg/policies/opa/rego/aws/aws_sqs_queue/AWS.SQS.NetworkSecurity.High.0569.json index f5d7d1de7..f6ddc9ee9 100755 --- a/pkg/policies/opa/rego/aws/aws_sqs_queue/AWS.SQS.NetworkSecurity.High.0569.json +++ b/pkg/policies/opa/rego/aws/aws_sqs_queue/AWS.SQS.NetworkSecurity.High.0569.json @@ -2,9 +2,7 @@ "name": "sqsQueueExposed", "file": "sqsQueueExposed.rego", "policy_type": "aws", - "resource_type": { - "aws_sqs_queue": true - }, + "resource_type": "aws_sqs_queue", "template_args": { "prefix": "" }, diff --git a/pkg/policies/opa/rego/aws/aws_sqs_queue/AWS.SQS.NetworkSecurity.High.0570.json b/pkg/policies/opa/rego/aws/aws_sqs_queue/AWS.SQS.NetworkSecurity.High.0570.json index 51cfc767f..2acb8921d 100755 --- a/pkg/policies/opa/rego/aws/aws_sqs_queue/AWS.SQS.NetworkSecurity.High.0570.json +++ b/pkg/policies/opa/rego/aws/aws_sqs_queue/AWS.SQS.NetworkSecurity.High.0570.json @@ -2,9 +2,7 @@ "name": "sqsSseDisabled", "file": "sqsSseDisabled.rego", "policy_type": "aws", - "resource_type": { - "aws_sqs_queue": true - }, + "resource_type": "aws_sqs_queue", "template_args": { "prefix": "" }, diff --git a/pkg/policies/opa/rego/aws/aws_vpc/AWS.VPC.Logging.Medium.0470.json b/pkg/policies/opa/rego/aws/aws_vpc/AWS.VPC.Logging.Medium.0470.json index 5a0157486..c0806c62c 100755 --- a/pkg/policies/opa/rego/aws/aws_vpc/AWS.VPC.Logging.Medium.0470.json +++ b/pkg/policies/opa/rego/aws/aws_vpc/AWS.VPC.Logging.Medium.0470.json @@ -2,10 +2,7 @@ "name": "vpcFlowLogsNotEnabled", "file": "vpcFlowLogsNotEnabled.rego", "policy_type": "aws", - "resource_type": { - "aws_vpc": true, - "aws_flow_log": true - }, + "resource_type": "aws_vpc", "template_args": { "prefix": "" }, diff --git a/pkg/policies/opa/rego/aws/aws_vpc/AWS.VPC.Logging.Medium.0471.json b/pkg/policies/opa/rego/aws/aws_vpc/AWS.VPC.Logging.Medium.0471.json index 9d0f0e5a8..e8750d34d 100755 --- a/pkg/policies/opa/rego/aws/aws_vpc/AWS.VPC.Logging.Medium.0471.json +++ b/pkg/policies/opa/rego/aws/aws_vpc/AWS.VPC.Logging.Medium.0471.json @@ -2,9 +2,7 @@ "name": "defaultVpcExist", "file": "defaultVpcExist.rego", "policy_type": "aws", - "resource_type": { - "aws_vpc": true - }, + "resource_type": "aws_vpc", "template_args": { "prefix": "" }, diff --git a/pkg/policies/opa/rego/aws/aws_workspaces_workspace/AWS.AWW.DP.MEDIUM.040.json b/pkg/policies/opa/rego/aws/aws_workspaces_workspace/AWS.AWW.DP.MEDIUM.040.json index 3ac54b360..e530f42f6 100644 --- a/pkg/policies/opa/rego/aws/aws_workspaces_workspace/AWS.AWW.DP.MEDIUM.040.json +++ b/pkg/policies/opa/rego/aws/aws_workspaces_workspace/AWS.AWW.DP.MEDIUM.040.json @@ -2,9 +2,7 @@ "name": "workspaceRootEncryptionCheck", "file": "workspaceEncryptionCheck.rego", "policy_type": "aws", - "resource_type": { - "aws_workspaces_workspace": true - }, + "resource_type": "aws_workspaces_workspace", "template_args": { "attribute_name": "root_volume_encryption_enabled", "name": "workspaceRootEncryptionCheck", @@ -14,6 +12,6 @@ "description": "Ensure root volume for Workspaces is Encrypted", "reference_id": "AWS.AWW.DP.MEDIUM.040", "category": "Data Protection", - "version": 2, - "id": "AC_AWS_0503" + "id": "AC_AWS_0503", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/aws/aws_workspaces_workspace/AWS.AWW.DP.MEDIUM.041.json b/pkg/policies/opa/rego/aws/aws_workspaces_workspace/AWS.AWW.DP.MEDIUM.041.json index 454e5246d..4fe57ab48 100644 --- a/pkg/policies/opa/rego/aws/aws_workspaces_workspace/AWS.AWW.DP.MEDIUM.041.json +++ b/pkg/policies/opa/rego/aws/aws_workspaces_workspace/AWS.AWW.DP.MEDIUM.041.json @@ -2,9 +2,7 @@ "name": "workspaceUserEncryptionCheck", "file": "workspaceEncryptionCheck.rego", "policy_type": "aws", - "resource_type": { - "aws_workspaces_workspace": true - }, + "resource_type": "aws_workspaces_workspace", "template_args": { "attribute_name": "user_volume_encryption_enabled", "name": "workspaceUserEncryptionCheck", @@ -14,6 +12,6 @@ "description": "Ensure user volume for Workspaces is Encrypted", "reference_id": "AWS.AWW.DP.MEDIUM.041", "category": "Data Protection", - "version": 2, - "id": "AC_AWS_0504" + "id": "AC_AWS_0504", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_application_gateway/accurics.azure.NS.147.json b/pkg/policies/opa/rego/azure/azurerm_application_gateway/accurics.azure.NS.147.json index c7756b23e..e304b672b 100755 --- a/pkg/policies/opa/rego/azure/azurerm_application_gateway/accurics.azure.NS.147.json +++ b/pkg/policies/opa/rego/azure/azurerm_application_gateway/accurics.azure.NS.147.json @@ -2,9 +2,7 @@ "name": "reme_appGatewayWAFEnabled", "file": "appGatewayWAFEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_application_gateway": true - }, + "resource_type": "azurerm_application_gateway", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_container_registry/accurics.azure.AKS.3.json b/pkg/policies/opa/rego/azure/azurerm_container_registry/accurics.azure.AKS.3.json index 37e1e331d..4b89b09c7 100755 --- a/pkg/policies/opa/rego/azure/azurerm_container_registry/accurics.azure.AKS.3.json +++ b/pkg/policies/opa/rego/azure/azurerm_container_registry/accurics.azure.AKS.3.json @@ -2,10 +2,7 @@ "name": "reme_containerRegistryResourceLock", "file": "containerRegistryResourceLock.rego", "policy_type": "azure", - "resource_type": { - "azurerm_container_registry": true, - "azurerm_management_lock": true - }, + "resource_type": "azurerm_container_registry", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_container_registry/accurics.azure.EKM.164.json b/pkg/policies/opa/rego/azure/azurerm_container_registry/accurics.azure.EKM.164.json index 034a3bd10..b6df40d8b 100755 --- a/pkg/policies/opa/rego/azure/azurerm_container_registry/accurics.azure.EKM.164.json +++ b/pkg/policies/opa/rego/azure/azurerm_container_registry/accurics.azure.EKM.164.json @@ -2,9 +2,7 @@ "name": "reme_containerRegistryAdminEnabled", "file": "containerRegistryAdminEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_container_registry": true - }, + "resource_type": "azurerm_container_registry", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_cosmosdb_account/accurics.azure.CAM.162.json b/pkg/policies/opa/rego/azure/azurerm_cosmosdb_account/accurics.azure.CAM.162.json index c3362e7eb..e77d94900 100755 --- a/pkg/policies/opa/rego/azure/azurerm_cosmosdb_account/accurics.azure.CAM.162.json +++ b/pkg/policies/opa/rego/azure/azurerm_cosmosdb_account/accurics.azure.CAM.162.json @@ -2,9 +2,7 @@ "name": "reme_noTags", "file": "noTags.rego", "policy_type": "azure", - "resource_type": { - "azurerm_cosmosdb_account": true - }, + "resource_type": "azurerm_cosmosdb_account", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_cosmosdb_account/accurics.azure.NS.32.json b/pkg/policies/opa/rego/azure/azurerm_cosmosdb_account/accurics.azure.NS.32.json index baae989da..9a4ae45d5 100755 --- a/pkg/policies/opa/rego/azure/azurerm_cosmosdb_account/accurics.azure.NS.32.json +++ b/pkg/policies/opa/rego/azure/azurerm_cosmosdb_account/accurics.azure.NS.32.json @@ -2,9 +2,7 @@ "name": "reme_ipRangeFilterMissing", "file": "ipRangeFilterMissing.rego", "policy_type": "azure", - "resource_type": { - "azurerm_cosmosdb_account": true - }, + "resource_type": "azurerm_cosmosdb_account", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_key_vault/accurics.azure.EKM.164.json b/pkg/policies/opa/rego/azure/azurerm_key_vault/accurics.azure.EKM.164.json index 6bd75ede6..0f50079d7 100755 --- a/pkg/policies/opa/rego/azure/azurerm_key_vault/accurics.azure.EKM.164.json +++ b/pkg/policies/opa/rego/azure/azurerm_key_vault/accurics.azure.EKM.164.json @@ -2,10 +2,7 @@ "name": "reme_keyVaultSoftDeleteEnabled", "file": "keyVaultSoftDeleteEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_key_vault": true, - "azurerm_monitor_diagnostic_setting": true - }, + "resource_type": "azurerm_key_vault", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_key_vault/accurics.azure.EKM.20.json b/pkg/policies/opa/rego/azure/azurerm_key_vault/accurics.azure.EKM.20.json index 46baa4189..c30852cc7 100755 --- a/pkg/policies/opa/rego/azure/azurerm_key_vault/accurics.azure.EKM.20.json +++ b/pkg/policies/opa/rego/azure/azurerm_key_vault/accurics.azure.EKM.20.json @@ -2,9 +2,7 @@ "name": "reme_keyVaultAuditLoggingEnabled", "file": "keyVaultAuditLoggingEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_key_vault": true - }, + "resource_type": "azurerm_key_vault", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_key_vault_key/accurics.azure.EKM.25.json b/pkg/policies/opa/rego/azure/azurerm_key_vault_key/accurics.azure.EKM.25.json index 7afbcbde4..1478dbfe8 100755 --- a/pkg/policies/opa/rego/azure/azurerm_key_vault_key/accurics.azure.EKM.25.json +++ b/pkg/policies/opa/rego/azure/azurerm_key_vault_key/accurics.azure.EKM.25.json @@ -2,9 +2,7 @@ "name": "reme_checkKeyExpirationIsSet", "file": "checkKeyExpirationIsSet.rego", "policy_type": "azure", - "resource_type": { - "azurerm_key_vault_key": true - }, + "resource_type": "azurerm_key_vault_key", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_key_vault_secret/accurics.azure.EKM.26.json b/pkg/policies/opa/rego/azure/azurerm_key_vault_secret/accurics.azure.EKM.26.json index 261fcfef8..4009d5108 100755 --- a/pkg/policies/opa/rego/azure/azurerm_key_vault_secret/accurics.azure.EKM.26.json +++ b/pkg/policies/opa/rego/azure/azurerm_key_vault_secret/accurics.azure.EKM.26.json @@ -2,9 +2,7 @@ "name": "reme_checkSecretExpirationIsSet", "file": "checkSecretExpirationIsSet.rego", "policy_type": "azure", - "resource_type": { - "azurerm_key_vault_secret": true - }, + "resource_type": "azurerm_key_vault_secret", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_kubernetes_cluster/accurics.azure.NS.382.json b/pkg/policies/opa/rego/azure/azurerm_kubernetes_cluster/accurics.azure.NS.382.json index e72854390..f528d9d60 100755 --- a/pkg/policies/opa/rego/azure/azurerm_kubernetes_cluster/accurics.azure.NS.382.json +++ b/pkg/policies/opa/rego/azure/azurerm_kubernetes_cluster/accurics.azure.NS.382.json @@ -2,9 +2,7 @@ "name": "networkPolicyEnabled", "file": "networkPolicyEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_kubernetes_cluster": true - }, + "resource_type": "azurerm_kubernetes_cluster", "template_args": null, "severity": "MEDIUM", "description": "Ensure AKS cluster has Network Policy configured.", diff --git a/pkg/policies/opa/rego/azure/azurerm_kubernetes_cluster/accurics.azure.NS.383.json b/pkg/policies/opa/rego/azure/azurerm_kubernetes_cluster/accurics.azure.NS.383.json index aee4a8353..7aab39ea1 100755 --- a/pkg/policies/opa/rego/azure/azurerm_kubernetes_cluster/accurics.azure.NS.383.json +++ b/pkg/policies/opa/rego/azure/azurerm_kubernetes_cluster/accurics.azure.NS.383.json @@ -2,9 +2,7 @@ "name": "kubeDashboardDisabled", "file": "kubeDashboardDisabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_kubernetes_cluster": true - }, + "resource_type": "azurerm_kubernetes_cluster", "template_args": null, "severity": "MEDIUM", "description": "Ensure Kube Dashboard is disabled", diff --git a/pkg/policies/opa/rego/azure/azurerm_managed_disk/accurics.azure.EKM.156.json b/pkg/policies/opa/rego/azure/azurerm_managed_disk/accurics.azure.EKM.156.json index 1e35e7c83..503f91140 100755 --- a/pkg/policies/opa/rego/azure/azurerm_managed_disk/accurics.azure.EKM.156.json +++ b/pkg/policies/opa/rego/azure/azurerm_managed_disk/accurics.azure.EKM.156.json @@ -2,12 +2,10 @@ "name": "checkDiskEncryption", "file": "checkDiskEncryption.rego", "policy_type": "azure", - "resource_type": { - "azurerm_managed_disk": true - }, + "resource_type": "azurerm_managed_disk", "template_args": { - "name": "checkDiskEncryption", "prefix": "reme_", + "name": "checkDiskEncryption", "suffix": "" }, "severity": "MEDIUM", diff --git a/pkg/policies/opa/rego/azure/azurerm_mssql_server/accurics.azure.LOG.357.json b/pkg/policies/opa/rego/azure/azurerm_mssql_server/accurics.azure.LOG.357.json index b682c4d66..05e0a9a68 100755 --- a/pkg/policies/opa/rego/azure/azurerm_mssql_server/accurics.azure.LOG.357.json +++ b/pkg/policies/opa/rego/azure/azurerm_mssql_server/accurics.azure.LOG.357.json @@ -2,9 +2,7 @@ "name": "mssqlAuditingRetention", "file": "mssqlAuditing.rego", "policy_type": "azure", - "resource_type": { - "azurerm_mssql_server": true - }, + "resource_type": "azurerm_mssql_server", "template_args": { "checkRetention": true, "name": "mssqlAuditingRetention" diff --git a/pkg/policies/opa/rego/azure/azurerm_mssql_server/accurics.azure.MON.355.json b/pkg/policies/opa/rego/azure/azurerm_mssql_server/accurics.azure.MON.355.json index 4811dfc33..02208bdca 100755 --- a/pkg/policies/opa/rego/azure/azurerm_mssql_server/accurics.azure.MON.355.json +++ b/pkg/policies/opa/rego/azure/azurerm_mssql_server/accurics.azure.MON.355.json @@ -2,9 +2,7 @@ "name": "mssqlServerAuditingEnabled", "file": "mssqlAuditing.rego", "policy_type": "azure", - "resource_type": { - "azurerm_mssql_server": true - }, + "resource_type": "azurerm_mssql_server", "template_args": { "checkRetention": false, "name": "mssqlServerAuditingEnabled" diff --git a/pkg/policies/opa/rego/azure/azurerm_mysql_server/accurics.azure.NS.361.json b/pkg/policies/opa/rego/azure/azurerm_mysql_server/accurics.azure.NS.361.json index 67f3ba886..2e269fc03 100755 --- a/pkg/policies/opa/rego/azure/azurerm_mysql_server/accurics.azure.NS.361.json +++ b/pkg/policies/opa/rego/azure/azurerm_mysql_server/accurics.azure.NS.361.json @@ -2,9 +2,7 @@ "name": "sslConnectionEnabled", "file": "sslConnectionEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_mysql_server": true - }, + "resource_type": "azurerm_mysql_server", "template_args": null, "severity": "HIGH", "description": "Ensure 'Enforce SSL connection' is set to 'ENABLED' for MySQL Database Server.", diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0270.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0270.json index 95c6a7c63..dfa00ab73 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0270.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0270.json @@ -1,23 +1,20 @@ { - "name": "networkPort3020ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3020ExposedToInternetAz", - "portNumber": 3020, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure CIFS / SMB (Tcp:3020) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0270", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0270" + "name": "networkPort3020ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort3020ExposedToInternetAz", + "portNumber": 3020, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure CIFS / SMB (Tcp:3020) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0270", + "id": "AC_AZURE_0270", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0271.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0271.json index c66a9890b..3277abd8e 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0271.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0271.json @@ -1,23 +1,20 @@ { - "name": "networkPort3020ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3020ExposedToPublicAz", - "portNumber": 3020, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure CIFS / SMB (Tcp:3020) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0271", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0271" + "name": "networkPort3020ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort3020ExposedToPublicAz", + "portNumber": 3020, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure CIFS / SMB (Tcp:3020) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0271", + "id": "AC_AZURE_0271", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0272.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0272.json index eb66f5006..b23a7abe5 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0272.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0272.json @@ -1,23 +1,20 @@ { - "name": "networkPort3020ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3020ExposedToPrivateAz", - "portNumber": 3020, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure CIFS / SMB (Tcp:3020) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0272", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0272" + "name": "networkPort3020ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort3020ExposedToPrivateAz", + "portNumber": 3020, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure CIFS / SMB (Tcp:3020) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0272", + "id": "AC_AZURE_0272", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0273.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0273.json index 2602ef9ac..e7cf18303 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0273.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0273.json @@ -1,23 +1,20 @@ { - "name": "networkPort7001ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort7001ExposedToInternetAz", - "portNumber": 7001, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Cassandra (Tcp:7001) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0273", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0273" + "name": "networkPort7001ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort7001ExposedToInternetAz", + "portNumber": 7001, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Cassandra (Tcp:7001) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0273", + "id": "AC_AZURE_0273", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0274.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0274.json index aaa5b21a2..ae6a04d63 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0274.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0274.json @@ -1,23 +1,20 @@ { - "name": "networkPort7001ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort7001ExposedToPublicAz", - "portNumber": 7001, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Cassandra (Tcp:7001) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0274", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0274" + "name": "networkPort7001ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort7001ExposedToPublicAz", + "portNumber": 7001, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Cassandra (Tcp:7001) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0274", + "id": "AC_AZURE_0274", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0275.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0275.json index fc43a6cd4..90a7cd806 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0275.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0275.json @@ -1,23 +1,20 @@ { - "name": "networkPort7001ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort7001ExposedToPrivateAz", - "portNumber": 7001, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Cassandra (Tcp:7001) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0275", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0275" + "name": "networkPort7001ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort7001ExposedToPrivateAz", + "portNumber": 7001, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Cassandra (Tcp:7001) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0275", + "id": "AC_AZURE_0275", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0276.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0276.json index 5ff15b0db..169afce58 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0276.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0276.json @@ -1,23 +1,20 @@ { - "name": "networkPort61621ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort61621ExposedToInternetAz", - "portNumber": 61621, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Cassandra OpsCenter (Tcp:61621) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0276", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0276" + "name": "networkPort61621ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort61621ExposedToInternetAz", + "portNumber": 61621, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Cassandra OpsCenter (Tcp:61621) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0276", + "id": "AC_AZURE_0276", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0285.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0285.json index 8169499e5..bfafc5ca8 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0285.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0285.json @@ -1,23 +1,20 @@ { - "name": "networkPort22ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort22ExposedToInternetAz", - "portNumber": 22, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure SSH (Tcp:22) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0285", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0285" + "name": "networkPort22ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort22ExposedToInternetAz", + "portNumber": 22, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure SSH (Tcp:22) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0285", + "id": "AC_AZURE_0285", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0286.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0286.json index 37c5d42d4..c8dc039ed 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0286.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0286.json @@ -1,23 +1,20 @@ { - "name": "networkPort22ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort22ExposedToPublicAz", - "portNumber": 22, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SSH (Tcp:22) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0286", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0286" + "name": "networkPort22ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort22ExposedToPublicAz", + "portNumber": 22, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SSH (Tcp:22) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0286", + "id": "AC_AZURE_0286", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0287.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0287.json index b8b0e5488..792282c5b 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0287.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0287.json @@ -1,23 +1,20 @@ { - "name": "networkPort22ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort22ExposedToPrivateAz", - "portNumber": 22, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SSH (Tcp:22) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0287", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0287" + "name": "networkPort22ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort22ExposedToPrivateAz", + "portNumber": 22, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SSH (Tcp:22) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0287", + "id": "AC_AZURE_0287", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0342.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0342.json index e3b954d80..f2d5935d1 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0342.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0342.json @@ -1,23 +1,20 @@ { - "name": "networkPort3389ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3389ExposedToInternetAz", - "portNumber": 3389, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure that RDP access is restricted from the internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0342", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0342" + "name": "networkPort3389ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort3389ExposedToInternetAz", + "portNumber": 3389, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure that RDP access is restricted from the internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0342", + "id": "AC_AZURE_0342", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0357.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0357.json index cdc733dcd..1b5208585 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0357.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0357.json @@ -1,23 +1,20 @@ { - "name": "networkPortAllExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPortAllExposedToInternetAz", - "portNumber": "*", - "prefix": "", - "protocol": "*", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure that request initiated from all ports (*) for all destination ports (*) is restricted from the internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0357", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0357" + "name": "networkPortAllExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPortAllExposedToInternetAz", + "portNumber": "*", + "prefix": "", + "protocol": "*", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure that request initiated from all ports (*) for all destination ports (*) is restricted from the internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0357", + "id": "AC_AZURE_0357", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0421.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0421.json index fcd839392..c3811ac4d 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0421.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0421.json @@ -1,20 +1,17 @@ { - "name": "tooOpenPrivateIPs", - "file": "tooOpenPrivateIPs.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "name": "tooOpenPrivateIPs", - "prefix": "", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure server is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0421", - "category": "Infrastructure Security", - "version": 1, - "id": "AC_AZURE_0421" + "name": "tooOpenPrivateIPs", + "file": "tooOpenPrivateIPs.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "name": "tooOpenPrivateIPs", + "prefix": "", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure server is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0421", + "id": "AC_AZURE_0421", + "category": "Infrastructure Security", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0422.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0422.json index c23bfe17a..f6795be42 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0422.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0422.json @@ -1,23 +1,20 @@ { - "name": "networkPort5900ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5900ExposedToPrivateAz", - "portNumber": 5900, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure VNC Server (Tcp:5900) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0422", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0422" + "name": "networkPort5900ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5900ExposedToPrivateAz", + "portNumber": 5900, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure VNC Server (Tcp:5900) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0422", + "id": "AC_AZURE_0422", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0423.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0423.json index 64b7af40d..3d344de1f 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0423.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0423.json @@ -1,23 +1,20 @@ { - "name": "networkPort5900ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5900ExposedToPublicAz", - "portNumber": 5900, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure VNC Server (Tcp:5900) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0423", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0423" + "name": "networkPort5900ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5900ExposedToPublicAz", + "portNumber": 5900, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure VNC Server (Tcp:5900) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0423", + "id": "AC_AZURE_0423", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0424.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0424.json index 99065bad6..373cc1a8d 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0424.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0424.json @@ -1,23 +1,20 @@ { - "name": "networkPort5900ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5900ExposedToInternetAz", - "portNumber": 5900, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure VNC Server (Tcp:5900) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0424", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0424" + "name": "networkPort5900ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5900ExposedToInternetAz", + "portNumber": 5900, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure VNC Server (Tcp:5900) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0424", + "id": "AC_AZURE_0424", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0425.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0425.json index 22f63888a..ac4945ef3 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0425.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0425.json @@ -1,23 +1,20 @@ { - "name": "networkPort5500ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5500ExposedToPrivateAz", - "portNumber": 5500, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure VNC Listener (Tcp:5500) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0425", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0425" + "name": "networkPort5500ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5500ExposedToPrivateAz", + "portNumber": 5500, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure VNC Listener (Tcp:5500) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0425", + "id": "AC_AZURE_0425", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0426.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0426.json index 7bf6c209f..42f2239b9 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0426.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0426.json @@ -1,23 +1,20 @@ { - "name": "networkPort5500ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5500ExposedToPublicAz", - "portNumber": 5500, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure VNC Listener (Tcp:5500) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0426", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0426" + "name": "networkPort5500ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5500ExposedToPublicAz", + "portNumber": 5500, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure VNC Listener (Tcp:5500) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0426", + "id": "AC_AZURE_0426", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0427.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0427.json index 8e125fd84..7f2a6f154 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0427.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0427.json @@ -1,23 +1,20 @@ { - "name": "networkPort5500ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5500ExposedToInternetAz", - "portNumber": 5500, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure VNC Listener (Tcp:5500) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0427", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0427" + "name": "networkPort5500ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5500ExposedToInternetAz", + "portNumber": 5500, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure VNC Listener (Tcp:5500) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0427", + "id": "AC_AZURE_0427", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0428.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0428.json index b1db5e7ee..53118bd01 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0428.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0428.json @@ -1,23 +1,20 @@ { - "name": "networkPort23ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort23ExposedToPrivateAz", - "portNumber": 23, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Telnet (Tcp:23) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0428", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0428" + "name": "networkPort23ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort23ExposedToPrivateAz", + "portNumber": 23, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Telnet (Tcp:23) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0428", + "id": "AC_AZURE_0428", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0429.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0429.json index 0949cc3ca..30bf4ceed 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0429.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0429.json @@ -1,23 +1,20 @@ { - "name": "networkPort23ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort23ExposedToPublicAz", - "portNumber": 23, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Telnet (Tcp:23) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0429", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0429" + "name": "networkPort23ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort23ExposedToPublicAz", + "portNumber": 23, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Telnet (Tcp:23) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0429", + "id": "AC_AZURE_0429", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0430.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0430.json index 03ed21ee8..a494c2811 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0430.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0430.json @@ -1,23 +1,20 @@ { - "name": "networkPort23ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort23ExposedToInternetAz", - "portNumber": 23, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Telnet (Tcp:23) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0430", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0430" + "name": "networkPort23ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort23ExposedToInternetAz", + "portNumber": 23, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Telnet (Tcp:23) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0430", + "id": "AC_AZURE_0430", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0431.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0431.json index e4842efeb..ee4e72f30 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0431.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0431.json @@ -1,23 +1,20 @@ { - "name": "networkPort4506ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort4506ExposedToPrivateAz", - "portNumber": 4506, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SaltStack Master (Tcp:4506) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0431", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0431" + "name": "networkPort4506ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort4506ExposedToPrivateAz", + "portNumber": 4506, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SaltStack Master (Tcp:4506) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0431", + "id": "AC_AZURE_0431", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0432.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0432.json index 7a7d0a61c..3aff7ae44 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0432.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0432.json @@ -1,23 +1,20 @@ { - "name": "networkPort4506ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort4506ExposedToPublicAz", - "portNumber": 4506, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SaltStack Master (Tcp:4506) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0432", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0432" + "name": "networkPort4506ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort4506ExposedToPublicAz", + "portNumber": 4506, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SaltStack Master (Tcp:4506) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0432", + "id": "AC_AZURE_0432", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0433.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0433.json index d68a905b0..98379eccf 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0433.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0433.json @@ -1,23 +1,20 @@ { - "name": "networkPort4506ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort4506ExposedToInternetAz", - "portNumber": 4506, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure SaltStack Master (Tcp:4506) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0433", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0433" + "name": "networkPort4506ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort4506ExposedToInternetAz", + "portNumber": 4506, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure SaltStack Master (Tcp:4506) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0433", + "id": "AC_AZURE_0433", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0434.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0434.json index 05781250a..e1e2f1054 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0434.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0434.json @@ -1,23 +1,20 @@ { - "name": "networkPort4505ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort4505ExposedToPrivateAz", - "portNumber": 4505, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SaltStack Master (Tcp:4505) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0434", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0434" + "name": "networkPort4505ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort4505ExposedToPrivateAz", + "portNumber": 4505, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SaltStack Master (Tcp:4505) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0434", + "id": "AC_AZURE_0434", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0435.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0435.json index 8402c6bdd..3c67ffb29 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0435.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0435.json @@ -1,23 +1,20 @@ { - "name": "networkPort4505ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort4505ExposedToPublicAz", - "portNumber": 4505, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SaltStack Master (Tcp:4505) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0435", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0435" + "name": "networkPort4505ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort4505ExposedToPublicAz", + "portNumber": 4505, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SaltStack Master (Tcp:4505) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0435", + "id": "AC_AZURE_0435", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0436.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0436.json index 23ef0876f..9832eee24 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0436.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0436.json @@ -1,23 +1,20 @@ { - "name": "networkPort4505ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort4505ExposedToInternetAz", - "portNumber": 4505, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure SaltStack Master (Tcp:4505) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0436", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0436" + "name": "networkPort4505ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort4505ExposedToInternetAz", + "portNumber": 4505, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure SaltStack Master (Tcp:4505) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0436", + "id": "AC_AZURE_0436", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0437.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0437.json index 7efe4b4fa..82c376374 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0437.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0437.json @@ -1,23 +1,20 @@ { - "name": "networkPort2383ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2383ExposedToPrivateAz", - "portNumber": 2383, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SQL Server Analysis (Tcp:2383) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0437", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0437" + "name": "networkPort2383ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2383ExposedToPrivateAz", + "portNumber": 2383, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SQL Server Analysis (Tcp:2383) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0437", + "id": "AC_AZURE_0437", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0438.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0438.json index 4f3132c9c..5f472f974 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0438.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0438.json @@ -1,23 +1,20 @@ { - "name": "networkPort2383ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2383ExposedToPublicAz", - "portNumber": 2383, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SQL Server Analysis (Tcp:2383) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0438", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0438" + "name": "networkPort2383ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2383ExposedToPublicAz", + "portNumber": 2383, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SQL Server Analysis (Tcp:2383) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0438", + "id": "AC_AZURE_0438", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0439.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0439.json index 435ff9372..0165b5106 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0439.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0439.json @@ -1,23 +1,20 @@ { - "name": "networkPort2383ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2383ExposedToInternetAz", - "portNumber": 2383, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure SQL Server Analysis (Tcp:2383) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0439", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0439" + "name": "networkPort2383ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2383ExposedToInternetAz", + "portNumber": 2383, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure SQL Server Analysis (Tcp:2383) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0439", + "id": "AC_AZURE_0439", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0440.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0440.json index a73d15b62..642f3d213 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0440.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0440.json @@ -1,23 +1,20 @@ { - "name": "networkPort2382ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2382ExposedToPrivateAz", - "portNumber": 2382, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SQL Server Analysis (Tcp:2382) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0440", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0440" + "name": "networkPort2382ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2382ExposedToPrivateAz", + "portNumber": 2382, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SQL Server Analysis (Tcp:2382) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0440", + "id": "AC_AZURE_0440", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0441.