diff --git a/LICENSE b/LICENSE index 261eeb9..feacccb 100644 --- a/LICENSE +++ b/LICENSE @@ -186,7 +186,7 @@ same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright [yyyy] [name of copyright owner] + Copyright [2021] [Open Raven Inc.] Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/README.md b/README.md index 9597b43..8c8220c 100644 --- a/README.md +++ b/README.md @@ -1,2 +1 @@ -# cspm-kb -Magpie CSPM Policy Knowledge Base +# @GIANT WIP diff --git a/rules/aws_account_security_questions_registered.yaml b/rules/aws_account_security_questions_registered.yaml index e9696e6..47950ac 100644 --- a/rules/aws_account_security_questions_registered.yaml +++ b/rules/aws_account_security_questions_registered.yaml @@ -24,6 +24,6 @@ remediation: > o Follow process for all 3 questions 7. Click Update when complete 8. Place Questions and Answers and place in a secure physical location -remediationDocURLs: - - https://docs.openraven.com/remediations/ensure_AWS_account_security_questions_registered +# remediationDocURLs: +# - https://docs.openraven.com/remediations/ensure_AWS_account_security_questions_registered version: 0.1.3 diff --git a/rules/aws_avoid_use_of_root_account.yaml b/rules/aws_avoid_use_of_root_account.yaml index 691ebcf..2bec23f 100644 --- a/rules/aws_avoid_use_of_root_account.yaml +++ b/rules/aws_avoid_use_of_root_account.yaml @@ -12,6 +12,6 @@ enabled: true remediation: > Follow the remediation instructions of the Ensure IAM policies are attached only to groups or roles recommendation -remediationDocURLs: - - https://docs.openraven.com/remediations/avoid_use_of_root_account +# remediationDocURLs: +# - https://docs.openraven.com/remediations/avoid_use_of_root_account version: 0.1.3 diff --git a/rules/aws_cloudtrail_enabled_in_all_regions.yaml b/rules/aws_cloudtrail_enabled_in_all_regions.yaml index b61ea5b..a4de9c6 100644 --- a/rules/aws_cloudtrail_enabled_in_all_regions.yaml +++ b/rules/aws_cloudtrail_enabled_in_all_regions.yaml @@ -47,6 +47,6 @@ remediation: > aws cloudtrail update-trail --name --is-multi-region-trail Note: Creating CloudTrail via CLI without providing any overriding options configures Management Events to set All type of Read/Writes by default. -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_global_trail +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_global_trail version: 0.1.3 diff --git a/rules/aws_cloudtrail_log_file_validation_enabled.yaml b/rules/aws_cloudtrail_log_file_validation_enabled.yaml index e620a3e..c8fe6c2 100644 --- a/rules/aws_cloudtrail_log_file_validation_enabled.yaml +++ b/rules/aws_cloudtrail_log_file_validation_enabled.yaml @@ -31,6 +31,6 @@ remediation: > Note that periodic validation of logs using these digests can be performed by running the following command: aws cloudtrail validate-logs --trail-arn --start-time --end-time -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_CloudTrail_log_file_validation +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_CloudTrail_log_file_validation version: 0.1.3 diff --git a/rules/aws_cloudtrail_logs_encrypted_using_kms_cmks.yaml b/rules/aws_cloudtrail_logs_encrypted_using_kms_cmks.yaml index 928931c..4fc638c 100644 --- a/rules/aws_cloudtrail_logs_encrypted_using_kms_cmks.yaml +++ b/rules/aws_cloudtrail_logs_encrypted_using_kms_cmks.yaml @@ -42,6 +42,6 @@ remediation: > aws kms put-key-policy --key-id --policy -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_KMS_log_encryption +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_KMS_log_encryption version: 0.1.3 diff --git a/rules/aws_config_enabled_in_all_regions.yaml b/rules/aws_config_enabled_in_all_regions.yaml index a00cf36..33f9165 100644 --- a/rules/aws_config_enabled_in_all_regions.yaml +++ b/rules/aws_config_enabled_in_all_regions.yaml @@ -39,6 +39,6 @@ remediation: > arn:aws:iam::012345678912:role/myConfigRole 3. Run this command to start the configuration recorder: start-configuration-recorder --configuration-recorder-name -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_AWS_Config_in_all_regions +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_AWS_Config_in_all_regions version: 0.1.3 diff --git a/rules/aws_default_security_groups_restrict_all_traffic.yaml b/rules/aws_default_security_groups_restrict_all_traffic.yaml index 4f54baf..2cb935f 100644 --- a/rules/aws_default_security_groups_restrict_all_traffic.yaml +++ b/rules/aws_default_security_groups_restrict_all_traffic.yaml @@ -43,6 +43,6 @@ remediation: > Recommended: IAM groups allow you to edit the "name" field. After remediating default groups rules for all VPCs in all regions, edit this field to add text similar to "DO NOT USE. DO NOT ADD RULES" -remediationDocURLs: - - https://docs.openraven.com/remediations/default_sec_group_restrict_traffic +# remediationDocURLs: +# - https://docs.openraven.com/remediations/default_sec_group_restrict_traffic version: 0.1.3 diff --git a/rules/aws_disable_unused_credentials_after_90_days.yaml b/rules/aws_disable_unused_credentials_after_90_days.yaml index 4a0a33d..350546c 100644 --- a/rules/aws_disable_unused_credentials_after_90_days.yaml +++ b/rules/aws_disable_unused_credentials_after_90_days.yaml @@ -39,6 +39,6 @@ remediation: > - Click on Make Inactive for credentials that have not been used in 90 Days 7. As an IAM User - Click on Make Inactive or Delete for credentials which have not been used in 90 -remediationDocURLs: - - https://docs.openraven.com/remediations/unused_credentials +# remediationDocURLs: +# - https://docs.openraven.com/remediations/unused_credentials version: 0.1.3 diff --git a/rules/aws_ec2_ebs_volume_with_no_snapshot.yaml b/rules/aws_ec2_ebs_volume_with_no_snapshot.yaml index 3bd8d94..fd35b82 100644 --- a/rules/aws_ec2_ebs_volume_with_no_snapshot.yaml +++ b/rules/aws_ec2_ebs_volume_with_no_snapshot.yaml @@ -31,5 +31,5 @@ remediation: > (Optional) Enter a description for the snapshot. (Optional) Choose Add Tag to add tags to your snapshot. For each tag, provide a tag key and a tag value. 