Skip to content

Commit 935056d

Browse files
artaasadiartaasadi
authored
Merge pull request #28 from opengovern/fix-policy
fix: update controls schema
2 parents 2713b60 + 8d308b7 commit 935056d

File tree

2,573 files changed

+101162
-107825
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

2,573 files changed

+101162
-107825
lines changed

‎compliance/controls/aws/aws_account_alternate_contact_security_registered.yaml‎

Lines changed: 56 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,57 @@
1-
Description: This control checks if an AWS Web Services (AWS) account has security contact information. The control fails if security contact information is not provided for the account.
2-
ID: aws_account_alternate_contact_security_registered
3-
IntegrationType:
1+
id: aws_account_alternate_contact_security_registered
2+
title: Security contact information should be provided for an AWS account
3+
description: This control checks if an AWS Web Services (AWS) account has security contact information. The control fails if security contact information is not provided for the account.
4+
integration_type:
45
- aws_cloud_account
5-
Query:
6-
Engine: CloudQL-v0.0.1
7-
ListOfTables:
8-
- aws_account
9-
- aws_account_alternate_contact
10-
Parameters: []
11-
PrimaryTable: aws_account
12-
QueryToExecute: |
13-
WITH alternate_security_contact AS (
14-
SELECT
15-
name,
16-
account_id
17-
FROM
18-
aws_account_alternate_contact
19-
WHERE
20-
contact_type = 'SECURITY'
21-
)
22-
SELECT
23-
arn AS resource,
24-
platform_integration_id AS platform_integration_id,
25-
platform_resource_id AS platform_resource_id,
26-
CASE
27-
WHEN a.partition = 'aws-us-gov' THEN 'info'
28-
WHEN c.name IS NOT NULL THEN 'ok'
29-
ELSE 'alarm'
30-
END AS status,
31-
CASE
32-
WHEN a.partition = 'aws-us-gov' THEN a.title || ' in GovCloud, manual verification required.'
33-
WHEN c.name IS NOT NULL THEN a.title || ' has security contact ' || c.name || ' registered.'
34-
ELSE a.title || ' security contact not registered.'
35-
END AS reason,
36-
a.account_id
37-
FROM
38-
aws_account AS a
39-
LEFT JOIN alternate_security_contact AS c ON c.account_id = a.account_id;
40-
Severity: low
41-
Tags:
42-
category:
43-
- Compliance
44-
cis:
45-
- "true"
46-
cis_item_id:
47-
- "1.18"
48-
cis_level:
49-
- "1"
50-
cis_section_id:
51-
- "1"
52-
cis_type:
53-
- not_scored
54-
cis_version:
55-
- v1.2.0
56-
plugin:
57-
- aws
58-
service:
59-
- AWS/IAM
60-
Title: Security contact information should be provided for an AWS account
6+
parameters: []
7+
policy:
8+
language: sql
9+
primary_resource: aws_account
10+
definition: |
11+
WITH alternate_security_contact AS (
12+
SELECT
13+
name,
14+
account_id
15+
FROM
16+
aws_account_alternate_contact
17+
WHERE
18+
contact_type = 'SECURITY'
19+
)
20+
SELECT
21+
arn AS resource,
22+
platform_integration_id AS platform_integration_id,
23+
platform_resource_id AS platform_resource_id,
24+
CASE
25+
WHEN a.partition = 'aws-us-gov' THEN 'info'
26+
WHEN c.name IS NOT NULL THEN 'ok'
27+
ELSE 'alarm'
28+
END AS status,
29+
CASE
30+
WHEN a.partition = 'aws-us-gov' THEN a.title || ' in GovCloud, manual verification required.'
31+
WHEN c.name IS NOT NULL THEN a.title || ' has security contact ' || c.name || ' registered.'
32+
ELSE a.title || ' security contact not registered.'
33+
END AS reason,
34+
a.account_id
35+
FROM
36+
aws_account AS a
37+
LEFT JOIN alternate_security_contact AS c ON c.account_id = a.account_id;
38+
severity: low
39+
tags:
40+
category:
41+
- Compliance
42+
cis:
43+
- 'true'
44+
cis_item_id:
45+
- '1.18'
46+
cis_level:
47+
- '1'
48+
cis_section_id:
49+
- '1'
50+
cis_type:
51+
- not_scored
52+
cis_version:
53+
- v1.2.0
54+
plugin:
55+
- aws
56+
service:
57+
- AWS/IAM