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0441.json index ea8281387..ea9fb77b3 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0441.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0441.json @@ -1,23 +1,20 @@ { - "name": "networkPort2382ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2382ExposedToPublicAz", - "portNumber": 2382, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SQL Server Analysis (Tcp:2382) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0441", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0441" + "name": "networkPort2382ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2382ExposedToPublicAz", + "portNumber": 2382, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SQL Server Analysis (Tcp:2382) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0441", + "id": "AC_AZURE_0441", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0442.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0442.json index b68225b4e..e281ebc77 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0442.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0442.json @@ -1,23 +1,20 @@ { - "name": "networkPort2382ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2382ExposedToInternetAz", - "portNumber": 2382, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure SQL Server Analysis (Tcp:2382) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0442", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0442" + "name": "networkPort2382ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2382ExposedToInternetAz", + "portNumber": 2382, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure SQL Server Analysis (Tcp:2382) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0442", + "id": "AC_AZURE_0442", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0443.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0443.json index 3b5eda919..942df9874 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0443.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0443.json @@ -1,23 +1,20 @@ { - "name": "networkPort161ExposedToPrivateUAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort161ExposedToPrivateUAz", - "portNumber": 161, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SNMP (Udp:161) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0443", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0443" + "name": "networkPort161ExposedToPrivateUAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort161ExposedToPrivateUAz", + "portNumber": 161, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SNMP (Udp:161) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0443", + "id": "AC_AZURE_0443", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0444.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0444.json index cb32b9c9e..afafb8ea1 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0444.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0444.json @@ -1,23 +1,20 @@ { - "name": "networkPort161ExposedToPublicUAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort161ExposedToPublicUAz", - "portNumber": 161, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SNMP (Udp:161) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0444", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0444" + "name": "networkPort161ExposedToPublicUAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort161ExposedToPublicUAz", + "portNumber": 161, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SNMP (Udp:161) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0444", + "id": "AC_AZURE_0444", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0445.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0445.json index 56e0804a2..3ce498034 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0445.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0445.json @@ -1,23 +1,20 @@ { - "name": "networkPort161ExposedToInternetUAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort161ExposedToInternetUAz", - "portNumber": 161, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure SNMP (Udp:161) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0445", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0445" + "name": "networkPort161ExposedToInternetUAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort161ExposedToInternetUAz", + "portNumber": 161, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure SNMP (Udp:161) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0445", + "id": "AC_AZURE_0445", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0446.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0446.json index 1f2ba88d9..ce7cf5f8f 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0446.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0446.json @@ -1,23 +1,20 @@ { - "name": "networkPort25ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort25ExposedToPrivateAz", - "portNumber": 25, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure SMTP (Tcp:25) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0446", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0446" + "name": "networkPort25ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort25ExposedToPrivateAz", + "portNumber": 25, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure SMTP (Tcp:25) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0446", + "id": "AC_AZURE_0446", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0447.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0447.json index d13e6a54c..260b58dc8 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0447.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0447.json @@ -1,23 +1,20 @@ { - "name": "networkPort25ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort25ExposedToPublicAz", - "portNumber": 25, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure SMTP (Tcp:25) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0447", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0447" + "name": "networkPort25ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort25ExposedToPublicAz", + "portNumber": 25, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure SMTP (Tcp:25) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0447", + "id": "AC_AZURE_0447", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0448.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0448.json index d12875e6f..963c00b6a 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0448.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0448.json @@ -1,23 +1,20 @@ { - "name": "networkPort25ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort25ExposedToInternetAz", - "portNumber": 25, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure SMTP (Tcp:25) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0448", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0448" + "name": "networkPort25ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort25ExposedToInternetAz", + "portNumber": 25, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure SMTP (Tcp:25) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0448", + "id": "AC_AZURE_0448", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0449.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0449.json index 679c86d21..77e0b1cc2 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0449.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0449.json @@ -1,23 +1,20 @@ { - "name": "networkPort8140ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8140ExposedToPrivateAz", - "portNumber": 8140, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Puppet Master (Tcp:8140) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0449", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0449" + "name": "networkPort8140ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort8140ExposedToPrivateAz", + "portNumber": 8140, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Puppet Master (Tcp:8140) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0449", + "id": "AC_AZURE_0449", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0450.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0450.json index b8f18b5e8..0b0b7120c 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0450.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0450.json @@ -1,23 +1,20 @@ { - "name": "networkPort8140ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8140ExposedToPublicAz", - "portNumber": 8140, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Puppet Master (Tcp:8140) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0450", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0450" + "name": "networkPort8140ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort8140ExposedToPublicAz", + "portNumber": 8140, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Puppet Master (Tcp:8140) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0450", + "id": "AC_AZURE_0450", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0451.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0451.json index 61bf0bdc8..3519c6888 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0451.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0451.json @@ -1,23 +1,20 @@ { - "name": "networkPort8140ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8140ExposedToInternetAz", - "portNumber": 8140, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Puppet Master (Tcp:8140) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0451", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0451" + "name": "networkPort8140ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort8140ExposedToInternetAz", + "portNumber": 8140, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Puppet Master (Tcp:8140) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0451", + "id": "AC_AZURE_0451", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0452.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0452.json index ee500be07..75d797f2a 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0452.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0452.json @@ -1,23 +1,20 @@ { - "name": "networkPort3000ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3000ExposedToPrivateAz", - "portNumber": 3000, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Prevalent known internal port (Tcp:3000) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0452", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0452" + "name": "networkPort3000ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort3000ExposedToPrivateAz", + "portNumber": 3000, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Prevalent known internal port (Tcp:3000) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0452", + "id": "AC_AZURE_0452", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0453.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0453.json index 3ccfc6c60..4f50583a3 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0453.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0453.json @@ -1,23 +1,20 @@ { - "name": "networkPort3000ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3000ExposedToPublicAz", - "portNumber": 3000, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Prevalent known internal port (Tcp:3000) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0453", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0453" + "name": "networkPort3000ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort3000ExposedToPublicAz", + "portNumber": 3000, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Prevalent known internal port (Tcp:3000) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0453", + "id": "AC_AZURE_0453", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0454.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0454.json index 7d52dcdd4..65b03f22e 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0454.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0454.json @@ -1,23 +1,20 @@ { - "name": "networkPort3000ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3000ExposedToInternetAz", - "portNumber": 3000, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Prevalent known internal port (Tcp:3000) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0454", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0454" + "name": "networkPort3000ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort3000ExposedToInternetAz", + "portNumber": 3000, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Prevalent known internal port (Tcp:3000) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0454", + "id": "AC_AZURE_0454", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0455.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0455.json index edd59e411..05db1020f 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0455.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0455.json @@ -1,23 +1,20 @@ { - "name": "networkPort5432ExposedToPrivateUAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5432ExposedToPrivateUAz", - "portNumber": 5432, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure PostgreSQL (Udp:5432) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0455", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0455" + "name": "networkPort5432ExposedToPrivateUAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5432ExposedToPrivateUAz", + "portNumber": 5432, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure PostgreSQL (Udp:5432) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0455", + "id": "AC_AZURE_0455", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0456.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0456.json index dea462341..f919d9db7 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0456.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0456.json @@ -1,23 +1,20 @@ { - "name": "networkPort5432ExposedToPublicUAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5432ExposedToPublicUAz", - "portNumber": 5432, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure PostgreSQL (Udp:5432) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0456", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0456" + "name": "networkPort5432ExposedToPublicUAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5432ExposedToPublicUAz", + "portNumber": 5432, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure PostgreSQL (Udp:5432) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0456", + "id": "AC_AZURE_0456", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0457.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0457.json index 1fdca063d..1ebeb1c7f 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0457.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0457.json @@ -1,23 +1,20 @@ { - "name": "networkPort5432ExposedToInternetUAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5432ExposedToInternetUAz", - "portNumber": 5432, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure PostgreSQL (Udp:5432) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0457", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0457" + "name": "networkPort5432ExposedToInternetUAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5432ExposedToInternetUAz", + "portNumber": 5432, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure PostgreSQL (Udp:5432) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0457", + "id": "AC_AZURE_0457", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0458.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0458.json index 4cae65754..e1685dc69 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0458.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0458.json @@ -1,23 +1,20 @@ { - "name": "networkPort5432ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5432ExposedToPrivateAz", - "portNumber": 5432, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure PostgreSQL (Tcp:5432) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0458", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0458" + "name": "networkPort5432ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5432ExposedToPrivateAz", + "portNumber": 5432, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure PostgreSQL (Tcp:5432) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0458", + "id": "AC_AZURE_0458", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0459.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0459.json index 0e5e9c4fa..ff5446873 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0459.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0459.json @@ -1,23 +1,20 @@ { - "name": "networkPort5432ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5432ExposedToPublicAz", - "portNumber": 5432, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure PostgreSQL (Tcp:5432) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0459", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0459" + "name": "networkPort5432ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5432ExposedToPublicAz", + "portNumber": 5432, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure PostgreSQL (Tcp:5432) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0459", + "id": "AC_AZURE_0459", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0460.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0460.json index b338024f7..f65365319 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0460.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0460.json @@ -1,23 +1,20 @@ { - "name": "networkPort5432ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort5432ExposedToInternetAz", - "portNumber": 5432, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure PostgreSQL (Tcp:5432) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0460", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0460" + "name": "networkPort5432ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort5432ExposedToInternetAz", + "portNumber": 5432, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure PostgreSQL (Tcp:5432) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0460", + "id": "AC_AZURE_0460", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0461.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0461.json index b6d63a1a2..7517c606f 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0461.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0461.json @@ -1,23 +1,20 @@ { - "name": "networkPort110ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort110ExposedToPrivateAz", - "portNumber": 110, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure POP3 (Tcp:110) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0461", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0461" + "name": "networkPort110ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort110ExposedToPrivateAz", + "portNumber": 110, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure POP3 (Tcp:110) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0461", + "id": "AC_AZURE_0461", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0462.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0462.json index c0a873ff8..bf688df20 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0462.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0462.json @@ -1,23 +1,20 @@ { - "name": "networkPort110ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort110ExposedToPublicAz", - "portNumber": 110, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure POP3 (Tcp:110) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0462", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0462" + "name": "networkPort110ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort110ExposedToPublicAz", + "portNumber": 110, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure POP3 (Tcp:110) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0462", + "id": "AC_AZURE_0462", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0463.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0463.json index 983d61e51..076a2270f 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0463.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0463.json @@ -1,23 +1,20 @@ { - "name": "networkPort110ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort110ExposedToInternetAz", - "portNumber": 110, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure POP3 (Tcp:110) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0463", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0463" + "name": "networkPort110ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort110ExposedToInternetAz", + "portNumber": 110, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure POP3 (Tcp:110) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0463", + "id": "AC_AZURE_0463", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0464.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0464.json index ab546bff1..2d830beff 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0464.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0464.json @@ -1,23 +1,20 @@ { - "name": "networkPort2484ExposedToPrivateUAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2484ExposedToPrivateUAz", - "portNumber": 2484, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Oracle DB SSL (Udp:2484) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0464", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0464" + "name": "networkPort2484ExposedToPrivateUAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2484ExposedToPrivateUAz", + "portNumber": 2484, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Oracle DB SSL (Udp:2484) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0464", + "id": "AC_AZURE_0464", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0465.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0465.json index 2bde99354..fb2266b36 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0465.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0465.json @@ -1,23 +1,20 @@ { - "name": "networkPort2484ExposedToPublicUAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2484ExposedToPublicUAz", - "portNumber": 2484, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Oracle DB SSL (Udp:2484) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0465", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0465" + "name": "networkPort2484ExposedToPublicUAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2484ExposedToPublicUAz", + "portNumber": 2484, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Oracle DB SSL (Udp:2484) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0465", + "id": "AC_AZURE_0465", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0466.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0466.json index f58ae9927..a7b1bb645 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0466.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0466.json @@ -1,23 +1,20 @@ { - "name": "networkPort2484ExposedToInternetUAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2484ExposedToInternetUAz", - "portNumber": 2484, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Oracle DB SSL (Udp:2484) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0466", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0466" + "name": "networkPort2484ExposedToInternetUAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2484ExposedToInternetUAz", + "portNumber": 2484, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Oracle DB SSL (Udp:2484) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0466", + "id": "AC_AZURE_0466", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0467.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0467.json index 6ae3d34c0..485ff74e9 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0467.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0467.json @@ -1,23 +1,20 @@ { - "name": "networkPort2484ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2484ExposedToPrivateAz", - "portNumber": 2484, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Oracle DB SSL (Tcp:2484) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0467", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0467" + "name": "networkPort2484ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2484ExposedToPrivateAz", + "portNumber": 2484, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Oracle DB SSL (Tcp:2484) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0467", + "id": "AC_AZURE_0467", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0468.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0468.json index 798d18f31..83f39ae64 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0468.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0468.json @@ -1,23 +1,20 @@ { - "name": "networkPort2484ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2484ExposedToPublicAz", - "portNumber": 2484, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Oracle DB SSL (Tcp:2484) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0468", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0468" + "name": "networkPort2484ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2484ExposedToPublicAz", + "portNumber": 2484, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Oracle DB SSL (Tcp:2484) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0468", + "id": "AC_AZURE_0468", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0469.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0469.json index dee4d2753..2b0959b7b 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0469.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0469.json @@ -1,23 +1,20 @@ { - "name": "networkPort2484ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort2484ExposedToInternetAz", - "portNumber": 2484, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Oracle DB SSL (Tcp:2484) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0469", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0469" + "name": "networkPort2484ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort2484ExposedToInternetAz", + "portNumber": 2484, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Oracle DB SSL (Tcp:2484) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0469", + "id": "AC_AZURE_0469", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0470.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0470.json index 78f263982..5c29f79ef 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0470.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0470.json @@ -1,23 +1,20 @@ { - "name": "networkPort139ExposedToPrivateUAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort139ExposedToPrivateUAz", - "portNumber": 139, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOS Session Service (Udp:139) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0470", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0470" + "name": "networkPort139ExposedToPrivateUAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort139ExposedToPrivateUAz", + "portNumber": 139, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOS Session Service (Udp:139) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0470", + "id": "AC_AZURE_0470", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0471.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0471.json index f4508efe8..ccd15270d 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0471.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0471.json @@ -1,23 +1,20 @@ { - "name": "networkPort139ExposedToPublicUAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort139ExposedToPublicUAz", - "portNumber": 139, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBIOS Session Service (Udp:139) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0471", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0471" + "name": "networkPort139ExposedToPublicUAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort139ExposedToPublicUAz", + "portNumber": 139, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBIOS Session Service (Udp:139) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0471", + "id": "AC_AZURE_0471", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0472.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0472.json index 783593601..8886f9871 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0472.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0472.json @@ -1,23 +1,20 @@ { - "name": "networkPort139ExposedToInternetUAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort139ExposedToInternetUAz", - "portNumber": 139, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure NetBIOS Session Service (Udp:139) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0472", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0472" + "name": "networkPort139ExposedToInternetUAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort139ExposedToInternetUAz", + "portNumber": 139, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure NetBIOS Session Service (Udp:139) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0472", + "id": "AC_AZURE_0472", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0473.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0473.json index 4ddee8db6..68094ce0a 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0473.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0473.json @@ -1,23 +1,20 @@ { - "name": "networkPort139ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort139ExposedToPrivateAz", - "portNumber": 139, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOS Session Service (Tcp:139) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0473", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0473" + "name": "networkPort139ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort139ExposedToPrivateAz", + "portNumber": 139, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOS Session Service (Tcp:139) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0473", + "id": "AC_AZURE_0473", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0474.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0474.json index 5c3b6be47..9e0d85c8d 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0474.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0474.json @@ -1,23 +1,20 @@ { - "name": "networkPort139ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort139ExposedToPublicAz", - "portNumber": 139, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBIOS Session Service (Tcp:139) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0474", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0474" + "name": "networkPort139ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort139ExposedToPublicAz", + "portNumber": 139, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBIOS Session Service (Tcp:139) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0474", + "id": "AC_AZURE_0474", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0475.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0475.json index 1522948d4..ad97bea7f 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0475.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0475.json @@ -1,23 +1,20 @@ { - "name": "networkPort139ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort139ExposedToInternetAz", - "portNumber": 139, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure NetBIOS Session Service (Tcp:139) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0475", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0475" + "name": "networkPort139ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort139ExposedToInternetAz", + "portNumber": 139, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure NetBIOS Session Service (Tcp:139) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0475", + "id": "AC_AZURE_0475", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0476.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0476.json index 8cb192d6c..a9fbbd148 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0476.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0476.json @@ -1,23 +1,20 @@ { - "name": "networkPort138ExposedToPrivateUAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort138ExposedToPrivateUAz", - "portNumber": 138, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOS Datagram Service (Udp:138) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0476", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0476" + "name": "networkPort138ExposedToPrivateUAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort138ExposedToPrivateUAz", + "portNumber": 138, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOS Datagram Service (Udp:138) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0476", + "id": "AC_AZURE_0476", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0477.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0477.json index 6a3947623..693e2e16c 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0477.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0477.json @@ -1,23 +1,20 @@ { - "name": "networkPort138ExposedToPublicUAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort138ExposedToPublicUAz", - "portNumber": 138, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBIOS Datagram Service (Udp:138) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0477", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0477" + "name": "networkPort138ExposedToPublicUAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort138ExposedToPublicUAz", + "portNumber": 138, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBIOS Datagram Service (Udp:138) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0477", + "id": "AC_AZURE_0477", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0478.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0478.json index b964ddbd2..281668772 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0478.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0478.json @@ -1,23 +1,20 @@ { - "name": "networkPort138ExposedToInternetUAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort138ExposedToInternetUAz", - "portNumber": 138, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure NetBIOS Datagram Service (Udp:138) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0478", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0478" + "name": "networkPort138ExposedToInternetUAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort138ExposedToInternetUAz", + "portNumber": 138, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure NetBIOS Datagram Service (Udp:138) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0478", + "id": "AC_AZURE_0478", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0479.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0479.json index cf3cc86ab..3208c6ff8 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0479.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0479.json @@ -1,23 +1,20 @@ { - "name": "networkPort138ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort138ExposedToPrivateAz", - "portNumber": 138, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOS Datagram Service (Tcp:138) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0479", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0479" + "name": "networkPort138ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort138ExposedToPrivateAz", + "portNumber": 138, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOS Datagram Service (Tcp:138) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0479", + "id": "AC_AZURE_0479", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0480.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0480.json index 45036febf..a345d5f07 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0480.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0480.json @@ -1,23 +1,20 @@ { - "name": "networkPort138ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort138ExposedToPublicAz", - "portNumber": 138, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBIOS Datagram Service (Tcp:138) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0480", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0480" + "name": "networkPort138ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort138ExposedToPublicAz", + "portNumber": 138, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBIOS Datagram Service (Tcp:138) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0480", + "id": "AC_AZURE_0480", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0481.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0481.json index aabb0c129..6042ff039 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0481.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0481.json @@ -1,23 +1,20 @@ { - "name": "networkPort138ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort138ExposedToInternetAz", - "portNumber": 138, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure NetBIOS Datagram Service (Tcp:138) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0481", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0481" + "name": "networkPort138ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort138ExposedToInternetAz", + "portNumber": 138, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure NetBIOS Datagram Service (Tcp:138) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0481", + "id": "AC_AZURE_0481", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0482.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0482.json index 76a4a056b..ccd67ae67 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0482.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0482.json @@ -1,23 +1,20 @@ { - "name": "networkPort137ExposedToPrivateUAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort137ExposedToPrivateUAz", - "portNumber": 137, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOS Name Service (Udp:137) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0482", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0482" + "name": "networkPort137ExposedToPrivateUAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort137ExposedToPrivateUAz", + "portNumber": 137, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOS Name Service (Udp:137) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0482", + "id": "AC_AZURE_0482", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0483.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0483.json index 978492371..052c4ee23 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0483.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0483.json @@ -1,23 +1,20 @@ { - "name": "networkPort137ExposedToPublicUAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort137ExposedToPublicUAz", - "portNumber": 137, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBIOS Name Service (Udp:137) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0483", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0483" + "name": "networkPort137ExposedToPublicUAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort137ExposedToPublicUAz", + "portNumber": 137, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBIOS Name Service (Udp:137) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0483", + "id": "AC_AZURE_0483", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0484.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0484.json index 214a06c23..1009c98d4 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0484.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0484.json @@ -1,23 +1,20 @@ { - "name": "networkPort137ExposedToInternetUAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort137ExposedToInternetUAz", - "portNumber": 137, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure NetBIOS Name Service (Udp:137) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0484", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0484" + "name": "networkPort137ExposedToInternetUAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort137ExposedToInternetUAz", + "portNumber": 137, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure NetBIOS Name Service (Udp:137) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0484", + "id": "AC_AZURE_0484", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0485.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0485.json index 549cc5e24..aca4f4199 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0485.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0485.json @@ -1,23 +1,20 @@ { - "name": "networkPort137ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort137ExposedToPrivateAz", - "portNumber": 137, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure NetBIOS Name Service (Tcp:137) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0485", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0485" + "name": "networkPort137ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort137ExposedToPrivateAz", + "portNumber": 137, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure NetBIOS Name Service (Tcp:137) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0485", + "id": "AC_AZURE_0485", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0486.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0486.json index e45e48616..67fa22ba5 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0486.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0486.json @@ -1,23 +1,20 @@ { - "name": "networkPort137ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort137ExposedToPublicAz", - "portNumber": 137, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure NetBIOS Name Service (Tcp:137) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0486", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0486" + "name": "networkPort137ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort137ExposedToPublicAz", + "portNumber": 137, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure NetBIOS Name Service (Tcp:137) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0486", + "id": "AC_AZURE_0486", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0487.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0487.json index 05c85fc4a..1cbf71866 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0487.