Skip to content

Commit c958afc

Browse files
vikramsinghvirdivikramsinghvirdi
authored
Merge pull request #94 from vmware-samples/release/v1.7.0
Release/v1.7.0
2 parents d9c0834 + 9236983 commit c958afc

File tree

50 files changed

+3652
-24
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+3652
-24
lines changed

‎README.md‎

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
## Abstract
1515
These jobs represent open-sourced remediation jobs to be used in conjunction with the
16-
[SecureState remediation worker for python](https://hub.docker.com/r/vmware/vss-remediation-worker). In order
16+
[Secure State remediation worker for python](https://hub.docker.com/r/vmware/vss-remediation-worker). In order
1717
to make use of this code, you must utilize the worker and have a Secure State worker group properly set up.
1818

1919
## Quick Start Guide
@@ -101,33 +101,39 @@ The table below lists all the supported jobs with their links.
101101
| 18. | e25a319c-0ca7-4e6a-b4b9-19beba480b3b | PostgreSQL server should have Enforce SSL connection enabled | [azure-postgresql-enforce-ssl-connection-enable](remediation_worker/jobs/azure_postgresql_enforce_ssl_connection_enable) |
102102
| 19. | 5c8c26977a550e1fb6560cd6 | SQL server should have Advanced Threat Protection types set to all | [azure-sql-threat-detection-types-all-server](remediation_worker/jobs/azure_sql_threat_detection_types_all_server) |
103103
| 20. | 7ba94354-ab4c-11ea-bb37-0242ac130002 | Storage account is not configured to have access from trusted Microsoft services | [azure-storage-trusted-microsoft-services-access-enabled](remediation_worker/jobs/azure_storage_trusted_microsoft_services_access_enabled) |
104+
| 21. | 7406e56f-bbf0-4571-8e50-21bd344e0fdb | SQL server should have TDE protector encrypted with customer-managed key | [azure-sql-tde-protector-encrypted-cmk](remediation_worker/jobs/azure_sql_tde_protector_encrypted_cmk) |
105+
| 22. | 9b7b5a71-5eaa-4418-a6b0-17f796e8ebaa | PostgreSQL server access from Azure services should be disabled | [azure-postgresql-allow-access-to-azure-service-disabled](remediation_worker/jobs/azure_postgresql_allow_access_to_azure_service_disabled) |
106+
| 23. | 4e27676b-7e87-4e2e-b756-28c96ed4fdf8 | Network security group should restrict public access to UDP ports | [azure-security-udp-access-restricted-from-internet](remediation_worker/jobs/azure_security_udp_access_restricted_from_internet) |
104107