‎compliance/controls/aws/aws_account_part_of_organizations.yaml‎

Lines changed: 41 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,42 @@
1-
Description: Ensure that an AWS account is part of AWS Organizations. The rule is non-compliant if an AWS account is not part of AWS Organizations, or AWS Organizations' master account ID does not match rule parameter MasterAccountId.
2-
ID: aws_account_part_of_organizations
3-
IntegrationType:
1+
id: aws_account_part_of_organizations
2+
title: AWS account should be part of AWS Organizations
3+
description: Ensure that an AWS account is part of AWS Organizations. The rule is non-compliant if an AWS account is not part of AWS Organizations, or AWS Organizations' master account ID does not match rule parameter MasterAccountId.
4+
integration_type:
45
- aws_cloud_account
5-
Query:
6-
Engine: CloudQL-v0.0.1
7-
ListOfTables:
8-
- aws_account
9-
Parameters: []
10-
PrimaryTable: aws_account
11-
QueryToExecute: |
12-
SELECT
13-
arn AS resource,
14-
platform_integration_id AS platform_integration_id,
15-
platform_resource_id AS platform_resource_id,
16-
CASE
17-
WHEN organization_id IS NOT NULL THEN 'ok'
18-
ELSE 'alarm'
19-
END AS status,
20-
CASE
21-
WHEN organization_id IS NOT NULL THEN title || ' is part of organization(s).'
22-
ELSE title || ' is not part of organization.'
23-
END AS reason,
24-
region,
25-
account_id
26-
FROM
27-
aws_account;
28-
Severity: medium
29-
Tags:
30-
category:
31-
- Compliance
32-
cis_controls_v8_ig1:
33-
- "true"
34-
gxp_21_cfr_part_11:
35-
- "true"
36-
nist_800_53_rev_5:
37-
- "true"
38-
nist_csf:
39-
- "true"
40-
plugin:
41-
- aws
42-
service:
43-
- AWS/IAM
44-
Title: AWS account should be part of AWS Organizations
6+
parameters: []
7+
policy:
8+
language: sql
9+
primary_resource: aws_account
10+
definition: |
11+
SELECT
12+
arn AS resource,
13+
platform_integration_id AS platform_integration_id,
14+
platform_resource_id AS platform_resource_id,
15+
CASE
16+
WHEN organization_id IS NOT NULL THEN 'ok'
17+
ELSE 'alarm'
18+
END AS status,
19+
CASE
20+
WHEN organization_id IS NOT NULL THEN title || ' is part of organization(s).'
21+
ELSE title || ' is not part of organization.'
22+
END AS reason,
23+
region,
24+
account_id
25+
FROM
26+
aws_account;
27+
severity: medium
28+
tags:
29+
category:
30+
- Compliance
31+
cis_controls_v8_ig1:
32+
- 'true'
33+
gxp_21_cfr_part_11:
34+
- 'true'
35+
nist_800_53_rev_5:
36+
- 'true'
37+
nist_csf:
38+
- 'true'
39+
plugin:
40+
- aws
41+
service:
42+
- AWS/IAM