6. Choose Create Snapshot. -remediationDocURLs: - - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html +# remediationDocURLs: +# - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html diff --git a/rules/aws_flow_logging_enabled_in_all_vpcs.yaml b/rules/aws_flow_logging_enabled_in_all_vpcs.yaml index 0809f38..94851b8 100644 --- a/rules/aws_flow_logging_enabled_in_all_vpcs.yaml +++ b/rules/aws_flow_logging_enabled_in_all_vpcs.yaml @@ -52,6 +52,6 @@ remediation: > the logs to a cheaper storage service rather than simply deleting them. See the following AWS resource to manage CloudWatch Logs retention periods: 1. http://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/SettingLogRetention.html -remediationDocURLs: - - https://docs.openraven.com/remediations/ensure_flow_logging_enabled_in_all_VPCs +# remediationDocURLs: +# - https://docs.openraven.com/remediations/ensure_flow_logging_enabled_in_all_VPCs version: 0.1.3 diff --git a/rules/aws_guard_duty_enabled.yaml b/rules/aws_guard_duty_enabled.yaml index b695c80..98c8028 100644 --- a/rules/aws_guard_duty_enabled.yaml +++ b/rules/aws_guard_duty_enabled.yaml @@ -24,5 +24,6 @@ sql: > remediation: > Perform the following steps under the below link to enable GuardDuty: https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html - - +# remediationDocURLs: +# - https://docs.openraven.com/remediations/unused_credentials +version: 0.1.3 diff --git a/rules/aws_hardware_mfa_enabled_for_root_account.yaml b/rules/aws_hardware_mfa_enabled_for_root_account.yaml index 2b373ac..682d37f 100644 --- a/rules/aws_hardware_mfa_enabled_for_root_account.yaml +++ b/rules/aws_hardware_mfa_enabled_for_root_account.yaml @@ -39,6 +39,6 @@ remediation: > 8. Choose Next Step . The MFA device is now associated with the AWS account. The next time you use your AWS account credentials to sign in, you must type a code from the hardware MFA device. -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_hardware_MFA_for_root_account +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_hardware_MFA_for_root_account version: 0.1.3 diff --git a/rules/aws_iam_password_policy_passwords_rotation_or_expiration.yaml b/rules/aws_iam_password_policy_passwords_rotation_or_expiration.yaml index bf9b0f3..406c9a4 100644 --- a/rules/aws_iam_password_policy_passwords_rotation_or_expiration.yaml +++ b/rules/aws_iam_password_policy_passwords_rotation_or_expiration.yaml @@ -28,6 +28,6 @@ remediation: > aws iam update-account-password-policy --max-password-age 90 Note: All commands starting with "aws iam update-account-password-policy" have be combined into a single command in order to all of them to take effect -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_password_expiration_requirement +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_password_expiration_requirement version: 0.1.3 diff --git a/rules/aws_iam_password_policy_prevents_password_reuse.yaml b/rules/aws_iam_password_policy_prevents_password_reuse.yaml index 7673b80..2a3070a 100644 --- a/rules/aws_iam_password_policy_prevents_password_reuse.yaml +++ b/rules/aws_iam_password_policy_prevents_password_reuse.yaml @@ -27,6 +27,6 @@ remediation: > aws iam update-account-password-policy --password-reuse-prevention 24 Note: All commands starting with "aws iam update-account-password-policy" have be combined into a single command in order to all of them to take effect -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_password_minimum_lenght_requirement +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_password_minimum_lenght_requirement version: 0.1.3 diff --git a/rules/aws_iam_password_policy_require_number.yaml b/rules/aws_iam_password_policy_require_number.yaml index 71fcc52..3a29918 100644 --- a/rules/aws_iam_password_policy_require_number.yaml +++ b/rules/aws_iam_password_policy_require_number.yaml @@ -28,6 +28,6 @@ remediation: > aws iam update-account-password-policy --require-numbers Note: All commands starting with "aws iam update-account-password-policy" have be combined into a single command in order to all of them to take effect -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_password_number_requirement +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_password_number_requirement version: 0.1.3 diff --git a/rules/aws_iam_password_policy_require_symbol.yaml b/rules/aws_iam_password_policy_require_symbol.yaml index 3a89502..ecea644 100644 --- a/rules/aws_iam_password_policy_require_symbol.yaml +++ b/rules/aws_iam_password_policy_require_symbol.yaml @@ -28,6 +28,6 @@ remediation: > aws iam update-account-password-policy --require-symbols Note: All commands starting with "aws iam update-account-password-policy" have be combined into a single command in order to all of them to take effect -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_password_symbol_requirement +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_password_symbol_requirement version: 0.1.3 diff --git a/rules/aws_iam_password_policy_requires_lowercase_letter.yaml b/rules/aws_iam_password_policy_requires_lowercase_letter.yaml index 9815eb6..ce86508 100644 --- a/rules/aws_iam_password_policy_requires_lowercase_letter.yaml +++ b/rules/aws_iam_password_policy_requires_lowercase_letter.yaml @@ -27,6 +27,6 @@ remediation: > aws iam update-account-password-policy --require-lowercase-characters Note: All commands starting with "aws iam update-account-password-policy" have be combined into a single command in order to all of them to take effect -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_password_lowercase_requirement +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_password_lowercase_requirement version: 0.1.3 diff --git a/rules/aws_iam_password_policy_requires_min_length_14.yaml b/rules/aws_iam_password_policy_requires_min_length_14.yaml index 6b3c922..df9a9ac 100644 --- a/rules/aws_iam_password_policy_requires_min_length_14.yaml +++ b/rules/aws_iam_password_policy_requires_min_length_14.yaml @@ -28,6 +28,6 @@ remediation: > aws iam update-account-password-policy --minimum-password-length 14 Note: All commands starting with "aws iam update-account-password-policy" have be combined into a single command in order to all of them to take effect -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_password_minimum_lenght_requirement +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_password_minimum_lenght_requirement version: 0.1.3 diff --git a/rules/aws_iam_password_policy_requires_uppercase_letter.yaml b/rules/aws_iam_password_policy_requires_uppercase_letter.yaml index 9b8732a..108f0a5 100644 --- a/rules/aws_iam_password_policy_requires_uppercase_letter.yaml +++ b/rules/aws_iam_password_policy_requires_uppercase_letter.yaml @@ -27,6 +27,6 @@ remediation: > aws iam update-account-password-policy --require-uppercase-characters Note: All commands starting with "aws iam update-account-password-policy" have be combined into a single command in order to all of them to take effect -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_password_uppercase_requirement +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_password_uppercase_requirement version: 0.1.3 diff --git a/rules/aws_iam_policies_attached_only_to_groups_or_roles.yaml b/rules/aws_iam_policies_attached_only_to_groups_or_roles.yaml index 8153cd4..8a4bd2b 100644 --- a/rules/aws_iam_policies_attached_only_to_groups_or_roles.yaml +++ b/rules/aws_iam_policies_attached_only_to_groups_or_roles.yaml @@ -43,6 +43,6 @@ remediation: > 4. Click Detach Policy for each policy 5. Expand Inline Policies 6. Click Remove Policy for each policy -remediationDocURLs: - - https://docs.openraven.com/remediations/detach_IAM_policies_from_users +# remediationDocURLs: +# - https://docs.openraven.com/remediations/detach_IAM_policies_from_users version: 0.1.3 diff --git a/rules/aws_iam_roles_for_resource_access_from_instances.yaml b/rules/aws_iam_roles_for_resource_access_from_instances.yaml index 5a330a5..0e2a6f7 100644 --- a/rules/aws_iam_roles_for_resource_access_from_instances.yaml +++ b/rules/aws_iam_roles_for_resource_access_from_instances.yaml @@ -33,6 +33,6 @@ remediation: > on dynamically assigned public IP addresses are a bad practice and, if possible, you may wish to rebuild the instance with a new elastic IP address and make the investment to remediate affected systems while assigning the system to a role. -remediationDocURLs: - - https://docs.openraven.com/remediations/ensure_IAM_roles_used_for_resource_access_from_instances +# remediationDocURLs: +# - https://docs.openraven.com/remediations/ensure_IAM_roles_used_for_resource_access_from_instances version: 0.1.3 diff --git a/rules/aws_iam_stale_roles_ap_with_s3_access.yaml b/rules/aws_iam_stale_roles_ap_with_s3_access.yaml index 78cba1f..bca1156 100644 --- a/rules/aws_iam_stale_roles_ap_with_s3_access.yaml +++ b/rules/aws_iam_stale_roles_ap_with_s3_access.yaml @@ -34,6 +34,6 @@ remediation: > If the task fails, you can choose View details or View Resources from the notifications to learn why the deletion failed. If the deletion fails because the role is using the service's resources, then the notification includes a list of resources, if the service returns that information. You can then clean up the resources and submit the deletion again. -remediationDocURLs: - - https://aws.amazon.com/blogs/security/identify-unused-iam-roles-remove-confidently-last-used-timestamp/ +# remediationDocURLs: +# - https://aws.amazon.com/blogs/security/identify-unused-iam-roles-remove-confidently-last-used-timestamp/ - https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role diff --git a/rules/aws_iam_stale_roles_ip_with_s3_access.yaml b/rules/aws_iam_stale_roles_ip_with_s3_access.yaml index 19c5504..bfb24d9 100644 --- a/rules/aws_iam_stale_roles_ip_with_s3_access.yaml +++ b/rules/aws_iam_stale_roles_ip_with_s3_access.yaml @@ -34,6 +34,6 @@ remediation: > If the task fails, you can choose View details or View Resources from the notifications to learn why the deletion failed. If the deletion fails because the role is using the service's resources, then the notification includes a list of resources, if the service returns that information. You can then clean up the resources and submit the deletion again. -remediationDocURLs: - - https://aws.amazon.com/blogs/security/identify-unused-iam-roles-remove-confidently-last-used-timestamp/ +# remediationDocURLs: +# - https://aws.amazon.com/blogs/security/identify-unused-iam-roles-remove-confidently-last-used-timestamp/ - https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role diff --git a/rules/aws_maintain_current_contact_details.yaml b/rules/aws_maintain_current_contact_details.yaml index 39a7530..08bd966 100644 --- a/rules/aws_maintain_current_contact_details.yaml +++ b/rules/aws_maintain_current_contact_details.yaml @@ -29,6 +29,6 @@ remediation: > - To edit your contact information, under Contact Information, choose Edit. - For the fields that you want to change, type your updated information, and then choose Update. -remediationDocURLs: - - https://docs.openraven.com/remediations/maintain_current_contact_details +# remediationDocURLs: +# - https://docs.openraven.com/remediations/maintain_current_contact_details version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_aws_config_changes.yaml b/rules/aws_metric_filter_and_alarm_aws_config_changes.yaml index 5318a47..117ec04 100644 --- a/rules/aws_metric_filter_and_alarm_aws_config_changes.yaml +++ b/rules/aws_metric_filter_and_alarm_aws_config_changes.yaml @@ -81,6 +81,6 @@ remediation: > aws cloudwatch put-metric-alarm --alarm-name `` - -metric-name `` --statistic Sum --period 300 -- threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluationperiods 1 --namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_AWS_Config_config_changes +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_AWS_Config_config_changes version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_aws_mc_auth_failures.yaml b/rules/aws_metric_filter_and_alarm_aws_mc_auth_failures.yaml index d3fbb2b..48e7ada 100644 --- a/rules/aws_metric_filter_and_alarm_aws_mc_auth_failures.yaml +++ b/rules/aws_metric_filter_and_alarm_aws_mc_auth_failures.yaml @@ -78,6 +78,6 @@ remediation: > `` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 -- namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_AWS_MC_auth_failures +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_AWS_MC_auth_failures version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_cloudtrail_config_changes.yaml b/rules/aws_metric_filter_and_alarm_cloudtrail_config_changes.yaml index 7cfe2c2..bf67ac3 100644 --- a/rules/aws_metric_filter_and_alarm_cloudtrail_config_changes.yaml +++ b/rules/aws_metric_filter_and_alarm_cloudtrail_config_changes.yaml @@ -81,6 +81,6 @@ remediation: > `` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 -- namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_CloudTrail_config_changes +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_CloudTrail_config_changes version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_console_sign_in_without_mfa.yaml b/rules/aws_metric_filter_and_alarm_console_sign_in_without_mfa.yaml index b635546..fcd844c 100644 --- a/rules/aws_metric_filter_and_alarm_console_sign_in_without_mfa.yaml +++ b/rules/aws_metric_filter_and_alarm_console_sign_in_without_mfa.yaml @@ -78,6 +78,6 @@ remediation: > --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold -- evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_Management_Console_sign_in_without_MFA +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_Management_Console_sign_in_without_MFA version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_disabling_deletion_cmks.yaml b/rules/aws_metric_filter_and_alarm_disabling_deletion_cmks.yaml index eee90b3..472e63a 100644 --- a/rules/aws_metric_filter_and_alarm_disabling_deletion_cmks.yaml +++ b/rules/aws_metric_filter_and_alarm_disabling_deletion_cmks.yaml @@ -77,6 +77,6 @@ remediation: > `` --metric-name `` --statistic Sum --period 300 -- threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluationperiods 1 --namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_disabling_deletion_CMKs +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_disabling_deletion_CMKs version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_gateways_changes.yaml b/rules/aws_metric_filter_and_alarm_gateways_changes.yaml index 70437de..f9b1a3b 100644 --- a/rules/aws_metric_filter_and_alarm_gateways_changes.yaml +++ b/rules/aws_metric_filter_and_alarm_gateways_changes.yaml @@ -81,6 +81,6 @@ remediation: > aws cloudwatch put-metric-alarm --alarm-name `` - -metric-name `` --statistic Sum --period 300 -- threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluationperiods 1 --namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_network_gateways_changes +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_network_gateways_changes version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_iam_policy_changes.yaml