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0487.json @@ -1,23 +1,20 @@ { - "name": "networkPort137ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort137ExposedToInternetAz", - "portNumber": 137, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure NetBIOS Name Service (Tcp:137) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0487", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0487" + "name": "networkPort137ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort137ExposedToInternetAz", + "portNumber": 137, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure NetBIOS Name Service (Tcp:137) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0487", + "id": "AC_AZURE_0487", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0488.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0488.json index 8d2df0369..d2c7eee1b 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0488.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0488.json @@ -1,23 +1,20 @@ { - "name": "networkPort3306ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3306ExposedToPrivateAz", - "portNumber": 3306, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure MySQL (Tcp:3306) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0488", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0488" + "name": "networkPort3306ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort3306ExposedToPrivateAz", + "portNumber": 3306, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure MySQL (Tcp:3306) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0488", + "id": "AC_AZURE_0488", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0489.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0489.json index 66db52ac1..9c2cdb155 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0489.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0489.json @@ -1,23 +1,20 @@ { - "name": "networkPort3306ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3306ExposedToPublicAz", - "portNumber": 3306, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure MySQL (Tcp:3306) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0489", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0489" + "name": "networkPort3306ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort3306ExposedToPublicAz", + "portNumber": 3306, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure MySQL (Tcp:3306) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0489", + "id": "AC_AZURE_0489", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0490.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0490.json index dc8902e57..54d81f589 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0490.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0490.json @@ -1,23 +1,20 @@ { - "name": "networkPort3306ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort3306ExposedToInternetAz", - "portNumber": 3306, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure MySQL (Tcp:3306) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0490", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0490" + "name": "networkPort3306ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort3306ExposedToInternetAz", + "portNumber": 3306, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure MySQL (Tcp:3306) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0490", + "id": "AC_AZURE_0490", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0491.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0491.json index a32537a03..18774d5e0 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0491.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0491.json @@ -1,23 +1,20 @@ { - "name": "networkPort27018ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort27018ExposedToPrivateAz", - "portNumber": 27018, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Mongo Web Portal (Tcp:27018) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0491", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0491" + "name": "networkPort27018ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort27018ExposedToPrivateAz", + "portNumber": 27018, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Mongo Web Portal (Tcp:27018) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0491", + "id": "AC_AZURE_0491", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0492.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0492.json index c0b2756a7..8d4c5f97b 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0492.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0492.json @@ -1,23 +1,20 @@ { - "name": "networkPort27018ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort27018ExposedToPublicAz", - "portNumber": 27018, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Mongo Web Portal (Tcp:27018) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0492", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0492" + "name": "networkPort27018ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort27018ExposedToPublicAz", + "portNumber": 27018, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Mongo Web Portal (Tcp:27018) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0492", + "id": "AC_AZURE_0492", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0493.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0493.json index f3a885bb8..814084249 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0493.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0493.json @@ -1,23 +1,20 @@ { - "name": "networkPort27018ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort27018ExposedToInternetAz", - "portNumber": 27018, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Mongo Web Portal (Tcp:27018) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0493", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0493" + "name": "networkPort27018ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort27018ExposedToInternetAz", + "portNumber": 27018, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Mongo Web Portal (Tcp:27018) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0493", + "id": "AC_AZURE_0493", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0494.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0494.json index d7f6be68a..75ad249ad 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0494.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0494.json @@ -1,23 +1,20 @@ { - "name": "networkPort445ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort445ExposedToPrivateAz", - "portNumber": 445, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Microsoft-DS (Tcp:445) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0494", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0494" + "name": "networkPort445ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort445ExposedToPrivateAz", + "portNumber": 445, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Microsoft-DS (Tcp:445) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0494", + "id": "AC_AZURE_0494", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0495.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0495.json index 244674681..d499cc389 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0495.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0495.json @@ -1,23 +1,20 @@ { - "name": "networkPort445ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort445ExposedToPublicAz", - "portNumber": 445, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Microsoft-DS (Tcp:445) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0495", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0495" + "name": "networkPort445ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort445ExposedToPublicAz", + "portNumber": 445, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Microsoft-DS (Tcp:445) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0495", + "id": "AC_AZURE_0495", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0496.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0496.json index 85f99c3ee..9be610581 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0496.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0496.json @@ -1,23 +1,20 @@ { - "name": "networkPort445ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort445ExposedToInternetAz", - "portNumber": 445, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Microsoft-DS (Tcp:445) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0496", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0496" + "name": "networkPort445ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort445ExposedToInternetAz", + "portNumber": 445, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Microsoft-DS (Tcp:445) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0496", + "id": "AC_AZURE_0496", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0497.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0497.json index 06c5610bf..db8da0c9b 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0497.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0497.json @@ -1,23 +1,20 @@ { - "name": "networkPort11215ExposedToPrivateUAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11215ExposedToPrivateUAz", - "portNumber": 11215, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Memcached SSL (Udp:11215) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0497", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0497" + "name": "networkPort11215ExposedToPrivateUAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11215ExposedToPrivateUAz", + "portNumber": 11215, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Memcached SSL (Udp:11215) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0497", + "id": "AC_AZURE_0497", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0498.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0498.json index a621f2671..3bece7a21 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0498.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0498.json @@ -1,23 +1,20 @@ { - "name": "networkPort11215ExposedToPublicUAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11215ExposedToPublicUAz", - "portNumber": 11215, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Memcached SSL (Udp:11215) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0498", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0498" + "name": "networkPort11215ExposedToPublicUAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11215ExposedToPublicUAz", + "portNumber": 11215, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Memcached SSL (Udp:11215) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0498", + "id": "AC_AZURE_0498", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0499.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0499.json index 520abac85..f4bd3b6e6 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0499.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0499.json @@ -1,23 +1,20 @@ { - "name": "networkPort11215ExposedToInternetUAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11215ExposedToInternetUAz", - "portNumber": 11215, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Memcached SSL (Udp:11215) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0499", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0499" + "name": "networkPort11215ExposedToInternetUAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11215ExposedToInternetUAz", + "portNumber": 11215, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Memcached SSL (Udp:11215) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0499", + "id": "AC_AZURE_0499", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0500.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0500.json index b58e2e231..a8884ce09 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0500.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0500.json @@ -1,23 +1,20 @@ { - "name": "networkPort11214ExposedToPrivateUAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11214ExposedToPrivateUAz", - "portNumber": 11214, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Memcached SSL (Udp:11214) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0500", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0500" + "name": "networkPort11214ExposedToPrivateUAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11214ExposedToPrivateUAz", + "portNumber": 11214, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Memcached SSL (Udp:11214) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0500", + "id": "AC_AZURE_0500", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0501.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0501.json index 9bd00eb7a..102684602 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0501.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0501.json @@ -1,23 +1,20 @@ { - "name": "networkPort11214ExposedToPublicUAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11214ExposedToPublicUAz", - "portNumber": 11214, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Memcached SSL (Udp:11214) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0501", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0501" + "name": "networkPort11214ExposedToPublicUAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11214ExposedToPublicUAz", + "portNumber": 11214, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Memcached SSL (Udp:11214) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0501", + "id": "AC_AZURE_0501", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0502.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0502.json index 1aa3354ad..12452adc5 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0502.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0502.json @@ -1,23 +1,20 @@ { - "name": "networkPort11214ExposedToInternetUAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11214ExposedToInternetUAz", - "portNumber": 11214, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Memcached SSL (Udp:11214) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0502", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0502" + "name": "networkPort11214ExposedToInternetUAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11214ExposedToInternetUAz", + "portNumber": 11214, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Memcached SSL (Udp:11214) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0502", + "id": "AC_AZURE_0502", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0503.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0503.json index 2623907a9..bba93c803 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0503.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0503.json @@ -1,23 +1,20 @@ { - "name": "networkPort11215ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11215ExposedToPrivateAz", - "portNumber": 11215, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Memcached SSL (Tcp:11215) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0503", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0503" + "name": "networkPort11215ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11215ExposedToPrivateAz", + "portNumber": 11215, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Memcached SSL (Tcp:11215) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0503", + "id": "AC_AZURE_0503", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0504.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0504.json index c1b9fbf9c..0537b1239 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0504.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0504.json @@ -1,23 +1,20 @@ { - "name": "networkPort11215ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11215ExposedToPublicAz", - "portNumber": 11215, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Memcached SSL (Tcp:11215) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0504", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0504" + "name": "networkPort11215ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11215ExposedToPublicAz", + "portNumber": 11215, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Memcached SSL (Tcp:11215) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0504", + "id": "AC_AZURE_0504", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0505.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0505.json index 4e6e850e2..9c52e66c0 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0505.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0505.json @@ -1,23 +1,20 @@ { - "name": "networkPort11215ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11215ExposedToInternetAz", - "portNumber": 11215, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Memcached SSL (Tcp:11215) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0505", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0505" + "name": "networkPort11215ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11215ExposedToInternetAz", + "portNumber": 11215, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Memcached SSL (Tcp:11215) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0505", + "id": "AC_AZURE_0505", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0506.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0506.json index ca746dfee..a979b89f0 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0506.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0506.json @@ -1,23 +1,20 @@ { - "name": "networkPort11214ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11214ExposedToPrivateAz", - "portNumber": 11214, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Memcached SSL (Tcp:11214) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0506", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0506" + "name": "networkPort11214ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11214ExposedToPrivateAz", + "portNumber": 11214, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Memcached SSL (Tcp:11214) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0506", + "id": "AC_AZURE_0506", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0507.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0507.json index c2fbbb01e..48b4be942 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0507.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0507.json @@ -1,23 +1,20 @@ { - "name": "networkPort11214ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11214ExposedToPublicAz", - "portNumber": 11214, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Memcached SSL (Tcp:11214) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0507", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0507" + "name": "networkPort11214ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11214ExposedToPublicAz", + "portNumber": 11214, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Memcached SSL (Tcp:11214) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0507", + "id": "AC_AZURE_0507", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0508.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0508.json index 7ab565fe2..45f86399e 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0508.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0508.json @@ -1,23 +1,20 @@ { - "name": "networkPort11214ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort11214ExposedToInternetAz", - "portNumber": 11214, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Memcached SSL (Tcp:11214) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0508", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0508" + "name": "networkPort11214ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort11214ExposedToInternetAz", + "portNumber": 11214, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Memcached SSL (Tcp:11214) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0508", + "id": "AC_AZURE_0508", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0509.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0509.json index 8ef04d9e9..827664a00 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0509.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0509.json @@ -1,23 +1,20 @@ { - "name": "networkPort1433ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1433ExposedToPrivateAz", - "portNumber": 1433, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure MSSQL Server (Tcp:1433) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0509", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0509" + "name": "networkPort1433ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort1433ExposedToPrivateAz", + "portNumber": 1433, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure MSSQL Server (Tcp:1433) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0509", + "id": "AC_AZURE_0509", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0510.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0510.json index 50aeed206..6001507b5 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0510.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0510.json @@ -1,23 +1,20 @@ { - "name": "networkPort1433ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1433ExposedToPublicAz", - "portNumber": 1433, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure MSSQL Server (Tcp:1433) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0510", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0510" + "name": "networkPort1433ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort1433ExposedToPublicAz", + "portNumber": 1433, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure MSSQL Server (Tcp:1433) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0510", + "id": "AC_AZURE_0510", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0511.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0511.json index 00711dc3c..230b6cefc 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0511.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0511.json @@ -1,23 +1,20 @@ { - "name": "networkPort1433ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1433ExposedToInternetAz", - "portNumber": 1433, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure MSSQL Server (Tcp:1433) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0511", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0511" + "name": "networkPort1433ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort1433ExposedToInternetAz", + "portNumber": 1433, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure MSSQL Server (Tcp:1433) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0511", + "id": "AC_AZURE_0511", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0512.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0512.json index d9b680611..d9f948e27 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0512.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0512.json @@ -1,23 +1,20 @@ { - "name": "networkPort135ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort135ExposedToPrivateAz", - "portNumber": 135, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure MSSQL Debugger (Tcp:135) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0512", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0512" + "name": "networkPort135ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort135ExposedToPrivateAz", + "portNumber": 135, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure MSSQL Debugger (Tcp:135) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0512", + "id": "AC_AZURE_0512", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0513.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0513.json index 9a9664152..83590c0b3 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0513.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0513.json @@ -1,23 +1,20 @@ { - "name": "networkPort135ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort135ExposedToPublicAz", - "portNumber": 135, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure MSSQL Debugger (Tcp:135) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0513", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0513" + "name": "networkPort135ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort135ExposedToPublicAz", + "portNumber": 135, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure MSSQL Debugger (Tcp:135) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0513", + "id": "AC_AZURE_0513", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0514.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0514.json index dc2e2c6d3..2da6bb234 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0514.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0514.json @@ -1,23 +1,20 @@ { - "name": "networkPort135ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort135ExposedToInternetAz", - "portNumber": 135, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure MSSQL Debugger (Tcp:135) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0514", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0514" + "name": "networkPort135ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort135ExposedToInternetAz", + "portNumber": 135, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure MSSQL Debugger (Tcp:135) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0514", + "id": "AC_AZURE_0514", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0515.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0515.json index 3eb1017d8..4e4a9a217 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0515.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0515.json @@ -1,23 +1,20 @@ { - "name": "networkPort1434ExposedToPrivateUAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1434ExposedToPrivateUAz", - "portNumber": 1434, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure MSSQL Browser (Udp:1434) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0515", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0515" + "name": "networkPort1434ExposedToPrivateUAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort1434ExposedToPrivateUAz", + "portNumber": 1434, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure MSSQL Browser (Udp:1434) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0515", + "id": "AC_AZURE_0515", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0516.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0516.json index b4381c4dc..095545414 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0516.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0516.json @@ -1,23 +1,20 @@ { - "name": "networkPort1434ExposedToPublicUAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1434ExposedToPublicUAz", - "portNumber": 1434, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure MSSQL Browser (Udp:1434) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0516", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0516" + "name": "networkPort1434ExposedToPublicUAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort1434ExposedToPublicUAz", + "portNumber": 1434, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure MSSQL Browser (Udp:1434) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0516", + "id": "AC_AZURE_0516", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0517.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0517.json index 6f005c11b..d18226cb5 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0517.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0517.json @@ -1,23 +1,20 @@ { - "name": "networkPort1434ExposedToInternetUAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1434ExposedToInternetUAz", - "portNumber": 1434, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure MSSQL Browser (Udp:1434) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0517", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0517" + "name": "networkPort1434ExposedToInternetUAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort1434ExposedToInternetUAz", + "portNumber": 1434, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure MSSQL Browser (Udp:1434) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0517", + "id": "AC_AZURE_0517", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0518.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0518.json index 40412c3d6..f6d0938cd 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0518.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0518.json @@ -1,23 +1,20 @@ { - "name": "networkPort1434ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1434ExposedToPrivateAz", - "portNumber": 1434, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure MSSQL Admin (Tcp:1434) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0518", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0518" + "name": "networkPort1434ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort1434ExposedToPrivateAz", + "portNumber": 1434, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure MSSQL Admin (Tcp:1434) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0518", + "id": "AC_AZURE_0518", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0519.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0519.json index b0debd437..5befb6cb0 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0519.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0519.json @@ -1,23 +1,20 @@ { - "name": "networkPort1434ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1434ExposedToPublicAz", - "portNumber": 1434, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure MSSQL Admin (Tcp:1434) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0519", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0519" + "name": "networkPort1434ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort1434ExposedToPublicAz", + "portNumber": 1434, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure MSSQL Admin (Tcp:1434) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0519", + "id": "AC_AZURE_0519", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0520.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0520.json index 5733e09b7..9e023bebd 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0520.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0520.json @@ -1,23 +1,20 @@ { - "name": "networkPort1434ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort1434ExposedToInternetAz", - "portNumber": 1434, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure MSSQL Admin (Tcp:1434) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0520", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0520" + "name": "networkPort1434ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort1434ExposedToInternetAz", + "portNumber": 1434, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure MSSQL Admin (Tcp:1434) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0520", + "id": "AC_AZURE_0520", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0521.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0521.json index 904be4ddb..cccddd48d 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0521.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0521.json @@ -1,23 +1,20 @@ { - "name": "networkPort636ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort636ExposedToPrivateAz", - "portNumber": 636, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure LDAP SSL (Tcp:636) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0521", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0521" + "name": "networkPort636ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort636ExposedToPrivateAz", + "portNumber": 636, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure LDAP SSL (Tcp:636) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0521", + "id": "AC_AZURE_0521", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0522.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0522.json index e2c77b724..c72483f86 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0522.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0522.json @@ -1,23 +1,20 @@ { - "name": "networkPort636ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort636ExposedToPublicAz", - "portNumber": 636, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure LDAP SSL (Tcp:636) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0522", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0522" + "name": "networkPort636ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort636ExposedToPublicAz", + "portNumber": 636, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure LDAP SSL (Tcp:636) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0522", + "id": "AC_AZURE_0522", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0523.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0523.json index 1917eba36..9e35a8f97 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0523.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0523.json @@ -1,23 +1,20 @@ { - "name": "networkPort636ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort636ExposedToInternetAz", - "portNumber": 636, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure LDAP SSL (Tcp:636) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0523", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0523" + "name": "networkPort636ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort636ExposedToInternetAz", + "portNumber": 636, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure LDAP SSL (Tcp:636) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0523", + "id": "AC_AZURE_0523", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0524.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0524.json index 839a5d9a2..161a224f9 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0524.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0524.json @@ -1,23 +1,20 @@ { - "name": "networkPort8080ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8080ExposedToPrivateAz", - "portNumber": 8080, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Known internal web port (Tcp:8080) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0524", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0524" + "name": "networkPort8080ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort8080ExposedToPrivateAz", + "portNumber": 8080, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Known internal web port (Tcp:8080) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0524", + "id": "AC_AZURE_0524", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0525.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0525.json index 18509e509..0060658da 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0525.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0525.json @@ -1,23 +1,20 @@ { - "name": "networkPort8080ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8080ExposedToPublicAz", - "portNumber": 8080, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Known internal web port (Tcp:8080) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0525", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0525" + "name": "networkPort8080ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort8080ExposedToPublicAz", + "portNumber": 8080, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Known internal web port (Tcp:8080) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0525", + "id": "AC_AZURE_0525", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0526.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0526.json index b27bd0865..3373d4194 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0526.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0526.json @@ -1,23 +1,20 @@ { - "name": "networkPort8080ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8080ExposedToInternetAz", - "portNumber": 8080, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Known internal web port (Tcp:8080) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0526", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0526" + "name": "networkPort8080ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort8080ExposedToInternetAz", + "portNumber": 8080, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Known internal web port (Tcp:8080) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0526", + "id": "AC_AZURE_0526", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0527.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0527.json index 84006ff6b..36eebd1c8 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0527.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0527.json @@ -1,23 +1,20 @@ { - "name": "networkPort8000ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8000ExposedToPrivateAz", - "portNumber": 8000, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Known internal web port (Tcp:8000) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0527", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0527" + "name": "networkPort8000ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort8000ExposedToPrivateAz", + "portNumber": 8000, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Known internal web port (Tcp:8000) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0527", + "id": "AC_AZURE_0527", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0528.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0528.json index 6a435562d..38c96b69f 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0528.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0528.json @@ -1,23 +1,20 @@ { - "name": "networkPort8000ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8000ExposedToPublicAz", - "portNumber": 8000, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Known internal web port (Tcp:8000) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0528", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0528" + "name": "networkPort8000ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort8000ExposedToPublicAz", + "portNumber": 8000, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Known internal web port (Tcp:8000) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0528", + "id": "AC_AZURE_0528", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0529.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0529.json index c6d7a3c4d..95871f0d6 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0529.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0529.json @@ -1,23 +1,20 @@ { - "name": "networkPort8000ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort8000ExposedToInternetAz", - "portNumber": 8000, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Known internal web port (Tcp:8000) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0529", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0529" + "name": "networkPort8000ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort8000ExposedToInternetAz", + "portNumber": 8000, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Known internal web port (Tcp:8000) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0529", + "id": "AC_AZURE_0529", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0530.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0530.json index cecb57eac..bb909bbf0 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0530.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0530.json @@ -1,23 +1,20 @@ { - "name": "networkPort9000ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort9000ExposedToPrivateAz", - "portNumber": 9000, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Hadoop Name Node (Tcp:9000) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0530", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0530" + "name": "networkPort9000ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort9000ExposedToPrivateAz", + "portNumber": 9000, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Hadoop Name Node (Tcp:9000) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0530", + "id": "AC_AZURE_0530", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0531.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0531.json index bdf3300a8..3e339efe1 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0531.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0531.json @@ -1,23 +1,20 @@ { - "name": "networkPort9000ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort9000ExposedToPublicAz", - "portNumber": 9000, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Hadoop Name Node (Tcp:9000) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0531", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0531" + "name": "networkPort9000ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort9000ExposedToPublicAz", + "portNumber": 9000, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Hadoop Name Node (Tcp:9000) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0531", + "id": "AC_AZURE_0531", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0532.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0532.json index 5618e3fb4..03195a3a6 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0532.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0532.json @@ -1,23 +1,20 @@ { - "name": "networkPort9000ExposedToInternetAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort9000ExposedToInternetAz", - "portNumber": 9000, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure Hadoop Name Node (Tcp:9000) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0532", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0532" + "name": "networkPort9000ExposedToInternetAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort9000ExposedToInternetAz", + "portNumber": 9000, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure Hadoop Name Node (Tcp:9000) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0532", + "id": "AC_AZURE_0532", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0533.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0533.json index 0bad887c4..12b710921 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0533.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0533.json @@ -1,23 +1,20 @@ { - "name": "networkPort53ExposedToPrivateUAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort53ExposedToPrivateUAz", - "portNumber": 53, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure DNS (Udp:53) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0533", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0533" + "name": "networkPort53ExposedToPrivateUAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort53ExposedToPrivateUAz", + "portNumber": 53, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure DNS (Udp:53) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0533", + "id": "AC_AZURE_0533", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0534.