105108

106109
**AWS Remediation Jobs**
107110

108111

109-
| Sr.No. | Rule Id | Rule Name | Remediation Job Link |
110-
|-------- |:------------------------------------: |:------------------------------------------------------------------------------: |:------------------------------------------------------------------------------------------: |
111-
| 1. | 5c8c26417a550e1fb6560c3f | EC2 instance should restrict public access to SSH port (22) | [ec2-close-port-22](remediation_worker/jobs/ec2_close_port_22) |
112-
| 2. | 5c8c26437a550e1fb6560c42 | EC2 security group should restrict public access to Remote Desktop port (3389) | [ec2-close-port-3389](remediation_worker/jobs/ec2_close_port_3389) |
113-
| 3. | 657c46b7-1cd0-4cce-80bb-9d195f49c987 | Elastic Load Balancer access logs are not enabled | [elb-enable-access-logs](remediation_worker/jobs/elb_enable_access_logs) |
114-
| 4. | 5c8c264a7a550e1fb6560c4d | The RDS backup retention period is less than 30 days | [rds-backup-retention-30-days](remediation_worker/jobs/rds_backup_retention_30_days) |
115-
| 5. | 5c8c265e7a550e1fb6560c67 | S3 access logging should be enabled | [s3-enable-access-logging](remediation_worker/jobs/s3_enable_access_logging) |
116-
| 6. | 1d187035-9fff-48b2-a7c3-ffc56a4da5e6 | S3 bucket default encryption should be enabled | [s3-enable-default-encryption](remediation_worker/jobs/s3_enable_default_encryption) |
117-
| 7. | 5c8c26507a550e1fb6560c57 | S3 bucket should restrict full public access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
118-
| 8. | 5c8c26517a550e1fb6560c59 | S3 bucket should restrict public read access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
119-
| 9. | 5c8c26537a550e1fb6560c5a | S3 bucket should restrict public read ACL access | [s3_remove_public_access](remediation_worker/jobs/s3_remove_public_access) |
120-
| 10. | 5c8c26537a550e1fb6560c5b | S3 bucket should restrict public write access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
121-
| 11. | 5c8c26547a550e1fb6560c5c | S3 bucket should restrict public write ACL access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
122-
| 12. | 5c8c26637a550e1fb6560c6b | S3 bucket policy should restrict public get access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
123-
| 13. | 5c8c26617a550e1fb6560c69 | S3 bucket policy should restrict full public access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
124-
| 14. | 5c8c25ec7a550e1fb6560bbe | EC2 security group should restrict public access to SSH port (22) | [security-group-close-port-22](remediation_worker/jobs/security_group_close_port_22) |
125-
| 15. | 5c8c25ef7a550e1fb6560bc4 | EC2 instance should restrict public access to Remote Desktop port (3389) | [security-group-close-port-3389](remediation_worker/jobs/security_group_close_port_3389) |
126-
| 16. | 5c8c25f07a550e1fb6560bc6 | EC2 instance should restrict public access to PostgreSQL server port (5432) | [security-group-close-port-5432](remediation_worker/jobs/security_group_close_port_5432) |
127-
| 17. | 5c8c25e47a550e1fb6560bac | CloudTrail logs should be encrypted | [aws-cloudtrail-logs-encrypted](remediation_worker/jobs/aws_cloudtrail_logs_encrypted) |
128-
| 18. | 5c8c26217a550e1fb6560c12 | KMS automated key rotation is not enabled | [aws-kms-key-rotates](remediation_worker/jobs/aws_kms_key_rotates) |
129-
| 19. | 5c8c265c7a550e1fb6560c63 | CloudTrail S3 buckets should have access logging enabled | [s3-enable-access-logging](remediation_worker/jobs/s3_enable_access_logging) |
130-
| 20. | 5c8c265d7a550e1fb6560c65 | CloudTrail S3 buckets should restrict access to required users | [aws-s3-cloudtrail-public-access](remediation_worker/jobs/aws_s3_cloudtrail_public_access) |
112+
| Sr.No. | Rule Id | Rule Name | Remediation Job Link |
113+
|:------: |:------------------------------------: |:---------------------------------------------------------------------------------: |:--------------------------------------------------------------------------------------------------------------------: |
114+
| 1. | 5c8c26417a550e1fb6560c3f | EC2 instance should restrict public access to SSH port (22) | [ec2-close-port-22](remediation_worker/jobs/ec2_close_port_22) |
115+
| 2. | 5c8c26437a550e1fb6560c42 | EC2 security group should restrict public access to Remote Desktop port (3389) | [ec2-close-port-3389](remediation_worker/jobs/ec2_close_port_3389) |
116+
| 3. | 657c46b7-1cd0-4cce-80bb-9d195f49c987 | Elastic Load Balancer access logs are not enabled | [elb-enable-access-logs](remediation_worker/jobs/elb_enable_access_logs) |
117+
| 4. | 5c8c264a7a550e1fb6560c4d | The RDS backup retention period is less than 30 days | [rds-backup-retention-30-days](remediation_worker/jobs/rds_backup_retention_30_days) |
118+
| 5. | 5c8c265e7a550e1fb6560c67 | S3 access logging should be enabled | [s3-enable-access-logging](remediation_worker/jobs/s3_enable_access_logging) |
119+
| 6. | 1d187035-9fff-48b2-a7c3-ffc56a4da5e6 | S3 bucket default encryption should be enabled | [s3-enable-default-encryption](remediation_worker/jobs/s3_enable_default_encryption) |
120+
| 7. | 5c8c26507a550e1fb6560c57 | S3 bucket should restrict full public access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
121+
| 8. | 5c8c26517a550e1fb6560c59 | S3 bucket should restrict public read access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
122+
| 9. | 5c8c26537a550e1fb6560c5a | S3 bucket should restrict public read ACL access | [s3_remove_public_access](remediation_worker/jobs/s3_remove_public_access) |
123+
| 10. | 5c8c26537a550e1fb6560c5b | S3 bucket should restrict public write access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
124+
| 11. | 5c8c26547a550e1fb6560c5c | S3 bucket should restrict public write ACL access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
125+
| 12. | 5c8c26637a550e1fb6560c6b | S3 bucket policy should restrict public get access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
126+
| 13. | 5c8c26617a550e1fb6560c69 | S3 bucket policy should restrict full public access | [s3-remove-public-access](remediation_worker/jobs/s3_remove_public_access) |
127+
| 14. | 5c8c25ec7a550e1fb6560bbe | EC2 security group should restrict public access to SSH port (22) | [security-group-close-port-22](remediation_worker/jobs/security_group_close_port_22) |
128+
| 15. | 5c8c25ef7a550e1fb6560bc4 | EC2 instance should restrict public access to Remote Desktop port (3389) | [security-group-close-port-3389](remediation_worker/jobs/security_group_close_port_3389) |
129+
| 16. | 5c8c25f07a550e1fb6560bc6 | EC2 instance should restrict public access to PostgreSQL server port (5432) | [security-group-close-port-5432](remediation_worker/jobs/security_group_close_port_5432) |
130+
| 17. | 5c8c25e47a550e1fb6560bac | CloudTrail logs should be encrypted | [aws-cloudtrail-logs-encrypted](remediation_worker/jobs/aws_cloudtrail_logs_encrypted) |
131+
| 18. | 5c8c26217a550e1fb6560c12 | KMS automated key rotation is not enabled | [aws-kms-key-rotates](remediation_worker/jobs/aws_kms_key_rotates) |
132+
| 19. | 5c8c265c7a550e1fb6560c63 | CloudTrail S3 buckets should have access logging enabled | [s3-enable-access-logging](remediation_worker/jobs/s3_enable_access_logging) |
133+
| 20. | 5c8c265d7a550e1fb6560c65 | CloudTrail S3 buckets should restrict access to required users | [aws-s3-cloudtrail-public-access](remediation_worker/jobs/aws_s3_cloudtrail_public_access) |
134+
| 21. | 688d093c-3b8d-11eb-adc1-0242ac120002 | S3 bucket should allow only HTTPS requests | [aws-s3-bucket-policy-allow-https](remediation_worker/jobs/aws_s3_bucket_policy_allow_https) |
135+
| 22. | 09639b9d-98e8-493b-b8a4-916775a7dea9 | SQS queue policy should restricted access to required users | [aws-sqs-queue-publicly-accessible](remediation_worker/jobs/aws_sqs_queue_publicly_accessible) |
136+
| 23. | 1ec4a1f2-3e08-11eb-b378-0242ac130002 | Network ACL should restrict administration ports (3389 and 22) from public access | [aws-ec2-administration-ports-ingress-allowed](remediation_worker/jobs/aws_ec2_administration_ports_ingress_allowed) |
131137