‎compliance/controls/aws/aws_acm_certificate_expires_30_days.yaml‎

Lines changed: 63 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,64 @@
1-
Description: Ensure network integrity is protected by ensuring X509 certificates are issued by AWS ACM.
2-
ID: aws_acm_certificate_expires_30_days
3-
IntegrationType:
1+
id: aws_acm_certificate_expires_30_days
2+
title: ACM certificates should not expire within 30 days
3+
description: Ensure network integrity is protected by ensuring X509 certificates are issued by AWS ACM.
4+
integration_type:
45
- aws_cloud_account
5-
Query:
6-
Engine: CloudQL-v0.0.1
7-
ListOfTables:
8-
- aws_acm_certificate
9-
Parameters: []
10-
PrimaryTable: aws_acm_certificate
11-
QueryToExecute: |
12-
SELECT
13-
certificate_arn AS resource,
14-
platform_integration_id AS platform_integration_id,
15-
platform_resource_id AS platform_resource_id,
16-
CASE
17-
WHEN renewal_eligibility = 'INELIGIBLE' THEN 'skip'
18-
WHEN DATE(not_after) - DATE(current_date) >= 30 THEN 'ok'
19-
ELSE 'alarm'
20-
END AS status,
21-
CASE
22-
WHEN renewal_eligibility = 'INELIGIBLE' THEN title || ' not eligible for renewal.'
23-
ELSE title || ' expires ' || TO_CHAR(not_after, 'DD-Mon-YYYY') ||
24-
' (' || EXTRACT(DAY FROM not_after - current_date) || ' days).'
25-
END AS reason,
26-
region,
27-
account_id
28-
FROM
29-
aws_acm_certificate;
30-
Severity: high
31-
Tags:
32-
category:
33-
- Compliance
34-
cisa_cyber_essentials:
35-
- "true"
36-
fedramp_low_rev_4:
37-
- "true"
38-
fedramp_moderate_rev_4:
39-
- "true"
40-
ffiec:
41-
- "true"
42-
gdpr:
43-
- "true"
44-
hipaa_final_omnibus_security_rule_2013:
45-
- "true"
46-
hipaa_security_rule_2003:
47-
- "true"
48-
nist_800_53_rev_4:
49-
- "true"
50-
nist_800_53_rev_5:
51-
- "true"
52-
nist_800_171_rev_2:
53-
- "true"
54-
nist_csf:
55-
- "true"
56-
pci_dss_v321:
57-
- "true"
58-
plugin:
59-
- aws
60-
rbi_cyber_security:
61-
- "true"
62-
service:
63-
- AWS/ACM
64-
soc_2:
65-
- "true"
66-
Title: ACM certificates should not expire within 30 days
6+
parameters: []
7+
policy:
8+
language: sql
9+
primary_resource: aws_acm_certificate
10+
definition: |
11+
SELECT
12+
certificate_arn AS resource,
13+
platform_integration_id AS platform_integration_id,
14+
platform_resource_id AS platform_resource_id,
15+
CASE
16+
WHEN renewal_eligibility = 'INELIGIBLE' THEN 'skip'
17+
WHEN DATE(not_after) - DATE(current_date) >= 30 THEN 'ok'
18+
ELSE 'alarm'
19+
END AS status,
20+
CASE
21+
WHEN renewal_eligibility = 'INELIGIBLE' THEN title || ' not eligible for renewal.'
22+
ELSE title || ' expires ' || TO_CHAR(not_after, 'DD-Mon-YYYY') ||
23+
' (' || EXTRACT(DAY FROM not_after - current_date) || ' days).'
24+
END AS reason,
25+
region,
26+
account_id
27+
FROM
28+
aws_acm_certificate;
29+
severity: high
30+
tags:
31+
category:
32+
- Compliance
33+
cisa_cyber_essentials:
34+
- 'true'
35+
fedramp_low_rev_4:
36+
- 'true'
37+
fedramp_moderate_rev_4:
38+
- 'true'
39+
ffiec:
40+
- 'true'
41+
gdpr:
42+
- 'true'
43+
hipaa_final_omnibus_security_rule_2013:
44+
- 'true'
45+
hipaa_security_rule_2003:
46+
- 'true'
47+
nist_800_53_rev_4:
48+
- 'true'
49+
nist_800_53_rev_5:
50+
- 'true'
51+
nist_800_171_rev_2:
52+
- 'true'
53+
nist_csf:
54+
- 'true'
55+
pci_dss_v321:
56+
- 'true'
57+
plugin:
58+
- aws
59+
rbi_cyber_security:
60+
- 'true'
61+
service:
62+
- AWS/ACM
63+
soc_2:
64+
- 'true'

‎compliance/controls/aws/aws_acm_certificate_no_failed_certificate.yaml‎

Lines changed: 22 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,23 @@
1-
Description: This control ensures that ACM certificates are not in failed state.
2-
ID: aws_acm_certificate_no_failed_certificate
3-
IntegrationType:
1+
id: aws_acm_certificate_no_failed_certificate
2+
title: Ensure that ACM certificates are not in failed state
3+
description: This control ensures that ACM certificates are not in failed state.
4+
integration_type:
45
- aws_cloud_account
5-
Query:
6-
Engine: CloudQL-v0.0.1
7-
ListOfTables:
8-
- aws_acm_certificate
9-
Parameters: []
10-
PrimaryTable: aws_acm_certificate
11-
QueryToExecute: |
12-
SELECT
13-
certificate_arn AS resource,
14-
platform_integration_id AS platform_integration_id,
15-
platform_resource_id AS platform_resource_id,
16-
CASE
17-
WHEN status IN ('VALIDATION_TIMED_OUT', 'FAILED') THEN 'alarm'
18-
ELSE 'ok'
19-
END AS status,
20-
title || ' status is ' || status || '.' AS reason
21-
FROM
22-
aws_acm_certificate;
23-
Severity: low
24-
Tags: {}
25-
Title: Ensure that ACM certificates are not in failed state
6+
parameters: []
7+
policy:
8+
language: sql
9+
primary_resource: aws_acm_certificate
10+
definition: |
11+
SELECT
12+
certificate_arn AS resource,
13+
platform_integration_id AS platform_integration_id,
14+
platform_resource_id AS platform_resource_id,
15+
CASE
16+
WHEN status IN ('VALIDATION_TIMED_OUT', 'FAILED') THEN 'alarm'
17+
ELSE 'ok'
18+
END AS status,
19+
title || ' status is ' || status || '.' AS reason
20+
FROM
21+
aws_acm_certificate;
22+
severity: low
23+
tags: {}

0 commit comments

Comments
 (0)