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0534.json index 28b846711..f2e90675b 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0534.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0534.json @@ -1,23 +1,20 @@ { - "name": "networkPort53ExposedToPublicUAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort53ExposedToPublicUAz", - "portNumber": 53, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure DNS (Udp:53) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0534", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0534" + "name": "networkPort53ExposedToPublicUAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort53ExposedToPublicUAz", + "portNumber": 53, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure DNS (Udp:53) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0534", + "id": "AC_AZURE_0534", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0535.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0535.json index 8218e61a8..b3992248f 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0535.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0535.json @@ -1,23 +1,20 @@ { - "name": "networkPort53ExposedToInternetUAz", - "file": "networkPortExposedToInternetAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort53ExposedToInternetUAz", - "portNumber": 53, - "prefix": "", - "protocol": "Udp", - "suffix": "" - }, - "severity": "HIGH", - "description": "Ensure DNS (Udp:53) is not exposed to entire internet for Azure Network Security Rule", - "reference_id": "AC_AZURE_0535", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0535" + "name": "networkPort53ExposedToInternetUAz", + "file": "networkPortExposedToInternetAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort53ExposedToInternetUAz", + "portNumber": 53, + "prefix": "", + "protocol": "Udp", + "suffix": "" + }, + "severity": "HIGH", + "description": "Ensure DNS (Udp:53) is not exposed to entire internet for Azure Network Security Rule", + "reference_id": "AC_AZURE_0535", + "id": "AC_AZURE_0535", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0536.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0536.json index 52eee5ff2..8e8ef9164 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0536.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0536.json @@ -1,23 +1,20 @@ { - "name": "networkPort61621ExposedToPrivateAz", - "file": "networkPortExposedToPrivateAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort61621ExposedToPrivateAz", - "portNumber": 61621, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "LOW", - "description": "Ensure Cassandra OpsCenter (Tcp:61621) is not exposed to private hosts more than 32 for Azure Network Security Rule", - "reference_id": "AC_AZURE_0536", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0536" + "name": "networkPort61621ExposedToPrivateAz", + "file": "networkPortExposedToPrivateAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort61621ExposedToPrivateAz", + "portNumber": 61621, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "LOW", + "description": "Ensure Cassandra OpsCenter (Tcp:61621) is not exposed to private hosts more than 32 for Azure Network Security Rule", + "reference_id": "AC_AZURE_0536", + "id": "AC_AZURE_0536", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0537.json b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0537.json index 0d6d8e4dc..1f4c3081e 100644 --- a/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0537.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_security_rule/AC_AZURE_0537.json @@ -1,23 +1,20 @@ { - "name": "networkPort61621ExposedToPublicAz", - "file": "networkPortExposedToPublicAz.rego", - "policy_type": "azure", - "resource_type": { - "azurerm_network_security_rule": true, - "azurerm_network_security_group": true - }, - "template_args": { - "defaultValue": "", - "name": "networkPort61621ExposedToPublicAz", - "portNumber": 61621, - "prefix": "", - "protocol": "Tcp", - "suffix": "" - }, - "severity": "MEDIUM", - "description": "Ensure Cassandra OpsCenter (Tcp:61621) is not exposed to public for Azure Network Security Rule", - "reference_id": "AC_AZURE_0537", - "category": "Infrastructure Security", - "version": 2, - "id": "AC_AZURE_0537" + "name": "networkPort61621ExposedToPublicAz", + "file": "networkPortExposedToPublicAz.rego", + "policy_type": "azure", + "resource_type": "azurerm_network_security_rule", + "template_args": { + "defaultValue": "", + "name": "networkPort61621ExposedToPublicAz", + "portNumber": 61621, + "prefix": "", + "protocol": "Tcp", + "suffix": "" + }, + "severity": "MEDIUM", + "description": "Ensure Cassandra OpsCenter (Tcp:61621) is not exposed to public for Azure Network Security Rule", + "reference_id": "AC_AZURE_0537", + "id": "AC_AZURE_0537", + "category": "Infrastructure Security", + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/azure/azurerm_network_watcher_flow_log/accurics.azure.NS.11.json b/pkg/policies/opa/rego/azure/azurerm_network_watcher_flow_log/accurics.azure.NS.11.json index e1475b1f6..221cbab74 100755 --- a/pkg/policies/opa/rego/azure/azurerm_network_watcher_flow_log/accurics.azure.NS.11.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_watcher_flow_log/accurics.azure.NS.11.json @@ -2,9 +2,7 @@ "name": "reme_networkWatcherEnabled", "file": "networkWatcherCheck.rego", "policy_type": "azure", - "resource_type": { - "azurerm_network_watcher_flow_log": true - }, + "resource_type": "azurerm_network_watcher_flow_log", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_network_watcher_flow_log/accurics.azure.NS.342.json b/pkg/policies/opa/rego/azure/azurerm_network_watcher_flow_log/accurics.azure.NS.342.json index a813ca3f4..6846c08fb 100755 --- a/pkg/policies/opa/rego/azure/azurerm_network_watcher_flow_log/accurics.azure.NS.342.json +++ b/pkg/policies/opa/rego/azure/azurerm_network_watcher_flow_log/accurics.azure.NS.342.json @@ -2,9 +2,7 @@ "name": "logRetensionGraterThan90Days", "file": "networkWatcherCheck.rego", "policy_type": "azure", - "resource_type": { - "azurerm_network_watcher_flow_log": true - }, + "resource_type": "azurerm_network_watcher_flow_log", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.151.json b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.151.json index 0d6ea72c4..bb9f8dcc2 100755 --- a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.151.json +++ b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.151.json @@ -2,9 +2,7 @@ "name": "reme_connectionThrottling", "file": "connectionThrottling.rego", "policy_type": "azure", - "resource_type": { - "azurerm_postgresql_configuration": true - }, + "resource_type": "azurerm_postgresql_configuration", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.152.json b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.152.json index 994b6e878..175459365 100755 --- a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.152.json +++ b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.152.json @@ -2,9 +2,7 @@ "name": "reme_logConnections", "file": "logConnections.rego", "policy_type": "azure", - "resource_type": { - "azurerm_postgresql_configuration": true - }, + "resource_type": "azurerm_postgresql_configuration", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.153.json b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.153.json index 5e7cc88a0..26db9c360 100755 --- a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.153.json +++ b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.153.json @@ -2,9 +2,7 @@ "name": "reme_logDisconnections", "file": "logDisconnections.rego", "policy_type": "azure", - "resource_type": { - "azurerm_postgresql_configuration": true - }, + "resource_type": "azurerm_postgresql_configuration", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.154.json b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.154.json index 90545b6e3..b5b485400 100755 --- a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.154.json +++ b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.154.json @@ -2,9 +2,7 @@ "name": "reme_logDuration", "file": "logDuration.rego", "policy_type": "azure", - "resource_type": { - "azurerm_postgresql_configuration": true - }, + "resource_type": "azurerm_postgresql_configuration", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.155.json b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.155.json index fc46e92ed..f660d9290 100755 --- a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.155.json +++ b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.155.json @@ -2,9 +2,7 @@ "name": "logRetentionPsql", "file": "logRetentionPsql.rego", "policy_type": "azure", - "resource_type": { - "azurerm_postgresql_configuration": true - }, + "resource_type": "azurerm_postgresql_configuration", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.364.json b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.364.json index 2e72dddb5..40f492785 100755 --- a/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.364.json +++ b/pkg/policies/opa/rego/azure/azurerm_postgresql_configuration/accurics.azure.LOG.364.json @@ -2,9 +2,7 @@ "name": "postgreSqlLogsEnabled", "file": "postgreSqlLogsEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_postgresql_configuration": true - }, + "resource_type": "azurerm_postgresql_configuration", "template_args": null, "severity": "MEDIUM", "description": "Ensure server parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server", diff --git a/pkg/policies/opa/rego/azure/azurerm_postgresql_server/accurics.azure.BDR.163.json b/pkg/policies/opa/rego/azure/azurerm_postgresql_server/accurics.azure.BDR.163.json index 85a79e7d7..1bf81c572 100755 --- a/pkg/policies/opa/rego/azure/azurerm_postgresql_server/accurics.azure.BDR.163.json +++ b/pkg/policies/opa/rego/azure/azurerm_postgresql_server/accurics.azure.BDR.163.json @@ -2,9 +2,7 @@ "name": "reme_geoRedundancyDisabled", "file": "geoRedundancyDisabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_postgresql_server": true - }, + "resource_type": "azurerm_postgresql_server", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_postgresql_server/accurics.azure.EKM.1.json b/pkg/policies/opa/rego/azure/azurerm_postgresql_server/accurics.azure.EKM.1.json index f95f83f21..c47c1563d 100755 --- a/pkg/policies/opa/rego/azure/azurerm_postgresql_server/accurics.azure.EKM.1.json +++ b/pkg/policies/opa/rego/azure/azurerm_postgresql_server/accurics.azure.EKM.1.json @@ -2,9 +2,7 @@ "name": "reme_sslEnforceDisabled", "file": "sslEnforceDisabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_postgresql_server": true - }, + "resource_type": "azurerm_postgresql_server", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.EKM.23.json b/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.EKM.23.json index a4a2afc8c..96f2cbbc0 100755 --- a/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.EKM.23.json +++ b/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.EKM.23.json @@ -2,9 +2,7 @@ "name": "reme_nonSslEnabled", "file": "nonSslEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_redis_cache": true - }, + "resource_type": "azurerm_redis_cache", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.13.json b/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.13.json index 5ed6fcba0..24231861c 100755 --- a/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.13.json +++ b/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.13.json @@ -2,9 +2,7 @@ "name": "reme_redisCacheNoUpdatePatchSchedule", "file": "redisCacheNoUpdatePatchSchedule.rego", "policy_type": "azure", - "resource_type": { - "azurerm_redis_cache": true - }, + "resource_type": "azurerm_redis_cache", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.166.json b/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.166.json index 0320faab0..5ebe7521e 100755 --- a/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.166.json +++ b/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.166.json @@ -2,9 +2,7 @@ "name": "reme_allowLessHosts", "file": "allowLessHosts.rego", "policy_type": "azure", - "resource_type": { - "azurerm_redis_cache": true - }, + "resource_type": "azurerm_redis_cache", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.30.json b/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.30.json index f557fc25c..93feb62f4 100755 --- a/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.30.json +++ b/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.30.json @@ -2,10 +2,7 @@ "name": "reme_entirelyAccessible", "file": "publiclyAccessible.rego", "policy_type": "azure", - "resource_type": { - "azurerm_redis_cache": true, - "azurerm_redis_firewall_rule": true - }, + "resource_type": "azurerm_redis_cache", "template_args": { "isEntire": true, "name": "entirelyAccessible", diff --git a/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.31.json b/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.31.json index 82f7f44d0..2cf4b24c1 100755 --- a/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.31.json +++ b/pkg/policies/opa/rego/azure/azurerm_redis_cache/accurics.azure.NS.31.json @@ -2,10 +2,7 @@ "name": "reme_publiclyAccessible", "file": "publiclyAccessible.rego", "policy_type": "azure", - "resource_type": { - "azurerm_redis_cache": true, - "azurerm_redis_firewall_rule": true - }, + "resource_type": "azurerm_redis_cache", "template_args": { "isEntire": false, "name": "publiclyAccessible", diff --git a/pkg/policies/opa/rego/azure/azurerm_resource_group/accurics.azure.NS.272.json b/pkg/policies/opa/rego/azure/azurerm_resource_group/accurics.azure.NS.272.json index 71dde6d95..3b11a08f2 100755 --- a/pkg/policies/opa/rego/azure/azurerm_resource_group/accurics.azure.NS.272.json +++ b/pkg/policies/opa/rego/azure/azurerm_resource_group/accurics.azure.NS.272.json @@ -2,10 +2,7 @@ "name": "reme_resourceGroupLock", "file": "resourceGroupLock.rego", "policy_type": "azure", - "resource_type": { - "azurerm_resource_group": true, - "azurerm_management_lock": true - }, + "resource_type": "azurerm_resource_group", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_role_assignment/accurics.azure.IAM.388.json b/pkg/policies/opa/rego/azure/azurerm_role_assignment/accurics.azure.IAM.388.json index 8441b99bf..f9dee9d4f 100755 --- a/pkg/policies/opa/rego/azure/azurerm_role_assignment/accurics.azure.IAM.388.json +++ b/pkg/policies/opa/rego/azure/azurerm_role_assignment/accurics.azure.IAM.388.json @@ -2,9 +2,7 @@ "name": "reme_checkGuestUser", "file": "checkGuestUser.rego", "policy_type": "azure", - "resource_type": { - "azurerm_role_assignment": true - }, + "resource_type": "azurerm_role_assignment", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_security_center_contact/accurics.azure.MON.353.json b/pkg/policies/opa/rego/azure/azurerm_security_center_contact/accurics.azure.MON.353.json index fe04849c3..76954e202 100755 --- a/pkg/policies/opa/rego/azure/azurerm_security_center_contact/accurics.azure.MON.353.json +++ b/pkg/policies/opa/rego/azure/azurerm_security_center_contact/accurics.azure.MON.353.json @@ -2,9 +2,7 @@ "name": "emailAlertsSecurityCenterContact", "file": "emailAlertsSecurityCenterContact.rego", "policy_type": "azure", - "resource_type": { - "azurerm_security_center_contact": true - }, + "resource_type": "azurerm_security_center_contact", "template_args": null, "severity": "MEDIUM", "description": "Ensure that 'Send email notification for high severity alerts' is set to 'On'", diff --git a/pkg/policies/opa/rego/azure/azurerm_security_center_subscription_pricing/accurics.azure.OPS.349.json b/pkg/policies/opa/rego/azure/azurerm_security_center_subscription_pricing/accurics.azure.OPS.349.json index d713d58e5..738646aa9 100755 --- a/pkg/policies/opa/rego/azure/azurerm_security_center_subscription_pricing/accurics.azure.OPS.349.json +++ b/pkg/policies/opa/rego/azure/azurerm_security_center_subscription_pricing/accurics.azure.OPS.349.json @@ -2,9 +2,7 @@ "name": "reme_securityCenterPrincingTier", "file": "securityCenterPrincingTier.rego", "policy_type": "azure", - "resource_type": { - "azurerm_security_center_subscription_pricing": true - }, + "resource_type": "azurerm_security_center_subscription_pricing", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_sql_active_directory_administrator/accurics.azure.IAM.137.json b/pkg/policies/opa/rego/azure/azurerm_sql_active_directory_administrator/accurics.azure.IAM.137.json index 164229416..b9648ff01 100755 --- a/pkg/policies/opa/rego/azure/azurerm_sql_active_directory_administrator/accurics.azure.IAM.137.json +++ b/pkg/policies/opa/rego/azure/azurerm_sql_active_directory_administrator/accurics.azure.IAM.137.json @@ -2,9 +2,7 @@ "name": "reme_sqlServerADPredictableAccount", "file": "sqlServerADPredictableAccount.rego", "policy_type": "azure", - "resource_type": { - "azurerm_sql_active_directory_administrator": true - }, + "resource_type": "azurerm_sql_active_directory_administrator", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_sql_database/accurics.azure.MON.157.json b/pkg/policies/opa/rego/azure/azurerm_sql_database/accurics.azure.MON.157.json index 7053d3a17..fbd39c0c6 100755 --- a/pkg/policies/opa/rego/azure/azurerm_sql_database/accurics.azure.MON.157.json +++ b/pkg/policies/opa/rego/azure/azurerm_sql_database/accurics.azure.MON.157.json @@ -2,9 +2,7 @@ "name": "reme_checkAuditEnabled", "file": "checkAuditEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_sql_database": true - }, + "resource_type": "azurerm_sql_database", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.169.json b/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.169.json index 1089c69af..cb86f62e1 100755 --- a/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.169.json +++ b/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.169.json @@ -2,9 +2,7 @@ "name": "reme_moreHostsAllowed", "file": "moreHostsAllowed.rego", "policy_type": "azure", - "resource_type": { - "azurerm_sql_firewall_rule": true - }, + "resource_type": "azurerm_sql_firewall_rule", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.21.json b/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.21.json index f84c02dd0..106fff2c3 100755 --- a/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.21.json +++ b/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.21.json @@ -2,9 +2,7 @@ "name": "reme_sqlIngressAccess", "file": "checkPublicAccessNotAllow.rego", "policy_type": "azure", - "resource_type": { - "azurerm_sql_firewall_rule": true - }, + "resource_type": "azurerm_sql_firewall_rule", "template_args": { "isEntire": false, "name": "sqlIngressAccess", diff --git a/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.5.json b/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.5.json index 3897064d5..096e47bf8 100755 --- a/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.5.json +++ b/pkg/policies/opa/rego/azure/azurerm_sql_firewall_rule/accurics.azure.NS.5.json @@ -2,9 +2,7 @@ "name": "reme_sqlPublicAccess", "file": "checkPublicAccessNotAllow.rego", "policy_type": "azure", - "resource_type": { - "azurerm_sql_firewall_rule": true - }, + "resource_type": "azurerm_sql_firewall_rule", "template_args": { "isEntire": true, "name": "sqlPublicAccess", diff --git a/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.IAM.10.json b/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.IAM.10.json index 2280c9b52..e34bd6b00 100755 --- a/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.IAM.10.json +++ b/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.IAM.10.json @@ -2,9 +2,7 @@ "name": "reme_sqlServerADAdminConfigured", "file": "sqlServerADAdminConfigured.rego", "policy_type": "azure", - "resource_type": { - "azurerm_sql_server": true - }, + "resource_type": "azurerm_sql_server", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.IAM.138.json b/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.IAM.138.json index 0b0db8982..59650ec3b 100755 --- a/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.IAM.138.json +++ b/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.IAM.138.json @@ -2,11 +2,7 @@ "name": "reme_sqlServerPredictableAccount", "file": "sqlServerPredictableAccount.rego", "policy_type": "azure", - "resource_type": { - "azurerm_sql_server": true, - "azurerm_mysql_server": true, - "azurerm_postgresql_server": true - }, + "resource_type": "azurerm_sql_server", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.LOG.356.json b/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.LOG.356.json index a10706a26..98d30f59b 100755 --- a/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.LOG.356.json +++ b/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.LOG.356.json @@ -2,9 +2,7 @@ "name": "sqlAuditingRetention", "file": "sqlAuditingRetention.rego", "policy_type": "azure", - "resource_type": { - "azurerm_sql_server": true - }, + "resource_type": "azurerm_sql_server", "template_args": null, "severity": "LOW", "description": "Ensure that 'Auditing' Retention is 'greater than 90 days' for SQL servers.", diff --git a/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.MON.354.json b/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.MON.354.json index bcbde3f91..f4313a215 100755 --- a/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.MON.354.json +++ b/pkg/policies/opa/rego/azure/azurerm_sql_server/accurics.azure.MON.354.json @@ -2,9 +2,7 @@ "name": "sqlServerAuditingEnabled", "file": "sqlServerAuditingEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_sql_server": true - }, + "resource_type": "azurerm_sql_server", "template_args": null, "severity": "MEDIUM", "description": "Ensure that 'Auditing' is set to 'On' for SQL servers", diff --git a/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.EKM.7.json b/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.EKM.7.json index 0cf814ef5..79e5787dd 100755 --- a/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.EKM.7.json +++ b/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.EKM.7.json @@ -2,9 +2,7 @@ "name": "reme_storageAccountEnableHttps", "file": "storageAccountEnableHttps.rego", "policy_type": "azure", - "resource_type": { - "azurerm_storage_account": true - }, + "resource_type": "azurerm_storage_account", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.NS.2.json b/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.NS.2.json index 34cbd51fe..8c0bb6d02 100755 --- a/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.NS.2.json +++ b/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.NS.2.json @@ -2,9 +2,7 @@ "name": "reme_storageAccountTrustedMicrosoftServicesEnabled", "file": "storageAccountTrustedMicrosoftServicesEnabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_storage_account": true - }, + "resource_type": "azurerm_storage_account", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.NS.4.json b/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.NS.4.json index 51f31920e..bac58bdce 100755 --- a/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.NS.4.json +++ b/pkg/policies/opa/rego/azure/azurerm_storage_account/accurics.azure.NS.4.json @@ -2,9 +2,7 @@ "name": "reme_storageAccountOpenToPublic", "file": "storageAccountOpenToPublic.rego", "policy_type": "azure", - "resource_type": { - "azurerm_storage_account": true - }, + "resource_type": "azurerm_storage_account", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_storage_account_network_rules/accurics.azure.NS.370.json b/pkg/policies/opa/rego/azure/azurerm_storage_account_network_rules/accurics.azure.NS.370.json index f6b74b57e..397132648 100755 --- a/pkg/policies/opa/rego/azure/azurerm_storage_account_network_rules/accurics.azure.NS.370.json +++ b/pkg/policies/opa/rego/azure/azurerm_storage_account_network_rules/accurics.azure.NS.370.json @@ -2,9 +2,7 @@ "name": "defStorageAccessDisabled", "file": "defStorageAccessDisabled.rego", "policy_type": "azure", - "resource_type": { - "azurerm_storage_account_network_rules": true - }, + "resource_type": "azurerm_storage_account_network_rules", "template_args": null, "severity": "MEDIUM", "description": "Ensure default network access rule for Storage Accounts is set to deny.", diff --git a/pkg/policies/opa/rego/azure/azurerm_storage_container/accurics.azure.IAM.368.json b/pkg/policies/opa/rego/azure/azurerm_storage_container/accurics.azure.IAM.368.json index 148157f49..6512e4235 100755 --- a/pkg/policies/opa/rego/azure/azurerm_storage_container/accurics.azure.IAM.368.json +++ b/pkg/policies/opa/rego/azure/azurerm_storage_container/accurics.azure.IAM.368.json @@ -2,9 +2,7 @@ "name": "reme_checkStorageContainerAccess", "file": "checkStorageContainerAccess.rego", "policy_type": "azure", - "resource_type": { - "azurerm_storage_container": true - }, + "resource_type": "azurerm_storage_container", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/azure/azurerm_virtual_network/accurics.azure.NS.161.json b/pkg/policies/opa/rego/azure/azurerm_virtual_network/accurics.azure.NS.161.json index 01cebd0a2..0feecf54e 100755 --- a/pkg/policies/opa/rego/azure/azurerm_virtual_network/accurics.azure.NS.161.json +++ b/pkg/policies/opa/rego/azure/azurerm_virtual_network/accurics.azure.NS.161.json @@ -2,9 +2,7 @@ "name": "reme_noSecurityGroupAssociated", "file": "noSecurityGroupAssociated.rego", "policy_type": "azure", - "resource_type": { - "azurerm_virtual_network": true - }, + "resource_type": "azurerm_virtual_network", "template_args": { "prefix": "reme_" }, diff --git a/pkg/policies/opa/rego/docker/docker_expose/AC_DOCKER_0011.json b/pkg/policies/opa/rego/docker/docker_expose/AC_DOCKER_0011.json index a3418746a..d2e9fd8b0 100644 --- a/pkg/policies/opa/rego/docker/docker_expose/AC_DOCKER_0011.json +++ b/pkg/policies/opa/rego/docker/docker_expose/AC_DOCKER_0011.json @@ -2,18 +2,16 @@ "name": "UNIXPortsOutOfRange", "file": "UNIXPortsOutOfRange.rego", "policy_type": "docker", - "resource_type": { - "docker_expose": true - }, + "resource_type": "docker_expose", "template_args": { - "name": "UNIXPortsOutOfRange", "prefix": "", - "suffix": "" + "suffix": "", + "name": "UNIXPortsOutOfRange" }, "severity": "HIGH", "description": "Ensure range of ports is from 0 to 65535", "reference_id": "AC_DOCKER_0011", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0011" + "id": "AC_DOCKER_0011", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/docker/docker_from/AC_DOCKER_0001.json b/pkg/policies/opa/rego/docker/docker_from/AC_DOCKER_0001.json index bdb223b34..d458f05e8 100644 --- a/pkg/policies/opa/rego/docker/docker_from/AC_DOCKER_0001.json +++ b/pkg/policies/opa/rego/docker/docker_from/AC_DOCKER_0001.json @@ -2,18 +2,16 @@ "name": "docFilePlatformFlag", "file": "docFilePlatformFlag.rego", "policy_type": "docker", - "resource_type": { - "docker_from": true - }, + "resource_type": "docker_from", "template_args": { - "name": "docFilePlatformFlag", "prefix": "", - "suffix": "" + "suffix": "", + "name": "docFilePlatformFlag" }, "severity": "MEDIUM", "description": "Ensure platform flag with FROM command is not used for Docker file", "reference_id": "AC_DOCKER_0001", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0001" + "id": "AC_DOCKER_0001", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0002.json b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0002.json index d7b65c391..9f4602f6c 100644 --- a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0002.json +++ b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0002.json @@ -2,18 +2,16 @@ "name": "runUsingApt", "file": "runUsingApt.rego", "policy_type": "docker", - "resource_type": { - "docker_run": true - }, + "resource_type": "docker_run", "template_args": { - "name": "runUsingApt", "prefix": "", - "suffix": "" + "suffix": "", + "name": "runUsingApt" }, "severity": "MEDIUM", "description": "Ensure apt is not used with RUN command for Docker file", "reference_id": "AC_DOCKER_0002", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0002" + "id": "AC_DOCKER_0002", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0003.json b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0003.json index 58712f2a2..1699ecebc 100644 --- a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0003.json +++ b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0003.json @@ -2,18 +2,16 @@ "name": "runUsingDnfUpdate", "file": "runUsingDnfUpdate.rego", "policy_type": "docker", - "resource_type": { - "docker_run": true - }, + "resource_type": "docker_run", "template_args": { - "name": "runUsingDnfUpdate", "prefix": "", - "suffix": "" + "suffix": "", + "name": "runUsingDnfUpdate" }, "severity": "MEDIUM", "description": "Ensure dnf Update is not used for Docker file", "reference_id": "AC_DOCKER_0003", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0003" + "id": "AC_DOCKER_0003", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0004.json b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0004.json index ea067fe57..eb1e286c0 100644 --- a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0004.json +++ b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0004.json @@ -2,18 +2,16 @@ "name": "yumInstallAllowInput", "file": "yumInstallAllowInput.rego", "policy_type": "docker", - "resource_type": { - "docker_run": true - }, + "resource_type": "docker_run", "template_args": { - "name": "yumInstallAllowInput", "prefix": "", - "suffix": "" + "suffix": "", + "name": "yumInstallAllowInput" }, "severity": "MEDIUM", "description": "Ensure yum install allow manual input with RUN command for Docker file", "reference_id": "AC_DOCKER_0004", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0004" + "id": "AC_DOCKER_0004", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0005.json b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0005.json index f5b7a66e0..9b94358ad 100644 --- a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0005.json +++ b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0005.json @@ -2,18 +2,16 @@ "name": "lastUserRoot", "file": "lastUserRoot.rego", "policy_type": "docker", - "resource_type": { - "docker_run": true - }, + "resource_type": "docker_run", "template_args": { - "name": "lastUserRoot", "prefix": "", - "suffix": "" + "suffix": "", + "name": "lastUserRoot" }, "severity": "MEDIUM", "description": "Ensure root with RUN command is not used for Docker file", "reference_id": "AC_DOCKER_0005", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0005" + "id": "AC_DOCKER_0005", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0007.json b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0007.json index a5673c047..f282808e6 100644 --- a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0007.json +++ b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0007.json @@ -2,9 +2,7 @@ "name": "runWithSudo", "file": "runWithSudo.rego", "policy_type": "docker", - "resource_type": { - "docker_run": true - }, + "resource_type": "docker_run", "template_args": { "prefix": "", "suffix": "" @@ -13,6 +11,6 @@ "description": "Ensure to avoid RUN with sudo command", "reference_id": "AC_DOCKER_0007", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0007" + "id": "AC_DOCKER_0007", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0009.json b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0009.json index 1f5a7d6be..ec6e499b7 100644 --- a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0009.json +++ b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0009.json @@ -2,9 +2,7 @@ "name": "yumCleanAllMissing", "file": "yumCleanAllMissing.rego", "policy_type": "docker", - "resource_type": { - "docker_run": true - }, + "resource_type": "docker_run", "template_args": { "prefix": "", "suffix": "" @@ -13,6 +11,6 @@ "description": "Ensure Yum Clean All is used after Yum Install", "reference_id": "AC_DOCKER_0009", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0009" + "id": "AC_DOCKER_0009", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0010.json b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0010.json index c0cca3c41..bf3948505 100644 --- a/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0010.json +++ b/pkg/policies/opa/rego/docker/docker_run/AC_DOCKER_0010.json @@ -2,9 +2,7 @@ "name": "pipUnpinnedVersion", "file": "pipUnpinnedVersion.rego", "policy_type": "docker", - "resource_type": { - "docker_run": true - }, + "resource_type": "docker_run", "template_args": { "prefix": "", "suffix": "" @@ -13,6 +11,6 @@ "description": "Ensure Pinned Pip Package Version", "reference_id": "AC_DOCKER_0010", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0010" + "id": "AC_DOCKER_0010", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/docker/docker_workdir/AC_DOCKER_0013.json b/pkg/policies/opa/rego/docker/docker_workdir/AC_DOCKER_0013.json index 9030998bf..abc22106b 100644 --- a/pkg/policies/opa/rego/docker/docker_workdir/AC_DOCKER_0013.json +++ b/pkg/policies/opa/rego/docker/docker_workdir/AC_DOCKER_0013.json @@ -2,18 +2,16 @@ "name": "workdir", "file": "workdir.rego", "policy_type": "docker", - "resource_type": { - "docker_workdir": true - }, + "resource_type": "docker_workdir", "template_args": { - "name": "workdir", "prefix": "", - "suffix": "" + "suffix": "", + "name": "workdir" }, "severity": "HIGH", "description": "Ensure the use absolute paths for your WORKDIR.", "reference_id": "AC_DOCKER_0013", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0013" + "id": "AC_DOCKER_0013", + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/github_repository/accurics.gcp.IAM.145.json b/pkg/policies/opa/rego/gcp/github_repository/accurics.gcp.IAM.145.json index 8cab6e420..679b5b63c 100755 --- a/pkg/policies/opa/rego/gcp/github_repository/accurics.gcp.IAM.145.json +++ b/pkg/policies/opa/rego/gcp/github_repository/accurics.gcp.IAM.145.json @@ -2,9 +2,7 @@ "name": "privateRepoEnabled", "file": "privateRepoEnabled.rego", "policy_type": "gcp", - "resource_type": { - "github_repository": true - }, + "resource_type": "github_repository", "template_args": null, "severity": "MEDIUM", "description": "Repository is Not Private.", diff --git a/pkg/policies/opa/rego/gcp/google_bigquery_dataset/accurics.gcp.IAM.106.json b/pkg/policies/opa/rego/gcp/google_bigquery_dataset/accurics.gcp.IAM.106.json index 977110670..b4cfd699e 100755 --- a/pkg/policies/opa/rego/gcp/google_bigquery_dataset/accurics.gcp.IAM.106.json +++ b/pkg/policies/opa/rego/gcp/google_bigquery_dataset/accurics.gcp.IAM.106.json @@ -2,9 +2,7 @@ "name": "bqDatasetPubliclyAccessible", "file": "bqDatasetPubliclyAccessible.rego", "policy_type": "gcp", - "resource_type": { - "google_bigquery_dataset": true - }, + "resource_type": "google_bigquery_dataset", "template_args": null, "severity": "HIGH", "description": "BigQuery datasets may be anonymously or publicly accessible.", diff --git a/pkg/policies/opa/rego/gcp/google_compute_disk/accurics.gcp.EKM.131.json b/pkg/policies/opa/rego/gcp/google_compute_disk/accurics.gcp.EKM.131.json index d6678dab5..d94184b7a 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_disk/accurics.gcp.EKM.131.json +++ b/pkg/policies/opa/rego/gcp/google_compute_disk/accurics.gcp.EKM.131.json @@ -2,9 +2,7 @@ "name": "vmEncryptedwithCsek", "file": "vmEncryptedwithCsek.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_disk": true - }, + "resource_type": "google_compute_disk", "template_args": null, "severity": "MEDIUM", "description": "Ensure VM disks for critical VMs are encrypted with Customer Supplied Encryption Keys (CSEK) .", diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0042.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0042.json index 989c5483a..cfd16c3be 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0042.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0042.json @@ -2,9 +2,7 @@ "name": "networkPort61621ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort61621ExposedToPrivateGCP", "portNumber": 61621, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Cassandra OpsCenter agent (TCP:61621) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0042", + "id": "AC_GCP_0042", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0042" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0043.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0043.json index 341249194..da00c2027 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0043.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0043.json @@ -2,9 +2,7 @@ "name": "networkPort61621ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort61621ExposedToPublicGCP", "portNumber": 61621, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Cassandra OpsCenter agent (TCP:61621) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0043", + "id": "AC_GCP_0043", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0043" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0044.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0044.json index 8422f417d..1f29b709f 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0044.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0044.json @@ -2,9 +2,7 @@ "name": "networkPort61621ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort61621ExposedToInternetGCP", "portNumber": 61621, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Cassandra OpsCenter agent (TCP:61621) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0044", + "id": "AC_GCP_0044", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0044" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0045.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0045.json index 9dcf79e83..c5c49e238 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0045.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0045.json @@ -2,9 +2,7 @@ "name": "networkPort27018ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort27018ExposedToPrivateGCP", "portNumber": 27018, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Mongo Web Portal (TCP:27018) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0045", + "id": "AC_GCP_0045", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0045" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0046.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0046.json index 1d6d4788f..1a379018b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0046.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0046.json @@ -2,9 +2,7 @@ "name": "networkPort27018ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort27018ExposedToPublicGCP", "portNumber": 27018, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Mongo Web Portal (TCP:27018) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0046", + "id": "AC_GCP_0046", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0046" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0047.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0047.json index 644a67d05..04cc1bf9f 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0047.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0047.json @@ -2,9 +2,7 @@ "name": "networkPort27018ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort27018ExposedToInternetGCP", "portNumber": 27018, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Mongo Web Portal (TCP:27018) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0047", + "id": "AC_GCP_0047", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0047" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0048.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0048.json index dc70cf88c..7d471c686 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0048.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0048.json @@ -2,9 +2,7 @@ "name": "networkPort8140ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8140ExposedToPrivateGCP", "portNumber": 8140, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Puppet Master (TCP:8140) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0048", + "id": "AC_GCP_0048", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0048" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0049.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0049.json index 6a5db5bad..3fd171120 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0049.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0049.json @@ -2,9 +2,7 @@ "name": "networkPort8140ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8140ExposedToPublicGCP", "portNumber": 8140, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Puppet Master (TCP:8140) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0049", + "id": "AC_GCP_0049", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0049" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0050.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0050.json index 0e8234835..80c631384 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0050.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0050.json @@ -2,9 +2,7 @@ "name": "networkPort8140ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8140ExposedToInternetGCP", "portNumber": 8140, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Puppet Master (TCP:8140) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0050", + "id": "AC_GCP_0050", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0050" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0051.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0051.json index ca5b1ee17..76066da39 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0051.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0051.json @@ -2,9 +2,7 @@ "name": "networkPort2382ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2382ExposedToPrivateGCP", "portNumber": 2382, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure SQL Server Analysis Service browser (TCP:2382) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0051", + "id": "AC_GCP_0051", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0051" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0052.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0052.json index ec14235a1..18ca16799 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0052.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0052.json @@ -2,9 +2,7 @@ "name": "networkPort2382ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2382ExposedToPublicGCP", "portNumber": 2382, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure SQL Server Analysis Service browser (TCP:2382) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0052", + "id": "AC_GCP_0052", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0052" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0053.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0053.json index 3594c0624..7de8dfdcb 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0053.