132138
## Contributing
133139
The Secure State team welcomes welcomes contributions from the community. If you wish to contribute code and you have not signed our contributor license agreement (CLA), our bot will update the issue when you open a Pull Request. For any questions about the CLA process, please refer to our [FAQ](https://cla.vmware.com/faq).

‎remediation_worker/jobs/aws_ec2_administration_ports_ingress_allowed/README.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Remove Network ACL Rules that allows public access to administration ports (3389 and 22)
2+
3+
This job removes Network ACL Rules that allows public access to administration ports (3389 and 22).
4+
5+
### Applicable Rule
6+
7+
##### Rule ID:
8+
1ec4a1f2-3e08-11eb-b378-0242ac130002
9+
10+
##### Rule Name:
11+
Network ACL should restrict administration ports (3389 and 22) from public access
12+
13+
## Getting Started
14+
15+
### Prerequisites
16+
17+
The provided AWS credential must have access to `ec2:DeleteNetworkAcl`, `ec2:DescribeNetworkAcls` and `ec2:ReplaceNetworkAclEntry`.
18+
19+
You may find the latest example policy file [here](minimum_policy.json)
20+
21+
### Running the script
22+
23+
You may run this script using following commands:
24+
```shell script
25+
pip install -r ../../requirements.txt
26+
python3 aws_ec2_administration_ports_ingress_allowed.py
27+
```
28+
29+
## Running the tests
30+
You may run test using following command under vss-remediation-worker-job-code-python directory:
31+
```shell script
32+
python3 -m pytest test
33+
```
34+
35+
## Deployment
36+
1. Provision a Virtual Machine
37+
Create an EC2 instance to use for the worker. The minimum required specifications are 128 MB memory and 1/2 Core CPU.
38+
2. Setup Docker
39+
Install Docker on the newly provisioned EC2 instance. You can refer to the [docs here](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/docker-basics.html) for more information.
40+
3. Deploy the worker image
41+
SSH into the EC2 instance and run the command below to deploy the worker image:
42+
```shell script
43+
docker run --rm -it --name worker \
44+
-e VSS_CLIENT_ID={ENTER CLIENT ID}
45+
-e VSS_CLIENT_SECRET={ENTER CLIENT SECRET} \
46+
vmware/vss-remediation-worker:latest-python
47+
```
48+
49+
50+
## Contributing
51+
The Secure State team welcomes welcomes contributions from the community. If you wish to contribute code and you have not signed our contributor license agreement (CLA), our bot will update the issue when you open a Pull Request. For any questions about the CLA process, please refer to our [FAQ](https://cla.vmware.com/faq).
52+
All contributions to this repository must be signed as described on that page. Your signature certifies that you wrote the patch or have the right to pass it on as an open-source patch.
53+
54+
For more detailed information, refer to [CONTRIBUTING.md](../../../CONTRIBUTING.md).
55+
56+
## Versioning
57+
58+
We use [SemVer](http://semver.org/) for versioning. For the versions available, see the [tags on this repository](https://github.com/vmware-samples/secure-state-remediation-jobs/tags).
59+
60+
## Authors
61+
62+
* **VMware Secure State** - *Initial work*
63+
64+
See also the list of [contributors](https://github.com/vmware-samples/secure-state-remediation-jobs/contributors) who participated in this project.
65+
66+
## License
67+
68+
This project is licensed under the Apache License - see the [LICENSE](https://github.com/vmware-samples/secure-state-remediation-jobs/blob/master/LICENSE.txt) file for details

‎remediation_worker/jobs/aws_ec2_administration_ports_ingress_allowed/__init__.py‎

Whitespace-only changes.

0 commit comments

Comments
 (0)