b/rules/aws_metric_filter_and_alarm_iam_policy_changes.yaml index cdbd32e..c68fb22 100644 --- a/rules/aws_metric_filter_and_alarm_iam_policy_changes.yaml +++ b/rules/aws_metric_filter_and_alarm_iam_policy_changes.yaml @@ -87,6 +87,6 @@ remediation: > metric-name `` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_IAM_policy_changes +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_IAM_policy_changes version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_nacl_changes.yaml b/rules/aws_metric_filter_and_alarm_nacl_changes.yaml index be23063..4207079 100644 --- a/rules/aws_metric_filter_and_alarm_nacl_changes.yaml +++ b/rules/aws_metric_filter_and_alarm_nacl_changes.yaml @@ -79,6 +79,6 @@ remediation: > aws cloudwatch put-metric-alarm --alarm-name `` -- metric-name `` --statistic Sum --period 300 -- threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluationperiods 1 --namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_NACL_changes +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_NACL_changes version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_root_account_usage.yaml b/rules/aws_metric_filter_and_alarm_root_account_usage.yaml index a08532e..3d55cb3 100644 --- a/rules/aws_metric_filter_and_alarm_root_account_usage.yaml +++ b/rules/aws_metric_filter_and_alarm_root_account_usage.yaml @@ -73,6 +73,6 @@ remediation: > aws cloudwatch put-metric-alarm --alarm-name `` --metricname `` --statistic Sum --period 300 --threshold 1 -- comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 -- namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_root_account_usage +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_root_account_usage version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_route_table_changes.yaml b/rules/aws_metric_filter_and_alarm_route_table_changes.yaml index f878bef..3843bf5 100644 --- a/rules/aws_metric_filter_and_alarm_route_table_changes.yaml +++ b/rules/aws_metric_filter_and_alarm_route_table_changes.yaml @@ -82,6 +82,6 @@ remediation: > -threshold 1 --comparison-operator GreaterThanOrEqualToThreshold -- evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_route_table_changes +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_route_table_changes version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_s3_buckets_policy_changes.yaml b/rules/aws_metric_filter_and_alarm_s3_buckets_policy_changes.yaml index aeee247..6a2a17f 100644 --- a/rules/aws_metric_filter_and_alarm_s3_buckets_policy_changes.yaml +++ b/rules/aws_metric_filter_and_alarm_s3_buckets_policy_changes.yaml @@ -86,6 +86,6 @@ remediation: > `` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_S3_buckets_policy_changes +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_S3_buckets_policy_changes version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_security_group_changes.yaml b/rules/aws_metric_filter_and_alarm_security_group_changes.yaml index 6db3fea..ffc8404 100644 --- a/rules/aws_metric_filter_and_alarm_security_group_changes.yaml +++ b/rules/aws_metric_filter_and_alarm_security_group_changes.yaml @@ -82,6 +82,6 @@ remediation: > `` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 -- namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_security_group_changes +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_security_group_changes version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_unauthorized_api_calls.yaml b/rules/aws_metric_filter_and_alarm_unauthorized_api_calls.yaml index c698d44..cf827e7 100644 --- a/rules/aws_metric_filter_and_alarm_unauthorized_api_calls.yaml +++ b/rules/aws_metric_filter_and_alarm_unauthorized_api_calls.yaml @@ -77,6 +77,6 @@ remediation: > `` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 -- namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_unauthorized_API_calls +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_unauthorized_API_calls version: 0.1.3 diff --git a/rules/aws_metric_filter_and_alarm_vpc_changes.yaml b/rules/aws_metric_filter_and_alarm_vpc_changes.yaml index c510fe2..7615541 100644 --- a/rules/aws_metric_filter_and_alarm_vpc_changes.yaml +++ b/rules/aws_metric_filter_and_alarm_vpc_changes.yaml @@ -86,6 +86,6 @@ remediation: > metric-name `` --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions -remediationDocURLs: - - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_VPC_changes +# remediationDocURLs: +# - https://docs.openraven.com/remediations/log_metric_filter_and_alarm_for_VPC_changes version: 0.1.3 diff --git a/rules/aws_mfa_enabled_for_root_account.yaml b/rules/aws_mfa_enabled_for_root_account.yaml index 58e4a2d..2f143e2 100644 --- a/rules/aws_mfa_enabled_for_root_account.yaml +++ b/rules/aws_mfa_enabled_for_root_account.yaml @@ -43,6 +43,6 @@ remediation: > 1. In the Manage MFA Device wizard, in the Authentication Code 1 box, type the onetime password that currently appears in the virtual MFA device. Wait up to 30 seconds for the device to generate a new one-time password. Then type the second one-time password into the Authentication Code 2 box. Choose Active Virtual MFA. -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_MFA_for_root_account +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_MFA_for_root_account version: 0.1.3 diff --git a/rules/aws_mfa_with_console_password.yaml b/rules/aws_mfa_with_console_password.yaml index 94c454f..ba4706b 100644 --- a/rules/aws_mfa_with_console_password.yaml +++ b/rules/aws_mfa_with_console_password.yaml @@ -25,6 +25,6 @@ remediation: > 3. In the User Name list, choose the name of the intended MFA user. 4. Choose the Security Credentials tab, and then choose Manage MFA Device. 