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0053.json @@ -2,9 +2,7 @@ "name": "networkPort2382ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2382ExposedToInternetGCP", "portNumber": 2382, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure SQL Server Analysis Service browser (TCP:2382) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0053", + "id": "AC_GCP_0053", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0053" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0054.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0054.json index fd997085c..14e8afc99 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0054.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0054.json @@ -2,9 +2,7 @@ "name": "networkPort1434ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1434ExposedToPrivateUGCP", "portNumber": 1434, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure MSSQL Browser Service (UDP:1434) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0054", + "id": "AC_GCP_0054", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0054" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0055.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0055.json index b5e9115ba..70b9ceb8c 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0055.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0055.json @@ -2,9 +2,7 @@ "name": "networkPort1434ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1434ExposedToPublicUGCP", "portNumber": 1434, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure MSSQL Browser Service (UDP:1434) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0055", + "id": "AC_GCP_0055", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0055" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0056.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0056.json index 90211dda9..41fafe58b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0056.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0056.json @@ -2,9 +2,7 @@ "name": "networkPort1434ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1434ExposedToInternetUGCP", "portNumber": 1434, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure MSSQL Browser Service (UDP:1434) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0056", + "id": "AC_GCP_0056", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0056" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0057.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0057.json index 3f1dab156..642778d7d 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0057.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0057.json @@ -2,9 +2,7 @@ "name": "networkPort1434ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1434ExposedToPrivateGCP", "portNumber": 1434, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure MSSQL Admin (TCP:1434) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0057", + "id": "AC_GCP_0057", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0057" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0058.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0058.json index 32c86ad43..96dae0cc3 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0058.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0058.json @@ -2,9 +2,7 @@ "name": "networkPort1434ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1434ExposedToPublicGCP", "portNumber": 1434, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure MSSQL Admin (TCP:1434) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0058", + "id": "AC_GCP_0058", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0058" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0059.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0059.json index b19ae4f59..a0224398d 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0059.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0059.json @@ -2,9 +2,7 @@ "name": "networkPort1434ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1434ExposedToInternetGCP", "portNumber": 1434, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure MSSQL Admin (TCP:1434) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0059", + "id": "AC_GCP_0059", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0059" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0060.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0060.json index fe60bb575..5612001b6 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0060.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0060.json @@ -2,9 +2,7 @@ "name": "networkPort5900ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5900ExposedToPrivateGCP", "portNumber": 5900, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure VNC Server (TCP:5900) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0060", + "id": "AC_GCP_0060", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0060" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0061.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0061.json index 74d3e8ecb..269743dd5 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0061.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0061.json @@ -2,9 +2,7 @@ "name": "networkPort5900ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5900ExposedToPublicGCP", "portNumber": 5900, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure VNC Server (TCP:5900) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0061", + "id": "AC_GCP_0061", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0061" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0062.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0062.json index 6b8d02e4e..34fe37ff2 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0062.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0062.json @@ -2,9 +2,7 @@ "name": "networkPort5900ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5900ExposedToInternetGCP", "portNumber": 5900, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure VNC Server (TCP:5900) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0062", + "id": "AC_GCP_0062", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0062" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0063.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0063.json index 83c443b48..337041a41 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0063.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0063.json @@ -2,9 +2,7 @@ "name": "networkPort5500ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5500ExposedToPrivateGCP", "portNumber": 5500, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure VNC Listener (TCP:5500) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0063", + "id": "AC_GCP_0063", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0063" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0064.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0064.json index a918fa7ba..5a7f23107 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0064.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0064.json @@ -2,9 +2,7 @@ "name": "networkPort5500ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5500ExposedToPublicGCP", "portNumber": 5500, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure VNC Listener (TCP:5500) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0064", + "id": "AC_GCP_0064", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0064" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0065.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0065.json index 2d79eec52..9864b42b3 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0065.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0065.json @@ -2,9 +2,7 @@ "name": "networkPort5500ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5500ExposedToInternetGCP", "portNumber": 5500, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure VNC Listener (TCP:5500) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0065", + "id": "AC_GCP_0065", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0065" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0066.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0066.json index 6de35b0b3..0e5e45ddc 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0066.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0066.json @@ -2,9 +2,7 @@ "name": "networkPort8080ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8080ExposedToPrivateGCP", "portNumber": 8080, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Known internal web port (TCP:8080) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0066", + "id": "AC_GCP_0066", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0066" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0067.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0067.json index 50bef2e01..3d00d57fc 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0067.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0067.json @@ -2,9 +2,7 @@ "name": "networkPort8080ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8080ExposedToPublicGCP", "portNumber": 8080, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Known internal web port (TCP:8080) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0067", + "id": "AC_GCP_0067", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0067" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0068.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0068.json index 99a93e13e..17ce9893b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0068.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0068.json @@ -2,9 +2,7 @@ "name": "networkPort8080ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8080ExposedToInternetGCP", "portNumber": 8080, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Known internal web port (TCP:8080) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0068", + "id": "AC_GCP_0068", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0068" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0069.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0069.json index 3b1c87503..463a5c51e 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0069.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0069.json @@ -2,9 +2,7 @@ "name": "networkPort8000ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8000ExposedToPrivateGCP", "portNumber": 8000, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Known internal web port (TCP:8000) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0069", + "id": "AC_GCP_0069", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0069" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0070.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0070.json index 146173fa3..9d1acc8a5 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0070.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0070.json @@ -2,9 +2,7 @@ "name": "networkPort8000ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8000ExposedToPublicGCP", "portNumber": 8000, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Known internal web port (TCP:8000) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0070", + "id": "AC_GCP_0070", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0070" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0071.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0071.json index 0a79defbd..686684b5e 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0071.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0071.json @@ -2,9 +2,7 @@ "name": "networkPort8000ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8000ExposedToInternetGCP", "portNumber": 8000, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Known internal web port (TCP:8000) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0071", + "id": "AC_GCP_0071", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0071" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0072.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0072.json index 7cbdd4810..69a48387c 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0072.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0072.json @@ -2,9 +2,7 @@ "name": "networkPort4506ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort4506ExposedToPrivateGCP", "portNumber": 4506, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure SaltStack Master (TCP:4506) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0072", + "id": "AC_GCP_0072", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0072" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0073.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0073.json index 5320467b1..efbea5a88 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0073.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0073.json @@ -2,9 +2,7 @@ "name": "networkPort4506ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort4506ExposedToPublicGCP", "portNumber": 4506, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure SaltStack Master (TCP:4506) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0073", + "id": "AC_GCP_0073", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0073" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0074.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0074.json index 9f75838ef..426ad4b0b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0074.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0074.json @@ -2,9 +2,7 @@ "name": "networkPort4506ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort4506ExposedToInternetGCP", "portNumber": 4506, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure SaltStack Master (TCP:4506) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0074", + "id": "AC_GCP_0074", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0074" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0075.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0075.json index 091b35de8..3d6b4540d 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0075.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0075.json @@ -2,9 +2,7 @@ "name": "networkPort4505ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort4505ExposedToPrivateGCP", "portNumber": 4505, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure SaltStack Master (TCP:4505) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0075", + "id": "AC_GCP_0075", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0075" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0076.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0076.json index 505e91eff..653232c6d 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0076.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0076.json @@ -2,9 +2,7 @@ "name": "networkPort4505ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort4505ExposedToPublicGCP", "portNumber": 4505, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure SaltStack Master (TCP:4505) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0076", + "id": "AC_GCP_0076", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0076" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0077.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0077.json index 4bbbf683f..5c475ecee 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0077.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0077.json @@ -2,9 +2,7 @@ "name": "networkPort4505ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort4505ExposedToInternetGCP", "portNumber": 4505, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure SaltStack Master (TCP:4505) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0077", + "id": "AC_GCP_0077", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0077" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0078.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0078.json index dc77ebe3b..da3c0e46b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0078.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0078.json @@ -2,9 +2,7 @@ "name": "networkPort3020ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3020ExposedToPrivateGCP", "portNumber": 3020, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure CIFS / SMB (TCP:3020) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0078", + "id": "AC_GCP_0078", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0078" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0079.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0079.json index 0c21d0b08..9c29e2602 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0079.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0079.json @@ -2,9 +2,7 @@ "name": "networkPort3020ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3020ExposedToPublicGCP", "portNumber": 3020, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure CIFS / SMB (TCP:3020) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0079", + "id": "AC_GCP_0079", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0079" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0080.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0080.json index 7b266df05..4db825ef0 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0080.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0080.json @@ -2,9 +2,7 @@ "name": "networkPort3020ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3020ExposedToInternetGCP", "portNumber": 3020, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure CIFS / SMB (TCP:3020) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0080", + "id": "AC_GCP_0080", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0080" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0081.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0081.json index 4ffe41af9..4b335e348 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0081.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0081.json @@ -2,9 +2,7 @@ "name": "networkPort3000ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3000ExposedToPrivateGCP", "portNumber": 3000, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Prevalent known internal port (TCP:3000) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0081", + "id": "AC_GCP_0081", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0081" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0082.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0082.json index bbd3a532c..5acaf4591 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0082.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0082.json @@ -2,9 +2,7 @@ "name": "networkPort3000ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3000ExposedToPublicGCP", "portNumber": 3000, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Prevalent known internal port (TCP:3000) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0082", + "id": "AC_GCP_0082", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0082" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0083.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0083.json index fee46457e..93971e121 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0083.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0083.json @@ -2,9 +2,7 @@ "name": "networkPort3000ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3000ExposedToInternetGCP", "portNumber": 3000, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Prevalent known internal port (TCP:3000) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0083", + "id": "AC_GCP_0083", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0083" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0084.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0084.json index 992e76849..a514dc149 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0084.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0084.json @@ -2,9 +2,7 @@ "name": "networkPort53ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort53ExposedToPrivateUGCP", "portNumber": 53, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure DNS (UDP:53) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0084", + "id": "AC_GCP_0084", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0084" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0085.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0085.json index 4e96601ac..ab561381d 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0085.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0085.json @@ -2,9 +2,7 @@ "name": "networkPort53ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort53ExposedToPublicUGCP", "portNumber": 53, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure DNS (UDP:53) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0085", + "id": "AC_GCP_0085", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0085" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0086.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0086.json index 097e39f01..857dc9050 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0086.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0086.json @@ -2,9 +2,7 @@ "name": "networkPort53ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort53ExposedToInternetUGCP", "portNumber": 53, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure DNS (UDP:53) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0086", + "id": "AC_GCP_0086", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0086" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0087.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0087.json index ef8d01233..45d23ff05 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0087.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0087.json @@ -2,9 +2,7 @@ "name": "networkPort161ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort161ExposedToPrivateUGCP", "portNumber": 161, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure SNMP (UDP:161) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0087", + "id": "AC_GCP_0087", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0087" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0088.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0088.json index 38c74b59a..397b34043 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0088.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0088.json @@ -2,9 +2,7 @@ "name": "networkPort161ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort161ExposedToPublicUGCP", "portNumber": 161, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure SNMP (UDP:161) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0088", + "id": "AC_GCP_0088", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0088" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0089.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0089.json index 4e4f5ef00..8e9d69181 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0089.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0089.json @@ -2,9 +2,7 @@ "name": "networkPort161ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort161ExposedToInternetUGCP", "portNumber": 161, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure SNMP (UDP:161) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0089", + "id": "AC_GCP_0089", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0089" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0090.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0090.json index 421aba8c7..dcb2dcf78 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0090.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0090.json @@ -2,9 +2,7 @@ "name": "networkPort139ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort139ExposedToPrivateUGCP", "portNumber": 139, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure NetBios Session Service (UDP:139) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0090", + "id": "AC_GCP_0090", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0090" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0091.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0091.json index 2436c8f1f..68d332953 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0091.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0091.json @@ -2,9 +2,7 @@ "name": "networkPort139ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort139ExposedToPublicUGCP", "portNumber": 139, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure NetBios Session Service (UDP:139) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0091", + "id": "AC_GCP_0091", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0091" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0092.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0092.json index f0bff36ea..04296bdd9 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0092.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0092.json @@ -2,9 +2,7 @@ "name": "networkPort139ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort139ExposedToInternetUGCP", "portNumber": 139, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure NetBios Session Service (UDP:139) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0092", + "id": "AC_GCP_0092", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0092" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0093.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0093.json index d2573d27d..0a896734f 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0093.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0093.json @@ -2,9 +2,7 @@ "name": "networkPort139ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort139ExposedToPrivateGCP", "portNumber": 139, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure NetBios Session Service (TCP:139) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0093", + "id": "AC_GCP_0093", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0093" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0094.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0094.json index 622a21b74..9b0eb10db 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0094.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0094.json @@ -2,9 +2,7 @@ "name": "networkPort139ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort139ExposedToPublicGCP", "portNumber": 139, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure NetBios Session Service (TCP:139) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0094", + "id": "AC_GCP_0094", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0094" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0095.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0095.json index c15df28b6..04df53f65 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0095.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0095.json @@ -2,9 +2,7 @@ "name": "networkPort139ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort139ExposedToInternetGCP", "portNumber": 139, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure NetBios Session Service (TCP:139) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0095", + "id": "AC_GCP_0095", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0095" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0096.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0096.json index 10466151a..b9eb49693 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0096.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0096.json @@ -2,9 +2,7 @@ "name": "networkPort138ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort138ExposedToPrivateGCP", "portNumber": 138, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure NetBios Datagram Service (TCP:138) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0096", + "id": "AC_GCP_0096", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0096" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0097.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0097.json index 1825df478..657f3f4f7 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0097.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0097.json @@ -2,9 +2,7 @@ "name": "networkPort138ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort138ExposedToPublicGCP", "portNumber": 138, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure NetBios Datagram Service (TCP:138) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0097", + "id": "AC_GCP_0097", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0097" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0098.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0098.json index cb6a59ef9..4c6427db1 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0098.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0098.json @@ -2,9 +2,7 @@ "name": "networkPort138ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort138ExposedToInternetGCP", "portNumber": 138, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure NetBios Datagram Service (TCP:138) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0098", + "id": "AC_GCP_0098", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0098" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0099.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0099.json index 74b14f37c..4c79c07ac 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0099.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0099.json @@ -2,9 +2,7 @@ "name": "networkPort138ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort138ExposedToPrivateGCP", "portNumber": 138, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure NetBios Datagram Service (TCP:138) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0099", + "id": "AC_GCP_0099", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0099" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0100.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0100.json index 48f3e0812..8135c5d7e 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0100.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0100.json @@ -2,9 +2,7 @@ "name": "networkPort138ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort138ExposedToPublicGCP", "portNumber": 138, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure NetBios Datagram Service (TCP:138) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0100", + "id": "AC_GCP_0100", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0100" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0101.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0101.json index 19095e029..5e9e64e1d 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0101.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0101.json @@ -2,9 +2,7 @@ "name": "networkPort138ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort138ExposedToInternetGCP", "portNumber": 138, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure NetBios Datagram Service (TCP:138) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0101", + "id": "AC_GCP_0101", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0101" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0102.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0102.json index c71923873..e45978c3a 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0102.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0102.json @@ -2,9 +2,7 @@ "name": "networkPort137ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort137ExposedToPrivateUGCP", "portNumber": 137, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure NetBIOS Name Service (UDP:137) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0102", + "id": "AC_GCP_0102", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0102" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0103.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0103.json index c340eb45a..ee57977ec 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0103.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0103.json @@ -2,9 +2,7 @@ "name": "networkPort137ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort137ExposedToPublicUGCP", "portNumber": 137, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure NetBIOS Name Service (UDP:137) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0103", + "id": "AC_GCP_0103", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0103" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0104.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0104.json index e90c689b2..e8d6a522a 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0104.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0104.json @@ -2,9 +2,7 @@ "name": "networkPort137ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort137ExposedToInternetUGCP", "portNumber": 137, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure NetBIOS Name Service (UDP:137) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0104", + "id": "AC_GCP_0104", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0104" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0105.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0105.json index b9e137b5f..9ea754795 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0105.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0105.json @@ -2,9 +2,7 @@ "name": "networkPort137ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort137ExposedToPrivateGCP", "portNumber": 137, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure NetBIOS Name Service (TCP:137) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0105", + "id": "AC_GCP_0105", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0105" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0106.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0106.json index f668926d1..ac39f8def 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0106.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0106.json @@ -2,9 +2,7 @@ "name": "networkPort137ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort137ExposedToPublicGCP", "portNumber": 137, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure NetBIOS Name Service (TCP:137) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0106", + "id": "AC_GCP_0106", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0106" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0107.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0107.json index aa9cc430c..fe9c94c7f 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0107.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0107.json @@ -2,9 +2,7 @@ "name": "networkPort137ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort137ExposedToInternetGCP", "portNumber": 137, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure NetBIOS Name Service (TCP:137) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0107", + "id": "AC_GCP_0107", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0107" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0108.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0108.json index 74c916138..f68047507 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0108.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0108.json @@ -2,9 +2,7 @@ "name": "networkPort110ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort110ExposedToPrivateGCP", "portNumber": 110, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure POP3 (TCP:110) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0108", + "id": "AC_GCP_0108", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0108" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0109.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0109.json index a2810906f..3085266c4 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0109.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0109.json @@ -2,9 +2,7 @@ "name": "networkPort110ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort110ExposedToPublicGCP", "portNumber": 110, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure POP3 (TCP:110) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0109", + "id": "AC_GCP_0109", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0109" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0110.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0110.json index 5444a6402..6433ffb2a 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0110.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0110.json @@ -2,9 +2,7 @@ "name": "networkPort110ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort110ExposedToInternetGCP", "portNumber": 110, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure POP3 (TCP:110) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0110", + "id": "AC_GCP_0110", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0110" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0111.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0111.json index c7e972509..1895a1e80 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0111.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0111.json @@ -2,9 +2,7 @@ "name": "networkPort25ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort25ExposedToPrivateGCP", "portNumber": 25, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure SMTP (TCP:25) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0111", + "id": "AC_GCP_0111", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0111" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0112.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0112.json index 717719df4..ec2a0689e 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0112.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0112.json @@ -2,9 +2,7 @@ "name": "networkPort25ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort25ExposedToPublicGCP", "portNumber": 25, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure SMTP (TCP:25) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0112", + "id": "AC_GCP_0112", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0112" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0113.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0113.json index 8a89559ef..fa4569436 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0113.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0113.json @@ -2,9 +2,7 @@ "name": "networkPort25ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort25ExposedToInternetGCP", "portNumber": 25, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure SMTP (TCP:25) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0113", + "id": "AC_GCP_0113", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0113" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0114.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0114.json index 341105f3a..b81722c18 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0114.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0114.json @@ -2,9 +2,7 @@ "name": "networkPort445ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort445ExposedToPrivateGCP", "portNumber": 445, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Microsoft-DS (TCP:445) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0114", + "id": "AC_GCP_0114", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0114" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0115.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0115.json index a25b4211d..4d24abc5b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0115.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0115.json @@ -2,9 +2,7 @@ "name": "networkPort445ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort445ExposedToPublicGCP", "portNumber": 445, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Microsoft-DS (TCP:445) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0115", + "id": "AC_GCP_0115", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0115" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0116.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0116.json index f90fcd77e..cd85cb730 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0116.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0116.json @@ -2,9 +2,7 @@ "name": "networkPort445ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort445ExposedToInternetGCP", "portNumber": 445, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Microsoft-DS (TCP:445) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0116", + "id": "AC_GCP_0116", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0116" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0117.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0117.json index bb7a03926..7d3965671 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0117.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0117.json @@ -2,9 +2,7 @@ "name": "networkPort23ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort23ExposedToPrivateGCP", "portNumber": 23, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Telnet (TCP:23) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0117", + "id": "AC_GCP_0117", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0117" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0118.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0118.json index bdff6f926..6d94f4d2f 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0118.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0118.json @@ -2,9 +2,7 @@ "name": "networkPort23ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort23ExposedToPublicGCP", "portNumber": 23, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Telnet (TCP:23) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0118", + "id": "AC_GCP_0118", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0118" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0119.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0119.json index 61585e5d6..1987bce29 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0119.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0119.json @@ -2,9 +2,7 @@ "name": "networkPort23ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort23ExposedToInternetGCP", "portNumber": 23, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Telnet (TCP:23) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0119", + "id": "AC_GCP_0119", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0119" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0120.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0120.json index 2e96ed5e6..4725f685f 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0120.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0120.json @@ -2,9 +2,7 @@ "name": "networkPort11215ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11215ExposedToPrivateUGCP", "portNumber": 11215, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Memcached SSL (UDP:11215) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0120", + "id": "AC_GCP_0120", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0120" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0121.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0121.json index f6f3e4a86..a304f0aab 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0121.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0121.json @@ -2,9 +2,7 @@ "name": "networkPort11215ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11215ExposedToPublicUGCP", "portNumber": 11215, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Memcached SSL (UDP:11215) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0121", + "id": "AC_GCP_0121", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0121" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0122.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0122.json index 6c0310bdb..43de56b73 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0122.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0122.json @@ -2,9 +2,7 @@ "name": "networkPort11215ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11215ExposedToInternetUGCP", "portNumber": 11215, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Memcached SSL (UDP:11215) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0122", + "id": "AC_GCP_0122", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0122" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0123.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0123.json index 4776a2c51..5de5b2209 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0123.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0123.json @@ -2,9 +2,7 @@ "name": "networkPort11215ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11215ExposedToPrivateGCP", "portNumber": 11215, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Memcached SSL (TCP:11215) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0123", + "id": "AC_GCP_0123", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0123" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0124.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0124.json index 7a0ae8dcf..0e43ed279 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0124.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0124.json @@ -2,9 +2,7 @@ "name": "networkPort11215ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11215ExposedToPublicGCP", "portNumber": 11215, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Memcached SSL (TCP:11215) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0124", + "id": "AC_GCP_0124", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0124" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0125.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0125.json index 6378edc17..81893fb8c 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0125.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0125.json @@ -2,9 +2,7 @@ "name": "networkPort11215ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11215ExposedToInternetGCP", "portNumber": 11215, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Memcached SSL (TCP:11215) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0125", + "id": "AC_GCP_0125", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0125" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0126.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0126.json index af0148d43..378c162be 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0126.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0126.json @@ -2,9 +2,7 @@ "name": "networkPort11214ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11214ExposedToPrivateUGCP", "portNumber": 11214, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Memcached SSL (UDP:11214) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0126", + "id": "AC_GCP_0126", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0126" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0127.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0127.json index 41720b563..52c0c4e17 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0127.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0127.json @@ -2,9 +2,7 @@ "name": "networkPort11214ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11214ExposedToPublicUGCP", "portNumber": 11214, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Memcached SSL (UDP:11214) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0127", + "id": "AC_GCP_0127", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0127" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0128.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0128.json index 4287a8c3b..7e8b6d3c5 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0128.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0128.json @@ -2,9 +2,7 @@ "name": "networkPort11214ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11214ExposedToInternetUGCP", "portNumber": 11214, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Memcached SSL (UDP:11214) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0128", + "id": "AC_GCP_0128", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0128" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0129.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0129.json index 740120186..2e1ca5771 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0129.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0129.json @@ -2,9 +2,7 @@ "name": "networkPort11214ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11214ExposedToPrivateGCP", "portNumber": 11214, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Memcached SSL (TCP:11214) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0129", + "id": "AC_GCP_0129", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0129" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0130.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0130.json index 85de4e64d..77b0ca274 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0130.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0130.json @@ -2,9 +2,7 @@ "name": "networkPort11214ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11214ExposedToPublicGCP", "portNumber": 11214, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Memcached SSL (TCP:11214) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0130", + "id": "AC_GCP_0130", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0130" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0131.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0131.json index 135abba31..db029afbc 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0131.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0131.json @@ -2,9 +2,7 @@ "name": "networkPort11214ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11214ExposedToInternetGCP", "portNumber": 11214, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Memcached SSL (TCP:11214) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0131", + "id": "AC_GCP_0131", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0131" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0132.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0132.json index 55c5297d0..76615deae 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0132.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0132.json @@ -2,9 +2,7 @@ "name": "networkPort3389ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3389ExposedToPrivateGCP", "portNumber": 3389, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Remote Desktop (TCP:3389) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0132", + "id": "AC_GCP_0132", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0132" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0133.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0133.json index 5cba202f5..c2a963603 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0133.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0133.json @@ -2,9 +2,7 @@ "name": "networkPort3389ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3389ExposedToPublicGCP", "portNumber": 3389, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Remote Desktop (TCP:3389) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0133", + "id": "AC_GCP_0133", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0133" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0134.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0134.json index 53f97b092..dbd6095f7 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0134.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0134.json @@ -2,9 +2,7 @@ "name": "networkPort3389ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3389ExposedToInternetGCP", "portNumber": 3389, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Remote Desktop (TCP:3389) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0134", + "id": "AC_GCP_0134", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0134" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0135.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0135.json index dfb35e818..5783db60b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0135.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0135.json @@ -2,9 +2,7 @@ "name": "networkPort7001ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort7001ExposedToPrivateGCP", "portNumber": 7001, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Cassandra (TCP:7001) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0135", + "id": "AC_GCP_0135", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0135" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0136.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0136.json index fffb8caef..d5d25bd6b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0136.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0136.json @@ -2,9 +2,7 @@ "name": "networkPort7001ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort7001ExposedToPublicGCP", "portNumber": 7001, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Cassandra (TCP:7001) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0136", + "id": "AC_GCP_0136", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0136" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0137.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0137.json index 00e8ea568..8de9064fe 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0137.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0137.json @@ -2,9 +2,7 @@ "name": "networkPort7001ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort7001ExposedToInternetGCP", "portNumber": 7001, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Cassandra (TCP:7001) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0137", + "id": "AC_GCP_0137", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0137" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0138.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0138.json index 0edadfc74..08ffac90c 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0138.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0138.json @@ -2,9 +2,7 @@ "name": "networkPort5432ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5432ExposedToPrivateUGCP", "portNumber": 5432, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Postgres SQL (UDP:5432) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0138", + "id": "AC_GCP_0138", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0138" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0139.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0139.json index 545552b76..b35b58ec8 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0139.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0139.json @@ -2,9 +2,7 @@ "name": "networkPort5432ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5432ExposedToPublicUGCP", "portNumber": 5432, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Postgres SQL (UDP:5432) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0139", + "id": "AC_GCP_0139", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0139" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0140.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0140.json index eee5acb1f..96d766c5c 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0140.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0140.json @@ -2,9 +2,7 @@ "name": "networkPort5432ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5432ExposedToInternetUGCP", "portNumber": 5432, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Postgres SQL (UDP:5432) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0140", + "id": "AC_GCP_0140", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0140" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0141.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0141.json index e252f4041..6e9b0548b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0141.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0141.json @@ -2,9 +2,7 @@ "name": "networkPort5432ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5432ExposedToPrivateGCP", "portNumber": 5432, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Postgres SQL (TCP:5432) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0141", + "id": "AC_GCP_0141", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0141" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0142.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0142.json index 008db5b10..6824fd7ed 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0142.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0142.json @@ -2,9 +2,7 @@ "name": "networkPort5432ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5432ExposedToPublicGCP", "portNumber": 5432, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Postgres SQL (TCP:5432) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0142", + "id": "AC_GCP_0142", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0142" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0143.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0143.json index 445957cc1..70e5a3e70 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0143.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0143.json @@ -2,9 +2,7 @@ "name": "networkPort5432ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort5432ExposedToInternetGCP", "portNumber": 5432, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Postgres SQL (TCP:5432) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0143", + "id": "AC_GCP_0143", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0143" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0144.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0144.json index bfe24359d..6a6f8f47d 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0144.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0144.json @@ -2,9 +2,7 @@ "name": "networkPort3306ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3306ExposedToPrivateGCP", "portNumber": 3306, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure MySQL (TCP:3306) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0144", + "id": "AC_GCP_0144", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0144" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0145.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0145.json index 7d780c43b..c9c93a4a8 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0145.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0145.json @@ -2,9 +2,7 @@ "name": "networkPort3306ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3306ExposedToPublicGCP", "portNumber": 3306, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure MySQL (TCP:3306) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0145", + "id": "AC_GCP_0145", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0145" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0146.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0146.json index d1ee3d4e4..466e4cfa8 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0146.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0146.json @@ -2,9 +2,7 @@ "name": "networkPort3306ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3306ExposedToInternetGCP", "portNumber": 3306, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure MySQL (TCP:3306) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0146", + "id": "AC_GCP_0146", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0146" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0147.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0147.json index 7c9510771..88d9b372b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0147.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0147.json @@ -2,9 +2,7 @@ "name": "networkPort2484ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2484ExposedToPrivateUGCP", "portNumber": 2484, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Oracle DB SSL (UDP:2484) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0147", + "id": "AC_GCP_0147", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0147" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0148.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0148.json index 33842e737..820f53d31 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0148.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0148.json @@ -2,9 +2,7 @@ "name": "networkPort2484ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2484ExposedToPublicUGCP", "portNumber": 2484, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Oracle DB SSL (UDP:2484) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0148", + "id": "AC_GCP_0148", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0148" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0149.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0149.json index 8d16ddf30..4ea834148 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0149.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0149.json @@ -2,9 +2,7 @@ "name": "networkPort2484ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2484ExposedToInternetUGCP", "portNumber": 2484, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Oracle DB SSL (UDP:2484) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0149", + "id": "AC_GCP_0149", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0149" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0150.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0150.json index aeb7b7fb1..2f8969186 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0150.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0150.json @@ -2,9 +2,7 @@ "name": "networkPort2484ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2484ExposedToPrivateGCP", "portNumber": 2484, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Oracle DB SSL (TCP:2484) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0150", + "id": "AC_GCP_0150", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0150" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0151.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0151.json index 081cf852c..cac3e1886 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0151.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0151.json @@ -2,9 +2,7 @@ "name": "networkPort2484ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2484ExposedToPublicGCP", "portNumber": 2484, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Oracle DB SSL (TCP:2484) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0151", + "id": "AC_GCP_0151", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0151" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0152.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0152.json index 1de73a5a9..6f96a61a8 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0152.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0152.json @@ -2,9 +2,7 @@ "name": "networkPort2484ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2484ExposedToInternetGCP", "portNumber": 2484, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Oracle DB SSL (TCP:2484) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0152", + "id": "AC_GCP_0152", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0152" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0153.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0153.json index ee2a80a86..dc287066c 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0153.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0153.json @@ -2,9 +2,7 @@ "name": "networkPort2383ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2383ExposedToPrivateGCP", "portNumber": 2383, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure SQL Server Analysis Services (TCP:2383) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0153", + "id": "AC_GCP_0153", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0153" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0154.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0154.json index 333d87108..cc83f7f1e 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0154.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0154.json @@ -2,9 +2,7 @@ "name": "networkPort2383ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2383ExposedToPublicGCP", "portNumber": 2383, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure SQL Server Analysis Services (TCP:2383) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0154", + "id": "AC_GCP_0154", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0154" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0155.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0155.json index 399be537a..d6ff96dbc 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0155.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0155.json @@ -2,9 +2,7 @@ "name": "networkPort2383ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2383ExposedToInternetGCP", "portNumber": 2383, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure SQL Server Analysis Services (TCP:2383) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0155", + "id": "AC_GCP_0155", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0155" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0156.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0156.json index 0c01286e7..b76df57d3 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0156.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0156.json @@ -2,9 +2,7 @@ "name": "networkPort1433ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1433ExposedToPrivateGCP", "portNumber": 1433, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure MSSQL Server (TCP:1433) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0156", + "id": "AC_GCP_0156", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0156" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0157.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0157.json index 913b44bee..21e9968a3 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0157.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0157.json @@ -2,9 +2,7 @@ "name": "networkPort1433ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1433ExposedToPublicGCP", "portNumber": 1433, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure MSSQL Server (TCP:1433) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0157", + "id": "AC_GCP_0157", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0157" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0158.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0158.json index 657672cb0..9211e9768 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0158.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0158.json @@ -2,9 +2,7 @@ "name": "networkPort1433ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1433ExposedToInternetGCP", "portNumber": 1433, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure MSSQL Server (TCP:1433) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0158", + "id": "AC_GCP_0158", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0158" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0159.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0159.json index 66103fa28..319a05639 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0159.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0159.json @@ -2,9 +2,7 @@ "name": "networkPort636ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort636ExposedToPrivateGCP", "portNumber": 636, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure LDAP SSL (TCP:636) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0159", + "id": "AC_GCP_0159", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0159" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0160.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0160.json index 95b2766d6..95a48d8f7 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0160.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0160.json @@ -2,9 +2,7 @@ "name": "networkPort636ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort636ExposedToPublicGCP", "portNumber": 636, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure LDAP SSL (TCP:636) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0160", + "id": "AC_GCP_0160", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0160" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0161.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0161.json index 30d640ebf..892b26953 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0161.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0161.json @@ -2,9 +2,7 @@ "name": "networkPort636ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort636ExposedToInternetGCP", "portNumber": 636, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure LDAP SSL (TCP:636) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0161", + "id": "AC_GCP_0161", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0161" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0162.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0162.json index 27707462f..08960eb4c 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0162.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0162.json @@ -2,9 +2,7 @@ "name": "networkPort135ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort135ExposedToPrivateGCP", "portNumber": 135, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure MSSQL Debugger (TCP:135) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0162", + "id": "AC_GCP_0162", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0162" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0163.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0163.json index 9e81ac63f..47f79a5be 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0163.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0163.json @@ -2,9 +2,7 @@ "name": "networkPort135ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort135ExposedToPublicGCP", "portNumber": 135, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure MSSQL Debugger (TCP:135) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0163", + "id": "AC_GCP_0163", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0163" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0164.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0164.json index fe9dc56d0..20b1656bd 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0164.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0164.json @@ -2,9 +2,7 @@ "name": "networkPort135ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort135ExposedToInternetGCP", "portNumber": 135, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure MSSQL Debugger (TCP:135) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0164", + "id": "AC_GCP_0164", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0164" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0165.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0165.json index 83f73bf4c..62a65d155 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0165.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0165.json @@ -2,9 +2,7 @@ "name": "networkPort61620ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort61620ExposedToPrivateGCP", "portNumber": 61620, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Cassandra OpsCenter Monitoring (TCP:61620) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0165", + "id": "AC_GCP_0165", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0165" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0166.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0166.json index dc8eb7fbb..46dee210f 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0166.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0166.json @@ -2,9 +2,7 @@ "name": "networkPort61620ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort61620ExposedToPublicGCP", "portNumber": 61620, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Cassandra OpsCenter Monitoring (TCP:61620) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0166", + "id": "AC_GCP_0166", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0166" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0167.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0167.json index 9a062844e..73a354a2b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0167.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0167.json @@ -2,9 +2,7 @@ "name": "networkPort61620ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort61620ExposedToInternetGCP", "portNumber": 61620, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Cassandra OpsCenter Monitoring (TCP:61620) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0167", + "id": "AC_GCP_0167", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0167" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0168.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0168.json index c488819a2..17565b5c3 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0168.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0168.json @@ -2,9 +2,7 @@ "name": "networkPort27017ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort27017ExposedToPrivateGCP", "portNumber": 27017, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Unencrypted Mongo Instances (TCP:27017) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0168", + "id": "AC_GCP_0168", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0168" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0169.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0169.json index e1c1837a3..a4d92a3bf 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0169.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0169.json @@ -2,9 +2,7 @@ "name": "networkPort27017ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort27017ExposedToPublicGCP", "portNumber": 27017, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Unencrypted Mongo Instances (TCP:27017) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0169", + "id": "AC_GCP_0169", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0169" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0170.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0170.json index 7a8956227..096953161 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0170.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0170.json @@ -2,9 +2,7 @@ "name": "networkPort27017ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort27017ExposedToInternetGCP", "portNumber": 27017, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Unencrypted Mongo Instances (TCP:27017) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0170", + "id": "AC_GCP_0170", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0170" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0171.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0171.json index 7e0feeaf5..f3da70871 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0171.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0171.json @@ -2,9 +2,7 @@ "name": "networkPort11211ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11211ExposedToPrivateUGCP", "portNumber": 11211, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Unencrypted Memcached Instances (UDP:11211) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0171", + "id": "AC_GCP_0171", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0171" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0172.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0172.json index d130318ca..83f72b4b8 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0172.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0172.json @@ -2,9 +2,7 @@ "name": "networkPort11211ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11211ExposedToPublicUGCP", "portNumber": 11211, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Unencrypted Memcached Instances (UDP:11211) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0172", + "id": "AC_GCP_0172", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0172" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0173.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0173.json index 1dd768111..bd72cbae3 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0173.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0173.json @@ -2,9 +2,7 @@ "name": "networkPort11211ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11211ExposedToInternetUGCP", "portNumber": 11211, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Unencrypted Memcached Instances (UDP:11211) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0173", + "id": "AC_GCP_0173", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0173" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0174.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0174.json index a7ceb5ba4..ae0a2c0fe 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0174.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0174.json @@ -2,9 +2,7 @@ "name": "networkPort11211ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11211ExposedToPrivateGCP", "portNumber": 11211, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Unencrypted Memcached Instances (TCP:11211) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0174", + "id": "AC_GCP_0174", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0174" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0175.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0175.json index 0385b33d0..913a4deed 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0175.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0175.json @@ -2,9 +2,7 @@ "name": "networkPort11211ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11211ExposedToPublicGCP", "portNumber": 11211, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Unencrypted Memcached Instances (TCP:11211) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0175", + "id": "AC_GCP_0175", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0175" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0176.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0176.json index 08ca0b52c..5042d2622 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0176.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0176.json @@ -2,9 +2,7 @@ "name": "networkPort11211ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort11211ExposedToInternetGCP", "portNumber": 11211, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Unencrypted Memcached Instances (TCP:11211) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0176", + "id": "AC_GCP_0176", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0176" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0177.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0177.json index d5beeacc2..8dd46bb61 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0177.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0177.json @@ -2,9 +2,7 @@ "name": "networkPort9300ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9300ExposedToPrivateGCP", "portNumber": 9300, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Elastic Search (TCP:9300) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0177", + "id": "AC_GCP_0177", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0177" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0178.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0178.json index fd8b2df91..9b70827c6 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0178.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0178.json @@ -2,9 +2,7 @@ "name": "networkPort9300ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9300ExposedToPublicGCP", "portNumber": 9300, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Elastic Search (TCP:9300) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0178", + "id": "AC_GCP_0178", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0178" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0179.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0179.json index 2081dd109..8cce28221 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0179.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0179.json @@ -2,9 +2,7 @@ "name": "networkPort9300ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9300ExposedToInternetGCP", "portNumber": 9300, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Elastic Search (TCP:9300) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0179", + "id": "AC_GCP_0179", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0179" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0180.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0180.json index c20fc9857..4b3f00414 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0180.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0180.json @@ -2,9 +2,7 @@ "name": "networkPort9200ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9200ExposedToPrivateGCP", "portNumber": 9200, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Elastic Search (TCP:9200) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0180", + "id": "AC_GCP_0180", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0180" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0181.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0181.json index 6aea04579..fd965aa4e 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0181.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0181.json @@ -2,9 +2,7 @@ "name": "networkPort9200ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9200ExposedToPublicGCP", "portNumber": 9200, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Elastic Search (TCP:9200) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0181", + "id": "AC_GCP_0181", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0181" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0182.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0182.json index dd3944e3c..728bb6226 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0182.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0182.json @@ -2,9 +2,7 @@ "name": "networkPort9200ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9200ExposedToInternetGCP", "portNumber": 9200, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Elastic Search (TCP:9200) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0182", + "id": "AC_GCP_0182", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0182" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0183.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0183.json index e9c42270b..c976ab9d1 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0183.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0183.json @@ -2,9 +2,7 @@ "name": "networkPort9160ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9160ExposedToPrivateGCP", "portNumber": 9160, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Cassandra Thrift (TCP:9160) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0183", + "id": "AC_GCP_0183", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0183" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0184.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0184.json index f573827e6..2c085e27c 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0184.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0184.json @@ -2,9 +2,7 @@ "name": "networkPort9160ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9160ExposedToPublicGCP", "portNumber": 9160, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Cassandra Thrift (TCP:9160) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0184", + "id": "AC_GCP_0184", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0184" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0185.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0185.json index f7e456916..5ec5dd74f 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0185.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0185.json @@ -2,9 +2,7 @@ "name": "networkPort9160ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9160ExposedToInternetGCP", "portNumber": 9160, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Cassandra Thrift (TCP:9160) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0185", + "id": "AC_GCP_0185", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0185" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0186.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0186.json index eb945ff50..a7f625019 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0186.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0186.json @@ -2,9 +2,7 @@ "name": "networkPort9042ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9042ExposedToPrivateGCP", "portNumber": 9042, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Cassandra Client (TCP:9042) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0186", + "id": "AC_GCP_0186", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0186" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0187.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0187.json index b0eeca13d..886fab643 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0187.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0187.json @@ -2,9 +2,7 @@ "name": "networkPort9042ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9042ExposedToPublicGCP", "portNumber": 9042, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Cassandra Client (TCP:9042) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0187", + "id": "AC_GCP_0187", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0187" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0188.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0188.json index bf48bfca2..3fffd98ee 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0188.