5. In the Manage MFA Device wizard, choose A virtual MFA device, and then choose Next Step. -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_mfa +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_mfa version: 0.1.3 diff --git a/rules/aws_no_access_keys_initially.yaml b/rules/aws_no_access_keys_initially.yaml index 701c217..555d3c5 100644 --- a/rules/aws_no_access_keys_initially.yaml +++ b/rules/aws_no_access_keys_initially.yaml @@ -35,6 +35,6 @@ remediation: > have not been used. Via CLI aws iam delete-access-key -remediationDocURLs: - - https://docs.openraven.com/remediations/no_initial_access_key_for_IAM_with_console_password +# remediationDocURLs: +# - https://docs.openraven.com/remediations/no_initial_access_key_for_IAM_with_console_password version: 0.1.3 diff --git a/rules/aws_no_full_administrative_privileges_policies.yaml b/rules/aws_no_full_administrative_privileges_policies.yaml index 8c4d591..78a1fca 100644 --- a/rules/aws_no_full_administrative_privileges_policies.yaml +++ b/rules/aws_no_full_administrative_privileges_policies.yaml @@ -57,6 +57,6 @@ remediation: > aws iam detach-group-policy --group-name --policy-arn 4. Detach the policy from all IAM Roles: aws iam detach-role-policy --role-name --policy-arn -remediationDocURLs: - - https://docs.openraven.com/remediations/no_full_admin_privileges_IAM_policies_created +# remediationDocURLs: +# - https://docs.openraven.com/remediations/no_full_admin_privileges_IAM_policies_created version: 0.1.3 diff --git a/rules/aws_no_root_account_access_key.yaml b/rules/aws_no_root_account_access_key.yaml index 6c22885..45b85eb 100644 --- a/rules/aws_no_root_account_access_key.yaml +++ b/rules/aws_no_root_account_access_key.yaml @@ -26,6 +26,6 @@ remediation: > 5. Under the Status column if there are any Keys which are Active 1. Click on Make Inactive - (Temporarily disable Key - may be needed again) 2. Click Delete - (Deleted keys cannot be recovered) -remediationDocURLs: - - https://docs.openraven.com/remediations/delete_root_account_access_keys +# remediationDocURLs: +# - https://docs.openraven.com/remediations/delete_root_account_access_keys version: 0.1.3 diff --git a/rules/aws_no_unrestricted_ssh_access.yaml b/rules/aws_no_unrestricted_ssh_access.yaml index 860620b..612f563 100644 --- a/rules/aws_no_unrestricted_ssh_access.yaml +++ b/rules/aws_no_unrestricted_ssh_access.yaml @@ -42,6 +42,6 @@ remediation: > 6. Identify the rules to be removed 7. Click the x in the Remove column 8. Click Save -remediationDocURLs: - - https://docs.openraven.com/remediations/ensure_limited_SSH_ingress +# remediationDocURLs: +# - https://docs.openraven.com/remediations/ensure_limited_SSH_ingress version: 0.1.3 diff --git a/rules/aws_no_unrestricted_tcp_udp_access.yaml b/rules/aws_no_unrestricted_tcp_udp_access.yaml index db7beac..edf830a 100644 --- a/rules/aws_no_unrestricted_tcp_udp_access.yaml +++ b/rules/aws_no_unrestricted_tcp_udp_access.yaml @@ -42,6 +42,6 @@ remediation: > 6. Identify the rules to be removed 7. Click the x in the Remove column 8. Click Save -remediationDocURLs: - - https://docs.openraven.com/remediations/ensure_limited_TCP_UDP_ingress +# remediationDocURLs: +# - https://docs.openraven.com/remediations/ensure_limited_TCP_UDP_ingress version: 0.1.3 diff --git a/rules/aws_peering_vpc_routing_tables_least_access.yaml b/rules/aws_peering_vpc_routing_tables_least_access.yaml index a59e5fb..0b866e5 100644 --- a/rules/aws_peering_vpc_routing_tables_least_access.yaml +++ b/rules/aws_peering_vpc_routing_tables_least_access.yaml @@ -20,6 +20,6 @@ remediation: > 2. Create a new compliant route: aws ec2 create-route --route-table-id --destination-cidrblock --vpc-peering-connection-id -remediationDocURLs: - - https://docs.openraven.com/remediations/ensure_peering_VPC_routing_tables_are_least_access +# remediationDocURLs: +# - https://docs.openraven.com/remediations/ensure_peering_VPC_routing_tables_are_least_access version: 0.1.3 diff --git a/rules/aws_rotate_access_keys_every_90_days.yaml b/rules/aws_rotate_access_keys_every_90_days.yaml index f80a2c6..2e53e76 100644 --- a/rules/aws_rotate_access_keys_every_90_days.yaml +++ b/rules/aws_rotate_access_keys_every_90_days.yaml @@ -36,6 +36,6 @@ remediation: > aws iam update-access-key aws iam create-access-key aws iam delete-access-key -remediationDocURLs: - - https://docs.openraven.com/remediations/rotate_keys +# remediationDocURLs: +# - https://docs.openraven.com/remediations/rotate_keys version: 0.1.3 diff --git a/rules/aws_rotation_for_customer_created_cmks.yaml b/rules/aws_rotation_for_customer_created_cmks.yaml index 1f45842..eec67ce 100644 --- a/rules/aws_rotation_for_customer_created_cmks.yaml +++ b/rules/aws_rotation_for_customer_created_cmks.yaml @@ -28,6 +28,6 @@ remediation: > Via CLI 1. Run the following command to enable