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0188.json @@ -2,9 +2,7 @@ "name": "networkPort9042ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9042ExposedToInternetGCP", "portNumber": 9042, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Cassandra Client (TCP:9042) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0188", + "id": "AC_GCP_0188", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0188" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0189.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0189.json index 3b06f7402..a1829d464 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0189.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0189.json @@ -2,9 +2,7 @@ "name": "networkPort8888ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8888ExposedToPrivateGCP", "portNumber": 8888, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Cassandra OpsCenter Website (TCP:8888) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0189", + "id": "AC_GCP_0189", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0189" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0190.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0190.json index 3a10fbd3d..7dfb0f2e9 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0190.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0190.json @@ -2,9 +2,7 @@ "name": "networkPort8888ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8888ExposedToPublicGCP", "portNumber": 8888, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Cassandra OpsCenter Website (TCP:8888) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0190", + "id": "AC_GCP_0190", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0190" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0191.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0191.json index 8a8505976..2e83b687b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0191.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0191.json @@ -2,9 +2,7 @@ "name": "networkPort8888ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort8888ExposedToInternetGCP", "portNumber": 8888, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Cassandra OpsCenter Website (TCP:8888) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0191", + "id": "AC_GCP_0191", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0191" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0192.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0192.json index 849ad0d47..bc155cf6e 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0192.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0192.json @@ -2,9 +2,7 @@ "name": "networkPort7199ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort7199ExposedToPrivateGCP", "portNumber": 7199, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Cassandra Monitoring (TCP:7199) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0192", + "id": "AC_GCP_0192", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0192" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0193.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0193.json index 092ecfca5..21d7dcbdb 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0193.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0193.json @@ -2,9 +2,7 @@ "name": "networkPort7199ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort7199ExposedToPublicGCP", "portNumber": 7199, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Cassandra Monitoring (TCP:7199) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0193", + "id": "AC_GCP_0193", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0193" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0194.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0194.json index b9dc282b0..ad33db690 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0194.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0194.json @@ -2,9 +2,7 @@ "name": "networkPort7199ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort7199ExposedToInternetGCP", "portNumber": 7199, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Cassandra Monitoring (TCP:7199) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0194", + "id": "AC_GCP_0194", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0194" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0196.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0196.json index 3aa7c4713..c5b8dcd24 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0196.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0196.json @@ -2,9 +2,7 @@ "name": "networkPort7000ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort7000ExposedToPrivateGCP", "portNumber": 7000, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Cassandra Internode Communication (TCP:7000) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0196", + "id": "AC_GCP_0196", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0196" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0197.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0197.json index 31637b002..14dd0859a 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0197.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0197.json @@ -2,9 +2,7 @@ "name": "networkPort7000ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort7000ExposedToPublicGCP", "portNumber": 7000, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Cassandra Internode Communication (TCP:7000) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0197", + "id": "AC_GCP_0197", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0197" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0198.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0198.json index 2432006d7..0caebf7f3 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0198.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0198.json @@ -2,9 +2,7 @@ "name": "networkPort7000ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort7000ExposedToInternetGCP", "portNumber": 7000, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Cassandra Internode Communication (TCP:7000) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0198", + "id": "AC_GCP_0198", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0198" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0199.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0199.json index 178ed656e..ebc02bca5 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0199.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0199.json @@ -2,9 +2,7 @@ "name": "networkPort6379ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort6379ExposedToPrivateGCP", "portNumber": 6379, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Redis (TCP:6379) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0199", + "id": "AC_GCP_0199", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0199" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0200.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0200.json index da137d8c2..f102919de 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0200.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0200.json @@ -2,9 +2,7 @@ "name": "networkPort6379ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort6379ExposedToPublicGCP", "portNumber": 6379, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Redis (TCP:6379) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0200", + "id": "AC_GCP_0200", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0200" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0201.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0201.json index 37116b712..740e0a843 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0201.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0201.json @@ -2,9 +2,7 @@ "name": "networkPort6379ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort6379ExposedToInternetGCP", "portNumber": 6379, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Redis (TCP:6379) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0201", + "id": "AC_GCP_0201", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0201" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0202.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0202.json index 916ae4bfb..deece6a58 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0202.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0202.json @@ -2,9 +2,7 @@ "name": "networkPort2483ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2483ExposedToPrivateUGCP", "portNumber": 2483, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Oracle DB (UDP:2483) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0202", + "id": "AC_GCP_0202", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0202" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0203.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0203.json index a3cf5f41b..4e93739f4 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0203.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0203.json @@ -2,9 +2,7 @@ "name": "networkPort2483ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2483ExposedToPublicUGCP", "portNumber": 2483, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Oracle DB (UDP:2483) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0203", + "id": "AC_GCP_0203", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0203" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0204.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0204.json index fd27ec088..a0ba5ae54 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0204.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0204.json @@ -2,9 +2,7 @@ "name": "networkPort2483ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2483ExposedToInternetUGCP", "portNumber": 2483, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Oracle DB (UDP:2483) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0204", + "id": "AC_GCP_0204", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0204" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0205.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0205.json index 0d373b34a..e7a74fc63 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0205.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0205.json @@ -2,9 +2,7 @@ "name": "networkPort2483ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2483ExposedToPrivateGCP", "portNumber": 2483, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Oracle DB (TCP:2483) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0205", + "id": "AC_GCP_0205", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0205" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0206.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0206.json index 98a1ad981..28b40e941 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0206.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0206.json @@ -2,9 +2,7 @@ "name": "networkPort2483ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2483ExposedToPublicGCP", "portNumber": 2483, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Oracle DB (TCP:2483) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0206", + "id": "AC_GCP_0206", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0206" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0207.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0207.json index cd0b922e1..aaaf4d110 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0207.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0207.json @@ -2,9 +2,7 @@ "name": "networkPort2483ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort2483ExposedToInternetGCP", "portNumber": 2483, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Oracle DB (TCP:2483) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0207", + "id": "AC_GCP_0207", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0207" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0208.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0208.json index 29b84a4db..9e6c8d80a 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0208.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0208.json @@ -2,9 +2,7 @@ "name": "networkPort1521ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1521ExposedToPrivateGCP", "portNumber": 1521, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Oracle DB (TCP:1521) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0208", + "id": "AC_GCP_0208", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0208" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0209.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0209.json index 85063b445..c7671998a 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0209.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0209.json @@ -2,9 +2,7 @@ "name": "networkPort1521ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1521ExposedToPublicGCP", "portNumber": 1521, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Oracle DB (TCP:1521) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0209", + "id": "AC_GCP_0209", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0209" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0210.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0210.json index a06efde71..8d2a77e90 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0210.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0210.json @@ -2,9 +2,7 @@ "name": "networkPort1521ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort1521ExposedToInternetGCP", "portNumber": 1521, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Oracle DB (TCP:1521) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0210", + "id": "AC_GCP_0210", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0210" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0211.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0211.json index d9de4be53..7873f2e35 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0211.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0211.json @@ -2,9 +2,7 @@ "name": "networkPort389ExposedToPrivateUGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort389ExposedToPrivateUGCP", "portNumber": 389, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure LDAP (UDP:389) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0211", + "id": "AC_GCP_0211", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0211" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0212.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0212.json index 2ccd0971c..b66a984ce 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0212.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0212.json @@ -2,9 +2,7 @@ "name": "networkPort389ExposedToPublicUGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort389ExposedToPublicUGCP", "portNumber": 389, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure LDAP (UDP:389) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0212", + "id": "AC_GCP_0212", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0212" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0213.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0213.json index ffc39b5be..e9489c28c 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0213.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0213.json @@ -2,9 +2,7 @@ "name": "networkPort389ExposedToInternetUGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort389ExposedToInternetUGCP", "portNumber": 389, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure LDAP (UDP:389) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0213", + "id": "AC_GCP_0213", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0213" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0214.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0214.json index 575a913cb..b72f07a74 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0214.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0214.json @@ -2,9 +2,7 @@ "name": "networkPort389ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort389ExposedToPrivateGCP", "portNumber": 389, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure LDAP (TCP:389) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0214", + "id": "AC_GCP_0214", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0214" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0215.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0215.json index 7e15d13f4..5c7ab50f5 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0215.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0215.json @@ -2,9 +2,7 @@ "name": "networkPort389ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort389ExposedToPublicGCP", "portNumber": 389, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure LDAP (TCP:389) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0215", + "id": "AC_GCP_0215", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0215" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0216.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0216.json index 262069456..8a9fbc8b9 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0216.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0216.json @@ -2,9 +2,7 @@ "name": "networkPort389ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort389ExposedToInternetGCP", "portNumber": 389, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure LDAP (TCP:389) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0216", + "id": "AC_GCP_0216", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0216" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0217.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0217.json index 1ab00892d..4e014f274 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0217.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0217.json @@ -2,9 +2,7 @@ "name": "networkPort9090ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9090ExposedToPrivateGCP", "portNumber": 9090, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure CiscoSecure, Websm (TCP:9090) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0217", + "id": "AC_GCP_0217", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0217" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0218.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0218.json index 3dbd53647..5c2fb23c4 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0218.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0218.json @@ -2,9 +2,7 @@ "name": "networkPort9090ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9090ExposedToPublicGCP", "portNumber": 9090, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure CiscoSecure, Websm (TCP:9090) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0218", + "id": "AC_GCP_0218", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0218" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0219.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0219.json index 9f220a90b..5947041a9 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0219.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0219.json @@ -2,9 +2,7 @@ "name": "networkPort9090ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9090ExposedToInternetGCP", "portNumber": 9090, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure CiscoSecure, Websm (TCP:9090) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0219", + "id": "AC_GCP_0219", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0219" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0220.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0220.json index 4c302c5a0..539324d87 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0220.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0220.json @@ -2,9 +2,7 @@ "name": "networkPort9000ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9000ExposedToPrivateGCP", "portNumber": 9000, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Hadoop Name Node (TCP:9000) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0220", + "id": "AC_GCP_0220", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0220" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0221.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0221.json index e1ad0d1e3..8074c292e 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0221.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0221.json @@ -2,9 +2,7 @@ "name": "networkPort9000ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9000ExposedToPublicGCP", "portNumber": 9000, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Hadoop Name Node (TCP:9000) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0221", + "id": "AC_GCP_0221", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0221" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0222.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0222.json index 32a1d080c..1b38512ae 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0222.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0222.json @@ -2,9 +2,7 @@ "name": "networkPort9000ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort9000ExposedToInternetGCP", "portNumber": 9000, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Hadoop Name Node (TCP:9000) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0222", + "id": "AC_GCP_0222", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0222" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0223.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0223.json index a1aff20ed..8e2826469 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0223.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0223.json @@ -2,9 +2,7 @@ "name": "networkPort3389ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3389ExposedToPrivateGCP", "portNumber": 3389, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure Remote Desktop (TCP:3389) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0223", + "id": "AC_GCP_0223", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0223" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0224.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0224.json index deab31754..713f587a8 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0224.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0224.json @@ -2,9 +2,7 @@ "name": "networkPort3389ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3389ExposedToPublicGCP", "portNumber": 3389, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure Remote Desktop (TCP:3389) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0224", + "id": "AC_GCP_0224", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0224" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0225.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0225.json index 3e68ee00a..c31d5ce7b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0225.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0225.json @@ -2,9 +2,7 @@ "name": "networkPort3389ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort3389ExposedToInternetGCP", "portNumber": 3389, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure Remote Desktop (TCP:3389) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0225", + "id": "AC_GCP_0225", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0225" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0226.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0226.json index be1a38fd6..c99f2d0cd 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0226.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0226.json @@ -2,9 +2,7 @@ "name": "networkPort20ExposedToPrivateGCP", "file": "networkPortExposedToPrivateGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort20ExposedToPrivateGCP", "portNumber": 20, @@ -15,7 +13,7 @@ "severity": "LOW", "description": "Ensure SSH (TCP:20) is not exposed to private hosts more than 32 for Google Compute Firewall", "reference_id": "AC_GCP_0226", + "id": "AC_GCP_0226", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0226" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0227.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0227.json index 32c45f166..a5d643663 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0227.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0227.json @@ -2,9 +2,7 @@ "name": "networkPort20ExposedToPublicGCP", "file": "networkPortExposedToPublicGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort20ExposedToPublicGCP", "portNumber": 20, @@ -15,7 +13,7 @@ "severity": "MEDIUM", "description": "Ensure SSH (TCP:20) is not exposed to public for Google Compute Firewall", "reference_id": "AC_GCP_0227", + "id": "AC_GCP_0227", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0227" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0228.json b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0228.json index deba22d4f..29103b982 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0228.json +++ b/pkg/policies/opa/rego/gcp/google_compute_firewall/AC_GCP_0228.json @@ -2,9 +2,7 @@ "name": "networkPort20ExposedToInternetGCP", "file": "networkPortExposedToInternetGCP.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_firewall": true - }, + "resource_type": "google_compute_firewall", "template_args": { "name": "networkPort20ExposedToInternetGCP", "portNumber": 20, @@ -15,7 +13,7 @@ "severity": "HIGH", "description": "Ensure SSH (TCP:20) is not exposed to entire internet for Google Compute Firewall", "reference_id": "AC_GCP_0228", + "id": "AC_GCP_0228", "category": "Infrastructure Security", - "version": 2, - "id": "AC_GCP_0228" + "version": 2 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.EKM.132.json b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.EKM.132.json index a0f067964..8f3be5ab7 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.EKM.132.json +++ b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.EKM.132.json @@ -2,11 +2,7 @@ "name": "encryptedwithCsek", "file": "encryptedwithCsek.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_instance": true, - "google_compute_disk": true, - "google_compute_attached_disk": true - }, + "resource_type": "google_compute_instance", "template_args": null, "severity": "MEDIUM", "description": "VM disks attached to a compute instance should be encrypted with Customer Supplied Encryption Keys (CSEK) .", diff --git a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.IAM.124.json b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.IAM.124.json index 06baffe8b..06404619f 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.IAM.124.json +++ b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.IAM.124.json @@ -2,9 +2,7 @@ "name": "defaultServiceAccountUsed", "file": "defaultServiceAccountUsed.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_instance": true - }, + "resource_type": "google_compute_instance", "template_args": null, "severity": "HIGH", "description": "Instances may have been configured to use the default service account with full access to all Cloud APIs", diff --git a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.IAM.128.json b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.IAM.128.json index e6a930edf..0f3296245 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.IAM.128.json +++ b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.IAM.128.json @@ -2,9 +2,7 @@ "name": "osLoginEnabled", "file": "metadataDisabled.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_instance": true - }, + "resource_type": "google_compute_instance", "template_args": { "metaKey": "enable-oslogin", "name": "osLoginEnabled" diff --git a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.125.json b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.125.json index 4dad1cfdb..c05561cb4 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.125.json +++ b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.125.json @@ -2,9 +2,7 @@ "name": "checkVM_NoFullCloudAccess", "file": "checkVM_NoFullCloudAccess.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_instance": true - }, + "resource_type": "google_compute_instance", "template_args": null, "severity": "HIGH", "description": "Instances may have been configured to use the default service account with full access to all Cloud APIs", diff --git a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.126.json b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.126.json index eab4da445..b47eb1f21 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.126.json +++ b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.126.json @@ -2,10 +2,7 @@ "name": "projectWideSshKeysUsed", "file": "metadataDisabled.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_instance": true, - "google_compute_project_metadata": true - }, + "resource_type": "google_compute_instance", "template_args": { "metaKey": "block-project-ssh-keys", "name": "projectWideSshKeysUsed" diff --git a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.129.json b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.129.json index b4c2fe788..219678f7b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.129.json +++ b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.129.json @@ -2,10 +2,7 @@ "name": "serialPortEnabled", "file": "metadataDisabled.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_instance": true, - "google_compute_project_metadata": true - }, + "resource_type": "google_compute_instance", "template_args": { "metaKey": "serial-port-enable", "name": "serialPortEnabled" diff --git a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.130.json b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.130.json index a1dd78698..9b1a82c85 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.130.json +++ b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.130.json @@ -2,9 +2,7 @@ "name": "checkIpForward", "file": "checkIpForward.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_instance": true - }, + "resource_type": "google_compute_instance", "template_args": { "name": "checkIpForward", "prefix": "", diff --git a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.133.json b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.133.json index 1990d84c9..ca738146b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.133.json +++ b/pkg/policies/opa/rego/gcp/google_compute_instance/accurics.gcp.NS.133.json @@ -2,9 +2,7 @@ "name": "shieldedVmEenabled", "file": "shieldedVmEenabled.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_instance": true - }, + "resource_type": "google_compute_instance", "template_args": null, "severity": "MEDIUM", "description": "Ensure Compute instances are launched with Shielded VM enabled.", diff --git a/pkg/policies/opa/rego/gcp/google_compute_project_metadata/accurics.gcp.IAM.127.json b/pkg/policies/opa/rego/gcp/google_compute_project_metadata/accurics.gcp.IAM.127.json index f2c6f4f5e..0a3bb6723 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_project_metadata/accurics.gcp.IAM.127.json +++ b/pkg/policies/opa/rego/gcp/google_compute_project_metadata/accurics.gcp.IAM.127.json @@ -2,14 +2,12 @@ "name": "checkOSLoginEnabled", "file": "checkOSLoginEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_project_metadata": true - }, + "resource_type": "google_compute_project_metadata", "template_args": null, "severity": "HIGH", "description": "Ensure oslogin is enabled for a Project", "reference_id": "accurics.gcp.IAM.127", + "id": "AC_GCP_0291", "category": "Identity and Access Management", - "version": 1, - "id": "AC_GCP_0291" + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_compute_ssl_policy/accurics.gcp.EKM.134.json b/pkg/policies/opa/rego/gcp/google_compute_ssl_policy/accurics.gcp.EKM.134.json index 0bf67aecc..2c803da4b 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_ssl_policy/accurics.gcp.EKM.134.json +++ b/pkg/policies/opa/rego/gcp/google_compute_ssl_policy/accurics.gcp.EKM.134.json @@ -2,9 +2,7 @@ "name": "weakCipherSuitesEnabled", "file": "weakCipherSuitesEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_ssl_policy": true - }, + "resource_type": "google_compute_ssl_policy", "template_args": null, "severity": "MEDIUM", "description": "Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites.", diff --git a/pkg/policies/opa/rego/gcp/google_compute_subnetwork/accurics.gcp.LOG.118.json b/pkg/policies/opa/rego/gcp/google_compute_subnetwork/accurics.gcp.LOG.118.json index 0e8054db2..b2bddd917 100755 --- a/pkg/policies/opa/rego/gcp/google_compute_subnetwork/accurics.gcp.LOG.118.json +++ b/pkg/policies/opa/rego/gcp/google_compute_subnetwork/accurics.gcp.LOG.118.json @@ -2,9 +2,7 @@ "name": "vpcFlowLogEnabled", "file": "vpcFlowLogEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_compute_subnetwork": true - }, + "resource_type": "google_compute_subnetwork", "template_args": null, "severity": "MEDIUM", "description": "Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network.", diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/AC-GC-IS-CC-M-0367.json b/pkg/policies/opa/rego/gcp/google_container_cluster/AC-GC-IS-CC-M-0367.json index 7ac136955..d5a1e72d8 100644 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/AC-GC-IS-CC-M-0367.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/AC-GC-IS-CC-M-0367.json @@ -2,14 +2,12 @@ "name": "gkeControlPlanePublicAccess", "file": "gkeControlPlanePublicAccess.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "Medium", "description": "GKE Control Plane is exposed to few public IP addresses using master-authorized-network-config", "reference_id": "AC-GC-IS-CC-M-0367", + "id": "AC_GCP_0292", "category": "Infrastructure Security", - "version": 1, - "id": "AC_GCP_0292" + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.104.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.104.json index 15d7d9e1f..3204212a6 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.104.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.104.json @@ -2,9 +2,7 @@ "name": "clientCertificateEnabled", "file": "clientCertificateEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "MEDIUM", "description": "Ensure Kubernetes Cluster is created with Client Certificate disabled.", diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.110.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.110.json index 67a4dd3ca..94f49f20c 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.110.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.110.json @@ -2,9 +2,7 @@ "name": "gkeBasicAuthDisabled", "file": "gkeBasicAuthDisabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "HIGH", "description": "Ensure GKE basic auth is disabled.", diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.142.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.142.json index a3bf6321a..eb598445d 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.142.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.IAM.142.json @@ -2,9 +2,7 @@ "name": "legacyAuthEnabled", "file": "legacyAuthEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "HIGH", "description": "Ensure Legacy Authorization is set to disabled on Kubernetes Engine Clusters.", diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.LOG.100.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.LOG.100.json index e1a10935d..16409cdfe 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.LOG.100.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.LOG.100.json @@ -2,9 +2,7 @@ "name": "stackDriverLoggingEnabled", "file": "stackDriverServiceDisabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": { "name": "stackDriverLoggingEnabled", "service": "logging" diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.MON.143.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.MON.143.json index 3eb61ac4e..c53b918f8 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.MON.143.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.MON.143.json @@ -2,9 +2,7 @@ "name": "stackDriverMonitoringEnabled", "file": "stackDriverServiceDisabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": { "name": "stackDriverMonitoringEnabled", "service": "monitoring" diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.103.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.103.json index 3a52104c4..de60c6437 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.103.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.103.json @@ -2,14 +2,12 @@ "name": "networkPolicyEnabled", "file": "networkPolicyEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "HIGH", "description": "Ensure Network policy is enabled on Kubernetes Engine Clusters.", "reference_id": "accurics.gcp.NS.103", + "id": "AC_GCP_0293", "category": "Infrastructure Security", - "version": 1, - "id": "AC_GCP_0293" + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.109.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.109.json index d7843ad6e..2c4401eee 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.109.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.109.json @@ -2,9 +2,7 @@ "name": "gkeControlPlaneNotPublic", "file": "gkeControlPlaneNotPublic.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "HIGH", "description": "Ensure GKE Control Plane is not public.", diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.112.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.112.json index c7d8b49b3..1c9ba081f 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.112.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.112.json @@ -2,9 +2,7 @@ "name": "masterAuthEnabled", "file": "masterAuthEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "HIGH", "description": "Ensure Master Authentication is set to enabled on Kubernetes Engine Clusters.", diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.117.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.117.json index e32b4e6b9..0dd266ada 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.117.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.NS.117.json @@ -2,14 +2,12 @@ "name": "privateClusterEnabled", "file": "privateClusterEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "HIGH", "description": "Ensure Kubernetes Cluster is created with Private cluster enabled.", "reference_id": "accurics.gcp.NS.117", + "id": "AC_GCP_0294", "category": "Infrastructure Security", - "version": 1, - "id": "AC_GCP_0294" + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.113.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.113.json index 212fe5a17..2eaadfd23 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.113.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.113.json @@ -2,9 +2,7 @@ "name": "clusterLabelsEnabled", "file": "clusterLabelsEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "HIGH", "description": "Ensure Kubernetes Clusters are configured with Labels.", diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.115.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.115.json index 49f84cbb2..22c7b828b 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.115.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.115.json @@ -2,9 +2,7 @@ "name": "ipAliasingEnabled", "file": "ipAliasingEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "HIGH", "description": "Ensure Kubernetes Cluster is created with Alias IP ranges enabled", diff --git a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.116.json b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.116.json index 961ba3a8d..2264e26e6 100755 --- a/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.116.json +++ b/pkg/policies/opa/rego/gcp/google_container_cluster/accurics.gcp.OPS.116.json @@ -2,9 +2,7 @@ "name": "podSecurityPolicyEnabled", "file": "podSecurityPolicyEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_cluster": true - }, + "resource_type": "google_container_cluster", "template_args": null, "severity": "HIGH", "description": "Ensure PodSecurityPolicy controller is enabled on the Kubernetes Engine Clusters.", diff --git a/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.101.json b/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.101.json index 2ac736f24..24ebcf8fa 100755 --- a/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.101.json +++ b/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.101.json @@ -2,9 +2,7 @@ "name": "autoNodeUpgradeEnabled", "file": "autoNodePropDisabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_node_pool": true - }, + "resource_type": "google_container_node_pool", "template_args": { "name": "autoNodeUpgradeEnabled", "property": "auto_upgrade" diff --git a/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.114.json b/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.114.json index 2ef66c43f..7ef8a33d8 100755 --- a/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.114.json +++ b/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.114.json @@ -2,9 +2,7 @@ "name": "cosNodeImageUsed", "file": "cosNodeImageUsed.rego", "policy_type": "gcp", - "resource_type": { - "google_container_node_pool": true - }, + "resource_type": "google_container_node_pool", "template_args": null, "severity": "HIGH", "description": "Ensure Container-Optimized OS (cos) is used for Kubernetes Engine Clusters Node image.", diff --git a/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.144.json b/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.144.json index 01c28ee3f..0b9e06b6e 100755 --- a/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.144.json +++ b/pkg/policies/opa/rego/gcp/google_container_node_pool/accurics.gcp.OPS.144.json @@ -2,9 +2,7 @@ "name": "autoNodeRepairEnabled", "file": "autoNodePropDisabled.rego", "policy_type": "gcp", - "resource_type": { - "google_container_node_pool": true - }, + "resource_type": "google_container_node_pool", "template_args": { "name": "autoNodeRepairEnabled", "property": "auto_repair" diff --git a/pkg/policies/opa/rego/gcp/google_dns_managed_zone/accurics.gcp.EKM.108.json b/pkg/policies/opa/rego/gcp/google_dns_managed_zone/accurics.gcp.EKM.108.json index ac644ae8c..855744c3c 100755 --- a/pkg/policies/opa/rego/gcp/google_dns_managed_zone/accurics.gcp.EKM.108.json +++ b/pkg/policies/opa/rego/gcp/google_dns_managed_zone/accurics.gcp.EKM.108.json @@ -2,9 +2,7 @@ "name": "rsaSha1NotUsedDNSSEC", "file": "rsaSha1NotUsedDNSSEC.rego", "policy_type": "gcp", - "resource_type": { - "google_dns_managed_zone": true - }, + "resource_type": "google_dns_managed_zone", "template_args": null, "severity": "HIGH", "description": "Ensure that RSASHA1 is not used for the zone-signing and key-signing keys in Cloud DNS DNSSEC.", diff --git a/pkg/policies/opa/rego/gcp/google_dns_managed_zone/accurics.gcp.NS.107.json b/pkg/policies/opa/rego/gcp/google_dns_managed_zone/accurics.gcp.NS.107.json index 7b1aa749d..318372ede 100755 --- a/pkg/policies/opa/rego/gcp/google_dns_managed_zone/accurics.gcp.NS.107.json +++ b/pkg/policies/opa/rego/gcp/google_dns_managed_zone/accurics.gcp.NS.107.json @@ -2,9 +2,7 @@ "name": "dnsStateIsNotOn", "file": "dnsStateIsNotOn.rego", "policy_type": "gcp", - "resource_type": { - "google_dns_managed_zone": true - }, + "resource_type": "google_dns_managed_zone", "template_args": null, "severity": "LOW", "description": "Ensure that DNSSEC is enabled for Cloud DNS.", diff --git a/pkg/policies/opa/rego/gcp/google_kms_crypto_key/accurics.gcp.EKM.007.json b/pkg/policies/opa/rego/gcp/google_kms_crypto_key/accurics.gcp.EKM.007.json index 3e74b4871..8b945155e 100755 --- a/pkg/policies/opa/rego/gcp/google_kms_crypto_key/accurics.gcp.EKM.007.json +++ b/pkg/policies/opa/rego/gcp/google_kms_crypto_key/accurics.gcp.EKM.007.json @@ -2,9 +2,7 @@ "name": "checkRotation365Days", "file": "checkRotation365Days.rego", "policy_type": "gcp", - "resource_type": { - "google_kms_crypto_key": true - }, + "resource_type": "google_kms_crypto_key", "template_args": null, "severity": "HIGH", "description": "Ensure Encryption keys are rotated within a period of 365 days.", diff --git a/pkg/policies/opa/rego/gcp/google_kms_crypto_key/accurics.gcp.EKM.139.json b/pkg/policies/opa/rego/gcp/google_kms_crypto_key/accurics.gcp.EKM.139.json index 81dac67e7..ac41776f6 100755 --- a/pkg/policies/opa/rego/gcp/google_kms_crypto_key/accurics.gcp.EKM.139.json +++ b/pkg/policies/opa/rego/gcp/google_kms_crypto_key/accurics.gcp.EKM.139.json @@ -2,9 +2,7 @@ "name": "checkRotation90Days", "file": "checkRotation90Days.rego", "policy_type": "gcp", - "resource_type": { - "google_kms_crypto_key": true - }, + "resource_type": "google_kms_crypto_key", "template_args": null, "severity": "MEDIUM", "description": "Ensure Encryption keys are rotated within a period of 90 days.", diff --git a/pkg/policies/opa/rego/gcp/google_project/accurics.gcp.NS.119.json b/pkg/policies/opa/rego/gcp/google_project/accurics.gcp.NS.119.json index 570c5f3a3..02b31fbc6 100755 --- a/pkg/policies/opa/rego/gcp/google_project/accurics.gcp.NS.119.json +++ b/pkg/policies/opa/rego/gcp/google_project/accurics.gcp.NS.119.json @@ -2,9 +2,7 @@ "name": "autoCreateNetDisabled", "file": "autoCreateNetDisabled.rego", "policy_type": "gcp", - "resource_type": { - "google_project": true - }, + "resource_type": "google_project", "template_args": null, "severity": "MEDIUM", "description": "Ensure that the default network does not exist in a project.", diff --git a/pkg/policies/opa/rego/gcp/google_project_iam_audit_config/accurics.gcp.LOG.010.json b/pkg/policies/opa/rego/gcp/google_project_iam_audit_config/accurics.gcp.LOG.010.json index e63426f87..0f2bbca12 100755 --- a/pkg/policies/opa/rego/gcp/google_project_iam_audit_config/accurics.gcp.LOG.010.json +++ b/pkg/policies/opa/rego/gcp/google_project_iam_audit_config/accurics.gcp.LOG.010.json @@ -2,9 +2,7 @@ "name": "checkAuditLoggingConfig", "file": "checkAuditLoggingConfig.rego", "policy_type": "gcp", - "resource_type": { - "google_project_iam_audit_config": true - }, + "resource_type": "google_project_iam_audit_config", "template_args": null, "severity": "LOW", "description": "Ensure that Cloud Audit Logging is configured properly across all services and all users from a project.", diff --git a/pkg/policies/opa/rego/gcp/google_project_iam_binding/accurics.gcp.IAM.136.json b/pkg/policies/opa/rego/gcp/google_project_iam_binding/accurics.gcp.IAM.136.json index a3a033558..406048fea 100755 --- a/pkg/policies/opa/rego/gcp/google_project_iam_binding/accurics.gcp.IAM.136.json +++ b/pkg/policies/opa/rego/gcp/google_project_iam_binding/accurics.gcp.IAM.136.json @@ -2,9 +2,7 @@ "name": "iamServiceAccountUsed", "file": "iamServiceAccountUsed.rego", "policy_type": "gcp", - "resource_type": { - "google_project_iam_binding": true - }, + "resource_type": "google_project_iam_binding", "template_args": null, "severity": "HIGH", "description": "Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level.", diff --git a/pkg/policies/opa/rego/gcp/google_project_iam_binding/accurics.gcp.IAM.150.json b/pkg/policies/opa/rego/gcp/google_project_iam_binding/accurics.gcp.IAM.150.json index 5e467790b..188a056ea 100755 --- a/pkg/policies/opa/rego/gcp/google_project_iam_binding/accurics.gcp.IAM.150.json +++ b/pkg/policies/opa/rego/gcp/google_project_iam_binding/accurics.gcp.IAM.150.json @@ -2,9 +2,7 @@ "name": "noGmailAccount", "file": "noGmailAccount.rego", "policy_type": "gcp", - "resource_type": { - "google_project_iam_binding": true - }, + "resource_type": "google_project_iam_binding", "template_args": null, "severity": "MEDIUM", "description": "Ensure that corporate login credentials are used instead of Gmail accounts.", diff --git a/pkg/policies/opa/rego/gcp/google_project_iam_member/accurics.gcp.IAM.137.json b/pkg/policies/opa/rego/gcp/google_project_iam_member/accurics.gcp.IAM.137.json index 788018274..ff6bb5626 100755 --- a/pkg/policies/opa/rego/gcp/google_project_iam_member/accurics.gcp.IAM.137.json +++ b/pkg/policies/opa/rego/gcp/google_project_iam_member/accurics.gcp.IAM.137.json @@ -2,9 +2,7 @@ "name": "iamServiceAccountUsed", "file": "iamServiceAccountUsed.rego", "policy_type": "gcp", - "resource_type": { - "google_project_iam_member": true - }, + "resource_type": "google_project_iam_member", "template_args": null, "severity": "HIGH", "description": "Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level.", diff --git a/pkg/policies/opa/rego/gcp/google_project_iam_member/accurics.gcp.IAM.138.json b/pkg/policies/opa/rego/gcp/google_project_iam_member/accurics.gcp.IAM.138.json index b4c09301b..acc9e4059 100755 --- a/pkg/policies/opa/rego/gcp/google_project_iam_member/accurics.gcp.IAM.138.json +++ b/pkg/policies/opa/rego/gcp/google_project_iam_member/accurics.gcp.IAM.138.json @@ -2,9 +2,7 @@ "name": "serviceAccountAdminPriviledges", "file": "serviceAccountAdminPriviledges.rego", "policy_type": "gcp", - "resource_type": { - "google_project_iam_member": true - }, + "resource_type": "google_project_iam_member", "template_args": null, "severity": "HIGH", "description": "Ensure that Service Account has no Admin privileges.", diff --git a/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.BDR.105.json b/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.BDR.105.json index 9f1c930cf..26807c8d1 100755 --- a/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.BDR.105.json +++ b/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.BDR.105.json @@ -2,9 +2,7 @@ "name": "backupConfigEnabled", "file": "backupConfigEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_sql_database_instance": true - }, + "resource_type": "google_sql_database_instance", "template_args": null, "severity": "HIGH", "description": "Ensure all Cloud SQL database instance have backup configuration enabled.", diff --git a/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.EKM.141.json b/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.EKM.141.json index 85ec55f8c..07b49cbde 100755 --- a/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.EKM.141.json +++ b/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.EKM.141.json @@ -2,9 +2,7 @@ "name": "checkRequireSSLEnabled", "file": "checkDatabaseSettings.rego", "policy_type": "gcp", - "resource_type": { - "google_sql_database_instance": true - }, + "resource_type": "google_sql_database_instance", "template_args": null, "severity": "HIGH", "description": "Ensure that Cloud SQL database instance requires all incoming connections to use SSL", diff --git a/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.NS.102.json b/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.NS.102.json index 721041bc4..691520302 100755 --- a/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.NS.102.json +++ b/pkg/policies/opa/rego/gcp/google_sql_database_instance/accurics.gcp.NS.102.json @@ -2,14 +2,12 @@ "name": "checkNoPublicAccess", "file": "checkDatabaseSettings.rego", "policy_type": "gcp", - "resource_type": { - "google_sql_database_instance": true - }, + "resource_type": "google_sql_database_instance", "template_args": null, "severity": "HIGH", "description": "Ensure that Cloud SQL database Instances are not open to the world.", "reference_id": "accurics.gcp.NS.102", + "id": "AC_GCP_0295", "category": "Infrastructure Security", - "version": 1, - "id": "AC_GCP_0295" + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.IAM.122.json b/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.IAM.122.json index e7a77b996..00f437094 100755 --- a/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.IAM.122.json +++ b/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.IAM.122.json @@ -2,9 +2,7 @@ "name": "uniformBucketEnabled", "file": "uniformBucketEnabled.rego", "policy_type": "gcp", - "resource_type": { - "google_storage_bucket": true - }, + "resource_type": "google_storage_bucket", "template_args": null, "severity": "MEDIUM", "description": "Ensure that Cloud Storage buckets have uniform bucket-level access enabled.", diff --git a/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.LOG.146.json b/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.LOG.146.json index 85838f57b..6023343cc 100755 --- a/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.LOG.146.json +++ b/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.LOG.146.json @@ -2,9 +2,7 @@ "name": "checkVersioningEnabled", "file": "checkStorageBucketConfig.rego", "policy_type": "gcp", - "resource_type": { - "google_storage_bucket": true - }, + "resource_type": "google_storage_bucket", "template_args": null, "severity": "HIGH", "description": "Ensure that object versioning is enabled on log-buckets.", diff --git a/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.LOG.147.json b/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.LOG.147.json index 15ae440bf..47c7137d0 100755 --- a/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.LOG.147.json +++ b/pkg/policies/opa/rego/gcp/google_storage_bucket/accurics.gcp.LOG.147.json @@ -2,9 +2,7 @@ "name": "checkLoggingEnabled", "file": "checkStorageBucketConfig.rego", "policy_type": "gcp", - "resource_type": { - "google_storage_bucket": true - }, + "resource_type": "google_storage_bucket", "template_args": null, "severity": "HIGH", "description": "Ensure that logging is enabled for Cloud storage buckets.", diff --git a/pkg/policies/opa/rego/gcp/google_storage_bucket_iam_binding/accurics.gcp.IAM.121.json b/pkg/policies/opa/rego/gcp/google_storage_bucket_iam_binding/accurics.gcp.IAM.121.json index 3c64f3a88..dc0472086 100755 --- a/pkg/policies/opa/rego/gcp/google_storage_bucket_iam_binding/accurics.gcp.IAM.121.json +++ b/pkg/policies/opa/rego/gcp/google_storage_bucket_iam_binding/accurics.gcp.IAM.121.json @@ -2,9 +2,7 @@ "name": "checkPubliclyAccessible", "file": "checkPubliclyAccessible.rego", "policy_type": "gcp", - "resource_type": { - "google_storage_bucket_iam_binding": true - }, + "resource_type": "google_storage_bucket_iam_binding", "template_args": null, "severity": "MEDIUM", "description": "Ensure that Cloud Storage bucket is not anonymously or publicly accessible.", diff --git a/pkg/policies/opa/rego/gcp/google_storage_bucket_iam_member/accurics.gcp.IAM.120.json b/pkg/policies/opa/rego/gcp/google_storage_bucket_iam_member/accurics.gcp.IAM.120.json index 685c654c4..311a9b1d8 100755 --- a/pkg/policies/opa/rego/gcp/google_storage_bucket_iam_member/accurics.gcp.IAM.120.json +++ b/pkg/policies/opa/rego/gcp/google_storage_bucket_iam_member/accurics.gcp.IAM.120.json @@ -2,9 +2,7 @@ "name": "checkNoPublicAccess", "file": "checkNoPublicAccess.rego", "policy_type": "gcp", - "resource_type": { - "google_storage_bucket_iam_member": true - }, + "resource_type": "google_storage_bucket_iam_member", "template_args": null, "severity": "HIGH", "description": "Ensure that Cloud Storage bucket is not anonymously or publicly Accessible.", diff --git a/pkg/policies/opa/rego/github/github_organization_webhook/accurics.github.EKM.1.json b/pkg/policies/opa/rego/github/github_organization_webhook/accurics.github.EKM.1.json index 9cba11c2e..fdc778b17 100755 --- a/pkg/policies/opa/rego/github/github_organization_webhook/accurics.github.EKM.1.json +++ b/pkg/policies/opa/rego/github/github_organization_webhook/accurics.github.EKM.1.json @@ -2,14 +2,12 @@ "name": "insecureSslUsed", "file": "insecureSslUsed.rego", "policy_type": "github", - "resource_type": { - "github_organization_webhook": true - }, + "resource_type": "github_organization_webhook", "template_args": null, "severity": "MEDIUM", "description": "Insecure SSL is used for organization webhook.", "reference_id": "accurics.github.EKM.1", + "id": "AC_GITHUB_0001", "category": "Encryption and Key Management", - "version": 1, - "id": "AC_GITHUB_0001" + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/github/github_repository/accurics.github.IAM.1.json b/pkg/policies/opa/rego/github/github_repository/accurics.github.IAM.1.json index 8bce3198b..acd81a95d 100755 --- a/pkg/policies/opa/rego/github/github_repository/accurics.github.IAM.1.json +++ b/pkg/policies/opa/rego/github/github_repository/accurics.github.IAM.1.json @@ -2,14 +2,12 @@ "name": "privateRepoEnabled", "file": "privateRepoEnabled.rego", "policy_type": "github", - "resource_type": { - "github_repository": true - }, + "resource_type": "github_repository", "template_args": null, "severity": "MEDIUM", "description": "Repository is Not Private.", "reference_id": "accurics.github.IAM.1", + "id": "AC_GITHUB_0002", "category": "Identity and Access Management", - "version": 1, - "id": "AC_GITHUB_0002" + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/github/github_repository_webhook/accurics.github.EKM2.json b/pkg/policies/opa/rego/github/github_repository_webhook/accurics.github.EKM2.json index 3cac1342d..4937b0eef 100644 --- a/pkg/policies/opa/rego/github/github_repository_webhook/accurics.github.EKM2.json +++ b/pkg/policies/opa/rego/github/github_repository_webhook/accurics.github.EKM2.json @@ -2,14 +2,12 @@ "name": "insecureSslUsed", "file": "insecureSslUsed.rego", "policy_type": "github", - "resource_type": { - "github_repository_webhook": true - }, + "resource_type": "github_repository_webhook", "template_args": null, "severity": "MEDIUM", "description": "Insecure SSL is used for repository webhook.", "reference_id": "accurics.github.EKM.2", + "id": "AC_GITHUB_0003", "category": "Encryption and Key Management", - "version": 1, - "id": "AC_GITHUB_0003" + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/k8s/kubernetes_endpoint_slice/AC_K8S_0113.json b/pkg/policies/opa/rego/k8s/kubernetes_endpoint_slice/AC_K8S_0113.json index 3706d767f..1060778fe 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_endpoint_slice/AC_K8S_0113.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_endpoint_slice/AC_K8S_0113.json @@ -2,9 +2,7 @@ "name": "loopbackAddressUsed", "file": "loopbackAddressUsed.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_endpoint_slice": true - }, + "resource_type": "kubernetes_endpoint_slice", "template_args": { "name": "loopbackAddressUsed", "prefix": "", @@ -13,7 +11,7 @@ "severity": "LOW", "description": "Ensure endpoint slice is not created or updated with loopback addresses as this acts as an attack vector for exploiting CVE-2021-25737 by an authorized user", "reference_id": "AC_K8S_0113", + "id": "AC_K8S_0113", "category": "Infrastructure Security", - "version": 1, - "id": "AC_K8S_0113" + "version": 1 } \ No newline at end of file diff --git a/pkg/policies/opa/rego/k8s/kubernetes_ingress/AC-K8-NS-IN-H-0020.json b/pkg/policies/opa/rego/k8s/kubernetes_ingress/AC-K8-NS-IN-H-0020.json index f3fd823e6..afc2630c1 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_ingress/AC-K8-NS-IN-H-0020.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_ingress/AC-K8-NS-IN-H-0020.json @@ -2,9 +2,7 @@ "name": "noHttps", "file": "noHttps.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_ingress": true - }, + "resource_type": "kubernetes_ingress", "template_args": { "name": "noHttps", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_namespace/AC-K8-OE-NS-L-0128.json b/pkg/policies/opa/rego/k8s/kubernetes_namespace/AC-K8-OE-NS-L-0128.json index c4ae926a7..53d9f50f6 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_namespace/AC-K8-OE-NS-L-0128.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_namespace/AC-K8-OE-NS-L-0128.json @@ -2,12 +2,7 @@ "name": "noOwnerLabel", "file": "noOwnerLabel.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_namespace": true, - "kubernetes_deployment": true, - "kubernetes_pod": true, - "kubernetes_job": true - }, + "resource_type": "kubernetes_namespace", "template_args": { "name": "noOwnerLabel", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-CA-PO-H-0165.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-CA-PO-H-0165.json index e3f0d0597..ca4d65440 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-CA-PO-H-0165.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-CA-PO-H-0165.json @@ -2,14 +2,7 @@ "name": "privilegeEscalationCheck", "file": "securityContextCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "allowed": "false", "arg1": "cpu", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0143.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0143.json index 5b89a1ba4..61eac218f 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0143.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0143.json @@ -2,14 +2,7 @@ "name": "disAllowedVolumes", "file": "disAllowedVolumes.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "disAllowedVolumes", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0176.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0176.json index ee31bea12..52ab922a5 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0176.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0176.json @@ -2,14 +2,7 @@ "name": "kubeDashboardEnabled", "file": "kubeDashboardEnabled.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "kubeDashboardEnabled", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0177.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0177.json index db313318a..633e754e6 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0177.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-DS-PO-M-0177.json @@ -2,14 +2,7 @@ "name": "tillerDeployed", "file": "tillerDeployed.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "tillerDeployed", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0106.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0106.json index 40b83bd17..a0fc3413f 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0106.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0106.json @@ -2,14 +2,7 @@ "name": "priviledgedContainersEnabled", "file": "priviledgedContainersEnabled.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "priviledgedContainersEnabled", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0137.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0137.json index ee540735d..93bb7a1f5 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0137.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0137.json @@ -2,14 +2,7 @@ "name": "disallowedSysCalls", "file": "disallowedSysCalls.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "disallowedSysCalls", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0138.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0138.json index 861bab5d9..c71a1cb36 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0138.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0138.json @@ -2,14 +2,7 @@ "name": "allowedHostPath", "file": "allowedHostPath.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "allowedHostPath", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0168.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0168.json index 3f662464a..aaee536e1 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0168.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-H-0168.json @@ -2,14 +2,7 @@ "name": "runAsNonRootCheck", "file": "securityContextCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "allowed": "false", "arg1": "cpu", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0105.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0105.json index 4856fe82d..f03043efa 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0105.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0105.json @@ -2,14 +2,7 @@ "name": "autoMountTokenEnabled", "file": "autoMountTokenEnabled.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "autoMountTokenEnabled", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0135.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0135.json index 3639f4b45..a110b9ce0 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0135.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0135.json @@ -2,14 +2,7 @@ "name": "appArmorProfile", "file": "appArmorProfile.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "appArmorProfile", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0139.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0139.json index 971bbbc50..8e44bcc9d 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0139.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0139.json @@ -2,14 +2,7 @@ "name": "allowedProcMount", "file": "allowedProcMount.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "allowedProcMount", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0140.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0140.json index a25ab7a59..2381555ff 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0140.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0140.json @@ -2,14 +2,7 @@ "name": "readOnlyFileSystem", "file": "securityContextCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "allowed": "false", "arg1": "limits", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0141.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0141.json index dd6ff541f..eb8ea84b1 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0141.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0141.json @@ -2,14 +2,7 @@ "name": "secCompProfile", "file": "secCompProfile.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "secCompProfile", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0143.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0143.json index 57a39c213..49bb185bf 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0143.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0143.json @@ -2,14 +2,7 @@ "name": "allowedVolumes", "file": "allowedVolumes.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "allowedVolumes", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0162.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0162.json index 731d81d0a..129a5caeb 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0162.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PO-M-0162.json @@ -2,14 +2,7 @@ "name": "falseHostPID", "file": "specBoolCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "falseHostPID", "param": "hostPID", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PS-M-0112.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PS-M-0112.json index cac856a29..20a305503 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PS-M-0112.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-IA-PS-M-0112.json @@ -2,14 +2,7 @@ "name": "netRawCapabilityUsed", "file": "capabilityUsed.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "attribute": "requiredDropCapabilities", "name": "netRawCapabilityUsed", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-H-0117.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-H-0117.json index cbff19011..662b16fa6 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-H-0117.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-H-0117.json @@ -2,14 +2,7 @@ "name": "secretsAsEnvVariables", "file": "secretsAsEnvVariables.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "secretsAsEnvVariables", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-H-0170.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-H-0170.json index 593badf45..52ed447ac 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-H-0170.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-H-0170.json @@ -2,14 +2,7 @@ "name": "capSysAdminUsed", "file": "capSysAdminUsed.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "capSysAdminUsed", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0122.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0122.json index ba9fd61c2..13adaec72 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0122.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0122.json @@ -2,14 +2,7 @@ "name": "securityContextUsed", "file": "securityContextUsed.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "securityContextUsed", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0133.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0133.json index f1de41260..d38e60168 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0133.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0133.json @@ -2,14 +2,7 @@ "name": "imageWithoutDigest", "file": "imageWithoutDigest.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "imageWithoutDigest", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0163.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0163.json index a9283016b..52c54fb70 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0163.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0163.json @@ -2,14 +2,7 @@ "name": "falseHostIPC", "file": "specBoolCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "falseHostIPC", "param": "hostIPC", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0164.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0164.json index fea0dd18f..ab68b646e 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0164.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0164.json @@ -2,14 +2,7 @@ "name": "falseHostNetwork", "file": "specBoolCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "falseHostNetwork", "param": "hostNetwork", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0171.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0171.json index ff54f1f26..0c40f4df3 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0171.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0171.json @@ -2,14 +2,7 @@ "name": "dontConnectDockerSock", "file": "dockerSockCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "attrib": "spec.volumes[_].hostPath", "name": "dontConnectDockerSock", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0182.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0182.json index 6989dc9b5..3e427c218 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0182.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-NS-PO-M-0182.json @@ -2,14 +2,7 @@ "name": "containersAsHighUID", "file": "containersAsHighUID.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "containersAsHighUID", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0034.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0034.json index 4cf206059..672ded732 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0034.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0034.json @@ -2,14 +2,7 @@ "name": "alwaysPullImages", "file": "commandCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "argument": "--enable-admission-plugins", "name": "alwaysPullImages", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0155.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0155.json index c29aa53df..5a96a0048 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0155.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0155.json @@ -2,14 +2,7 @@ "name": "CpuRequestsCheck", "file": "securityContextCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "allowed": "true", "arg1": "requests", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0156.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0156.json index 58828735d..8b47a5f15 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0156.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0156.json @@ -2,14 +2,7 @@ "name": "CpulimitsCheck", "file": "securityContextCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "allowed": "true", "arg1": "limits", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0157.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0157.json index d7d9a851a..68bfdcfaa 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0157.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0157.json @@ -2,14 +2,7 @@ "name": "MemoryRequestsCheck", "file": "securityContextCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "allowed": "true", "arg1": "requests", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0158.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0158.json index d7ad78b01..73fe8bf26 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0158.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PK-M-0158.json @@ -2,14 +2,7 @@ "name": "MemorylimitsCheck", "file": "securityContextCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "allowed": "true", "arg1": "limits", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0129.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0129.json index 3932e19cf..1885819f6 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0129.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0129.json @@ -2,14 +2,7 @@ "name": "nolivenessProbe", "file": "probeCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "argument": "livenessProbe", "argumentTF": "liveness_probe", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0130.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0130.json index 219975845..94481c3a5 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0130.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0130.json @@ -2,14 +2,7 @@ "name": "noReadinessProbe", "file": "probeCheck.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "argument": "readinessProbe", "argumentTF": "readiness_probe", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0134.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0134.json index 53096b472..11b535ee7 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0134.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-L-0134.json @@ -2,14 +2,7 @@ "name": "imageWithLatestTag", "file": "imageWithLatestTag.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "imageWithLatestTag", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-M-0166.json b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-M-0166.json index 7f72c2f61..8451a7920 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-M-0166.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_pod/AC-K8-OE-PO-M-0166.json @@ -2,14 +2,7 @@ "name": "otherNamespace", "file": "otherNamespace.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_pod": true, - "kubernetes_deployment": true, - "kubernetes_replica_set": true, - "kubernetes_job": true, - "kubernetes_replication_controller": true, - "kubernetes_stateful_set": true - }, + "resource_type": "kubernetes_pod", "template_args": { "name": "otherNamespace", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_role/AC-K8-IA-RO-H-0104.json b/pkg/policies/opa/rego/k8s/kubernetes_role/AC-K8-IA-RO-H-0104.json index cbec63c5d..dec83a74c 100755 --- a/pkg/policies/opa/rego/k8s/kubernetes_role/AC-K8-IA-RO-H-0104.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_role/AC-K8-IA-RO-H-0104.json @@ -2,11 +2,7 @@ "name": "defaultServiceAccountUsed", "file": "defaultServiceAccountUsed.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_role": true, - "kubernetes_cluster_role": true, - "kubernetes_role_binding": true - }, + "resource_type": "kubernetes_role", "template_args": { "name": "defaultServiceAccountUsed", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SE-M-0185.json b/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SE-M-0185.json index 544a135c8..5febff1b3 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SE-M-0185.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SE-M-0185.json @@ -2,9 +2,7 @@ "name": "tillerServiceDeleted", "file": "tillerServiceDeleted.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_service": true - }, + "resource_type": "kubernetes_service", "template_args": { "name": "tillerServiceDeleted", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SE-M-0188.json b/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SE-M-0188.json index c5811e5cc..a9b1e394d 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SE-M-0188.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SE-M-0188.json @@ -2,9 +2,7 @@ "name": "ensurePrivateIP", "file": "ensurePrivateIP.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_service": true - }, + "resource_type": "kubernetes_service", "template_args": { "name": "ensurePrivateIP", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SV-L-0132.json b/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SV-L-0132.json index 3e7d8e593..7fb09f487 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SV-L-0132.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_service/AC-K8-NS-SV-L-0132.json @@ -2,9 +2,7 @@ "name": "nodePort", "file": "nodePort.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_service": true - }, + "resource_type": "kubernetes_service", "template_args": { "name": "nodePort", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_service/AC_K8S_0114.json b/pkg/policies/opa/rego/k8s/kubernetes_service/AC_K8S_0114.json index 694f7ee13..6220d9b7b 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_service/AC_K8S_0114.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_service/AC_K8S_0114.json @@ -2,9 +2,7 @@ "name": "ensureServiceWithSelector", "file": "ensureServiceWithSelector.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_service": true - }, + "resource_type": "kubernetes_service", "template_args": { "name": "ensureServiceWithSelector", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_service/cve_2020_8554/AC-K8-NS-SE-M-0188.json b/pkg/policies/opa/rego/k8s/kubernetes_service/cve_2020_8554/AC-K8-NS-SE-M-0188.json index 31e59cf0f..32facc0ed 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_service/cve_2020_8554/AC-K8-NS-SE-M-0188.json +++ b/pkg/policies/opa/rego/k8s/kubernetes_service/cve_2020_8554/AC-K8-NS-SE-M-0188.json @@ -2,9 +2,7 @@ "name": "ensurePrivateIP", "file": "ensurePrivateIP.rego", "policy_type": "k8s", - "resource_type": { - "kubernetes_service": true - }, + "resource_type": "kubernetes_service", "template_args": { "name": "ensurePrivateIP", "prefix": "", diff --git a/pkg/policies/opa/rego/k8s/kubernetes_service/cve_2020_8554/ensurePrivateIP.rego b/pkg/policies/opa/rego/k8s/kubernetes_service/cve_2020_8554/ensurePrivateIP.rego index 0d274a67a..e195b2885 100644 --- a/pkg/policies/opa/rego/k8s/kubernetes_service/cve_2020_8554/ensurePrivateIP.rego +++ b/pkg/policies/opa/rego/k8s/kubernetes_service/cve_2020_8554/ensurePrivateIP.rego @@ -1,7 +1,7 @@ package accurics {{.prefix}}{{.name}}{{.suffix}}[service.id] { - service := input.kubernetes_service[_] + service := input.{{.resource_type}}[_] type_check(service.config.spec) object.get(service.config.spec, "externalIPs", "undefined") != "undefined" } diff --git a/pkg/policies/opa/rego/policy_test.go b/pkg/policies/opa/rego/policy_test.go index f3ab69671..477bf0cef 100644 --- a/pkg/policies/opa/rego/policy_test.go +++ b/pkg/policies/opa/rego/policy_test.go @@ -99,7 +99,7 @@ func validateRequiredFields(regoMetadata *policy.RegoMetadata, filepath string, if regoMetadata.PolicyType == "" { validationErrorLogger("policy_type", filepath, t) } - if len(regoMetadata.ResourceType) == 0 { + if regoMetadata.ResourceType == "" { validationErrorLogger("resource_type", filepath, t) } if regoMetadata.Severity == "" { diff --git a/pkg/policy/types.go b/pkg/policy/types.go index 4e3a0216b..98ab9ea1f 100644 --- a/pkg/policy/types.go +++ b/pkg/policy/types.go @@ -52,7 +52,7 @@ type RegoMetadata struct { Name string `json:"name"` File string `json:"file"` PolicyType string `json:"policy_type"` - ResourceType map[string]bool `json:"resource_type"` + ResourceType string `json:"resource_type"` TemplateArgs map[string]interface{} `json:"template_args"` Severity string `json:"severity"` Description string `json:"description"` diff --git a/test/e2e/scan/scan_docker_file_test.go b/test/e2e/scan/scan_docker_file_test.go index 56072d775..bfb7b1285 100644 --- a/test/e2e/scan/scan_docker_file_test.go +++ b/test/e2e/scan/scan_docker_file_test.go @@ -50,7 +50,7 @@ var _ = Describe("Scan is run for dockerfile directories and files", func() { Context("scan iac directories violating dockerfile policies", func() { Context("iac type docker will be part of all iac", func() { When("docker files are scanned but iac type is not specified", func() { - PIt("should scan all iac and display violations", func() { + It("should scan all iac and display violations", func() { scanArgs := []string{scanUtils.ScanCommand, "-d", iacDir} session = helper.RunCommand(terrascanBinaryPath, outWriter, errWriter, scanArgs...) // exit code is 5 because iac files in directory has violations diff --git a/test/e2e/scan/scan_k8s_files_test.go b/test/e2e/scan/scan_k8s_files_test.go index 7cd1acc0b..bebab49dd 100644 --- a/test/e2e/scan/scan_k8s_files_test.go +++ b/test/e2e/scan/scan_k8s_files_test.go @@ -50,7 +50,7 @@ var _ = Describe("Scan is run for k8s directories and files", func() { Context("scan iac directories violating k8s policies", func() { Context("iac type k8s will be part of all iac", func() { When("k8s files are scanned but iac type is not specified", func() { - PIt("should scan will all iac and display violations", func() { + It("should scan will all iac and display violations", func() { scanArgs := []string{scanUtils.ScanCommand, "-d", iacDir} session = helper.RunCommand(terrascanBinaryPath, outWriter, errWriter, scanArgs...) // exit code is 5 because iac files in directory has violations diff --git a/test/e2e/scan/scan_remote_test.go b/test/e2e/scan/scan_remote_test.go index f37de0e84..30af67ebb 100644 --- a/test/e2e/scan/scan_remote_test.go +++ b/test/e2e/scan/scan_remote_test.go @@ -136,7 +136,7 @@ var _ = Describe("Scan Command using remote types", func() { Context("valid remote type is supplied with valid remote URL", func() { When("remote type is git", func() { remoteURL := "github.com/accurics/KaiMonkey/terraform/aws" - PIt("should download the resource and generate scan results", func() { + It("should download the resource and generate scan results", func() { scanArgs := []string{scanUtils.ScanCommand, "-r", "git", "--remote-url", remoteURL} session = helper.RunCommand(terrascanBinaryPath, outWriter, errWriter, scanArgs...) // exit code is 5 because iac files in directory has violations @@ -144,7 +144,7 @@ var _ = Describe("Scan Command using remote types", func() { Eventually(session, scanUtils.RemoteScanTimeout).Should(gexec.Exit(helper.ExitCodeFive)) }) - PIt("should download the resource and generate scan results", func() { + It("should download the resource and generate scan results", func() { remoteURL := "https://github.com/accurics/KaiMonkey.git//terraform/aws" scanArgs := []string{scanUtils.ScanCommand, "-r", "git", "--remote-url", remoteURL} session = helper.RunCommand(terrascanBinaryPath, outWriter, errWriter, scanArgs...) diff --git a/test/e2e/scan/scan_test.go b/test/e2e/scan/scan_test.go index f218a8198..b082170f7 100644 --- a/test/e2e/scan/scan_test.go +++ b/test/e2e/scan/scan_test.go @@ -106,7 +106,7 @@ var _ = Describe("Scan", func() { }) }) Context("tf files are present in the working directory", func() { - PIt("should scan the directory, return results and exit with status code 3 as there would no directory scan errors", func() { + It("should scan the directory, return results and exit with status code 3 as there would no directory scan errors", func() { workDir, err := filepath.Abs(filepath.Join(awsIacRelPath, "aws_ami_violation")) Expect(err).NotTo(HaveOccurred()) diff --git a/test/e2e/scan/scan_tf_files_test.go b/test/e2e/scan/scan_tf_files_test.go index 12f342379..531a50f7c 100644 --- a/test/e2e/scan/scan_tf_files_test.go +++ b/test/e2e/scan/scan_tf_files_test.go @@ -54,7 +54,7 @@ var _ = Describe("Scan is run for terraform files", func() { }) When("terraform iac provider is used", func() { - PIt("should scan successfully and exit with status code 3", func() { + It("should scan successfully and exit with status code 3", func() { scanArgs := []string{scanUtils.ScanCommand, "-d", iacDir, "-i", "terraform"} session = helper.RunCommand(terrascanBinaryPath, outWriter, errWriter, scanArgs...) Eventually(session, scanUtils.ScanTimeout).Should(gexec.Exit(helper.ExitCodeThree)) @@ -63,14 +63,14 @@ var _ = Describe("Scan is run for terraform files", func() { Context("default iac version for terraform is v14", func() { When("iac version is v12", func() { - PIt("terrascan should display the warning message related to version", func() { + It("terrascan should display the warning message related to version", func() { scanArgs := []string{scanUtils.ScanCommand, "-d", iacDir, "-i", "terraform", "--iac-version", "v12"} scanUtils.RunScanAndAssertErrorMessage(terrascanBinaryPath, helper.ExitCodeThree, scanUtils.ScanTimeout, backwardsCompatibilityWarningMessage, outWriter, errWriter, scanArgs...) }) }) When("iac version is v13", func() { - PIt("terrascan should not display the warning message related to version", func() { + It("terrascan should not display the warning message related to version", func() { scanArgs := []string{scanUtils.ScanCommand, "-d", iacDir, "-i", "terraform", "--iac-version", "v13"} session = helper.RunCommand(terrascanBinaryPath, outWriter, errWriter, scanArgs...) Eventually(session, scanUtils.ScanTimeout).Should(gexec.Exit(helper.ExitCodeThree)) diff --git a/test/e2e/test_data/policies/docker/docker_from/AC_DOCKER_0001.json b/test/e2e/test_data/policies/docker/docker_from/AC_DOCKER_0001.json index bdb223b34..d458f05e8 100644 --- a/test/e2e/test_data/policies/docker/docker_from/AC_DOCKER_0001.json +++ b/test/e2e/test_data/policies/docker/docker_from/AC_DOCKER_0001.json @@ -2,18 +2,16 @@ "name": "docFilePlatformFlag", "file": "docFilePlatformFlag.rego", "policy_type": "docker", - "resource_type": { - "docker_from": true - }, + "resource_type": "docker_from", "template_args": { - "name": "docFilePlatformFlag", "prefix": "", - "suffix": "" + "suffix": "", + "name": "docFilePlatformFlag" }, "severity": "MEDIUM", "description": "Ensure platform flag with FROM command is not used for Docker file", "reference_id": "AC_DOCKER_0001", "category": "Infrastructure Security", - "version": 1, - "id": "AC_DOCKER_0001" + "id": "AC_DOCKER_0001", + "version": 1 } \ No newline at end of file