key rotation: aws kms enable-key-rotation --key-id -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_rotation_for_customer_created_CMKs +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_rotation_for_customer_created_CMKs version: 0.1.3 diff --git a/rules/aws_s3_bucket_access_logging_enabled.yaml b/rules/aws_s3_bucket_access_logging_enabled.yaml index 34872f3..0c941fb 100644 --- a/rules/aws_s3_bucket_access_logging_enabled.yaml +++ b/rules/aws_s3_bucket_access_logging_enabled.yaml @@ -33,6 +33,6 @@ remediation: > 2. Select Target Bucket from list 3. Enter a Target Prefix 6. Click Save -remediationDocURLs: - - https://docs.openraven.com/remediations/enable_CloudTrail_S3_bucket_access_logging_for +# remediationDocURLs: +# - https://docs.openraven.com/remediations/enable_CloudTrail_S3_bucket_access_logging_for version: 0.1.3 diff --git a/rules/aws_s3_bucket_cloudtrail_logs_not_publicly_accessible.yaml b/rules/aws_s3_bucket_cloudtrail_logs_not_publicly_accessible.yaml index 957db0c..fb713d6 100644 --- a/rules/aws_s3_bucket_cloudtrail_logs_not_publicly_accessible.yaml +++ b/rules/aws_s3_bucket_cloudtrail_logs_not_publicly_accessible.yaml @@ -55,6 +55,6 @@ remediation: > 8. If the Edit bucket policy button is present, click it. 9. Remove any Statement having an Effect set to Allow and a Principal set to "*" or {"AWS" : "*"}. -remediationDocURLs: - - https://docs.openraven.com/remediations/ensure_CloudTrail_logs_S3_bucket_not_publicly_accessible +# remediationDocURLs: +# - https://docs.openraven.com/remediations/ensure_CloudTrail_logs_S3_bucket_not_publicly_accessible version: 0.1.3 diff --git a/rules/aws_s3_bucket_encryption_enabled_by_another_account.yaml b/rules/aws_s3_bucket_encryption_enabled_by_another_account.yaml index c60164f..d568962 100644 --- a/rules/aws_s3_bucket_encryption_enabled_by_another_account.yaml +++ b/rules/aws_s3_bucket_encryption_enabled_by_another_account.yaml @@ -29,6 +29,6 @@ remediation: > 4. Under Default encryption, choose Edit. 5. Remove cross-account KMS Key and specify account related KMS Key for data encryption 6. Consider rule aws_058 aws_s3_prevent_default_kms_key_override.yaml remediation to prevent such violation on future -remediationDocURLs: - - https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html +# remediationDocURLs: +# - https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html version: 0.1.3 diff --git a/rules/aws_s3_deny_public_access_enabled.yaml b/rules/aws_s3_deny_public_access_enabled.yaml index fbcad7b..a6f5a20 100644 --- a/rules/aws_s3_deny_public_access_enabled.yaml +++ b/rules/aws_s3_deny_public_access_enabled.yaml @@ -24,4 +24,6 @@ remediation: > 6. Find "Bucket policy" check for any public configuration like "principal": * etc 7. Reference: https://docs.amazonaws.cn/en_us/AmazonS3/latest/userguide/access-control-block-public-access.html 8. Reference: https://aws.amazon.com/s3/features/block-public-access/ - +# remediationDocURLs: +# - https://docs.openraven.com/remediations/unused_credentials +version: 0.1.3 \ No newline at end of file diff --git a/rules/aws_s3_prevent_default_kms_key_override.yaml b/rules/aws_s3_prevent_default_kms_key_override.yaml index 428e298..f68d9f9 100644 --- a/rules/aws_s3_prevent_default_kms_key_override.yaml +++ b/rules/aws_s3_prevent_default_kms_key_override.yaml @@ -37,8 +37,8 @@ remediation: > 6. Add policy Condition statement where you define the KMS Key to be matched for Statement with s3:PutObject permission 7. Condition example for Allow effect for: "Condition":{"StringEquals":{"s3:x-amz-server-side-encryption-aws-kms-key-id":"arn:aws:kms:REGION:ACCOUNT-ID:key\/KEY-ID"}}} -remediationDocURLs: - - https://rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/#:~:text=Another%20feature%20of,be%20found%20here. - - https://docs.aws.amazon.com/AmazonS3/latest/userguide/add-bucket-policy.html - - https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html +# remediationDocURLs: +# - https://rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/#:~:text=Another%20feature%20of,be%20found%20here. +# - https://docs.aws.amazon.com/AmazonS3/latest/userguide/add-bucket-policy.html +# - https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html version: 0.1.3 diff --git a/rules/aws_s3_versioning_and_mfa_delete_enabled.yaml b/rules/aws_s3_versioning_and_mfa_delete_enabled.yaml index c1bad65..5694ca2 100644 --- a/rules/aws_s3_versioning_and_mfa_delete_enabled.yaml +++ b/rules/aws_s3_versioning_and_mfa_delete_enabled.yaml @@ -26,4 +26,7 @@ remediation: > 4. Find "Bucket Versioning" section 5. Click Edit and enable versioning 6. Follow AWS instruction to add MFA Delete option via CLI or SDK - https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html \ No newline at end of file +# remediationDocURLs: +# - https://docs.openraven.com/remediations/unused_credentials +# https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html + version: 0.1.3 \ No newline at end of file diff --git a/rules/aws_security_contact_information_registered.yaml b/rules/aws_security_contact_information_registered.yaml index 5b14740..9d46615 100644 --- a/rules/aws_security_contact_information_registered.yaml +++ b/rules/aws_security_contact_information_registered.yaml @@ -18,6 +18,6 @@ remediation: > 4. Enter contact information in the Security section Note: Consider specifying an internal email distribution list to ensure emails are regularly monitored by more than one individual. -remediationDocURLs: - - https://docs.openraven.com/remediations/ensure_security_contact_information_registered +# remediationDocURLs: +# - https://docs.openraven.com/remediations/ensure_security_contact_information_registered version: 0.1.3 diff --git a/rules/aws_security_hub_enabled.yaml b/rules/aws_security_hub_enabled.yaml index 4afa568..ee16a28 100644 --- a/rules/aws_security_hub_enabled.yaml +++ b/rules/aws_security_hub_enabled.yaml @@ -26,7 +26,6 @@ remediation: > 3. On the welcome page, Security standards lists the security standards that Security Hub supports. 4. To enable a standard, select its check box.. To disable a standard, clear its check box. 5. Choose Enable Security Hub. - For details visit: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-enable.html - - - +# remediationDocURLs: +# - https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-enable.html +version: 0.1.3 diff --git a/rules/aws_ssm_manage_all_ec2_instances.yaml b/rules/aws_ssm_manage_all_ec2_instances.yaml index 2841530..6a45ca8 100644 --- a/rules/aws_ssm_manage_all_ec2_instances.yaml +++ b/rules/aws_ssm_manage_all_ec2_instances.yaml @@ -24,5 +24,6 @@ remediation: > 3. Navigate to and choose your EC2 instance from the list. 4. In the Actions menu, choose Security, Modify IAM role. 5. For IAM role, select the instance profile you created for that perspective -remediationDocURLs: - - https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up.html +# remediationDocURLs: +# - https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up.html +version: 0.1.3 diff --git a/rules/aws_support_role_is_created.yaml b/rules/aws_support_role_is_created.yaml index ec3f4c2..a4e4ae9 100644 --- a/rules/aws_support_role_is_created.yaml +++ b/rules/aws_support_role_is_created.yaml @@ -34,6 +34,6 @@ remediation: > aws iam create-role --role-name --assume-rolepolicy-document file:///tmp/TrustPolicy.json - Attach 'AWSSupportAccess' managed policy to the created IAM role: aws iam attach-role-policy --policy-arn --role-name -remediationDocURLs: - - https://docs.openraven.com/remediations/ensure_support_role_is_created +# remediationDocURLs: +# - https://docs.openraven.com/remediations/ensure_support_role_is_created version: 0.1.3 diff --git a/rules/aws_trails_integrated_with_cloudwatch_logs.yaml b/rules/aws_trails_integrated_with_cloudwatch_logs.yaml index f77422b..c3f2046 100644 --- a/rules/aws_trails_integrated_with_cloudwatch_logs.yaml +++ b/rules/aws_trails_integrated_with_cloudwatch_logs.yaml @@ -41,6 +41,6 @@ remediation: > aws cloudtrail update-trail --name --cloudwatch-logs-log-grouparn --cloudwatch-logs-role-arn -remediationDocURLs: - - https://docs.openraven.com/remediations/integrate_CloudTrails_with_CloudWatch_logs +# remediationDocURLs: +# - https://docs.openraven.com/remediations/integrate_CloudTrails_with_CloudWatch_logs version: 0.1.3 diff --git a/rules/gcp_instances_dont_use_default_service_account.yaml b/rules/gcp_instances_dont_use_default_service_account.yaml index 896b8ff..92b480d 100644 --- a/rules/gcp_instances_dont_use_default_service_account.yaml +++ b/rules/gcp_instances_dont_use_default_service_account.yaml @@ -33,6 +33,6 @@ remediation: > gcloud compute instances set-service-account INSTANCE_NAME --service-account=SERVICE_ACCOUNT 3. Restart the instance: gcloud compute instances start INSTANCE_NAME -remediationDocURLs: - - https://docs.openraven.com/remediations/ensure_instances_dont_use_default_service_account +# remediationDocURLs: +# - https://docs.openraven.com/remediations/ensure_instances_dont_use_default_service_account version: 0.1.3 diff --git a/rules/gcp_no_project_level_service_account_user_or_token_for_iam_user.yaml b/rules/gcp_no_project_level_service_account_user_or_token_for_iam_user.yaml index a0bbf57..a82e510 100644 --- a/rules/gcp_no_project_level_service_account_user_or_token_for_iam_user.yaml +++ b/rules/gcp_no_project_level_service_account_user_or_token_for_iam_user.yaml @@ -60,6 +60,6 @@ remediation: > } 2. Update the project's IAM policy: gcloud projects set-iam-policy PROJECT_ID iam.json -remediationDocURLs: - - https://docs.openraven.com/remediations/unassing_gcp_Service_Account_User_and_Service_Account_Token_Creator_roles_from_project_level +# remediationDocURLs: +# - https://docs.openraven.com/remediations/unassing_gcp_Service_Account_User_and_Service_Account_Token_Creator_roles_from_project_level version: 0.1.3 diff --git a/rules/gcp_service_account_no_user_managed_keys.yaml b/rules/gcp_service_account_no_user_managed_keys.yaml index 57b4965..b2d7dae 100644 --- a/rules/gcp_service_account_no_user_managed_keys.yaml +++ b/rules/gcp_service_account_no_user_managed_keys.yaml @@ -22,6 +22,6 @@ remediation: > 4. Click the edit and delete the keys. From CLI To delete a user managed Service Account Key: gcloud iam service-accounts keys delete --iam-account= -remediationDocURLs: - - https://docs.openraven.com/remediations/delete_gcp_service_account_keys +# remediationDocURLs: +# - https://docs.openraven.com/remediations/delete_gcp_service_account_keys version: 0.1.3