cartography 0.104.0rc2__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/models/tailscale/user.py

@@ -3,6 +3,7 @@ from dataclasses import dataclass
 from cartography.models.core.common import PropertyRef
 from cartography.models.core.nodes import CartographyNodeProperties
 from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
 from cartography.models.core.relationships import CartographyRelProperties
 from cartography.models.core.relationships import CartographyRelSchema
 from cartography.models.core.relationships import LinkDirection
@@ -15,7 +16,8 @@ class TailscaleUserNodeProperties(CartographyNodeProperties):
     id: PropertyRef = PropertyRef("id")
     lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
     display_name: PropertyRef = PropertyRef("displayName")
-    login_name: PropertyRef = PropertyRef("loginName", extra_index=True)
+    login_name: PropertyRef = PropertyRef("loginName")
+    email: PropertyRef = PropertyRef("loginName", extra_index=True)
     profile_pic_url: PropertyRef = PropertyRef("profilePicUrl")
     created: PropertyRef = PropertyRef("created")
     type: PropertyRef = PropertyRef("type")
@@ -48,5 +50,8 @@ class TailscaleUserToTailnetRel(CartographyRelSchema):
 @dataclass(frozen=True)
 class TailscaleUserSchema(CartographyNodeSchema):
     label: str = "TailscaleUser"
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(
+        ["UserAccount"]
+    )  # UserAccount label is used for ontology mapping
     properties: TailscaleUserNodeProperties = TailscaleUserNodeProperties()
     sub_resource_relationship: TailscaleUserToTailnetRel = TailscaleUserToTailnetRel()

cartography/models/trivy/findings.py

@@ -0,0 +1,66 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class TrivyImageFindingNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    name: PropertyRef = PropertyRef("VulnerabilityID")
+    cve_id: PropertyRef = PropertyRef("cve_id", extra_index=True)
+    description: PropertyRef = PropertyRef("Description")
+    last_modified_date: PropertyRef = PropertyRef("LastModifiedDate")
+    primary_url: PropertyRef = PropertyRef("PrimaryURL")
+    published_date: PropertyRef = PropertyRef("PublishedDate")
+    severity: PropertyRef = PropertyRef("Severity", extra_index=True)
+    severity_source: PropertyRef = PropertyRef("SeveritySource")
+    title: PropertyRef = PropertyRef("Title")
+    cvss_nvd_v2_score: PropertyRef = PropertyRef("nvd_v2_score")
+    cvss_nvd_v2_vector: PropertyRef = PropertyRef("nvd_v2_vector")
+    cvss_nvd_v3_score: PropertyRef = PropertyRef("nvd_v3_score")
+    cvss_nvd_v3_vector: PropertyRef = PropertyRef("nvd_v3_vector")
+    cvss_redhat_v3_score: PropertyRef = PropertyRef("redhat_v3_score")
+    cvss_redhat_v3_vector: PropertyRef = PropertyRef("redhat_v3_vector")
+    cvss_ubuntu_v3_score: PropertyRef = PropertyRef("ubuntu_v3_score")
+    cvss_ubuntu_v3_vector: PropertyRef = PropertyRef("ubuntu_v3_vector")
+    class_name: PropertyRef = PropertyRef("Class")
+    type: PropertyRef = PropertyRef("Type")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class TrivyFindingToImageRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class TrivyFindingToImage(CartographyRelSchema):
+    target_node_label: str = "ECRImage"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("ImageDigest")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "AFFECTS"
+    properties: TrivyFindingToImageRelProperties = TrivyFindingToImageRelProperties()
+
+
+@dataclass(frozen=True)
+class TrivyImageFindingSchema(CartographyNodeSchema):
+    label: str = "TrivyImageFinding"
+    scoped_cleanup: bool = False
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["Risk", "CVE"])
+    properties: TrivyImageFindingNodeProperties = TrivyImageFindingNodeProperties()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            TrivyFindingToImage(),
+        ],
+    )

cartography/models/trivy/fix.py

@@ -0,0 +1,66 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class TrivyFixNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    version: PropertyRef = PropertyRef("FixedVersion")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class TrivyFixToPackageRelProperties(CartographyRelProperties):
+    version: PropertyRef = PropertyRef("FixedVersion")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class TrivyFixToPackage(CartographyRelSchema):
+    target_node_label: str = "Package"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("PackageId")},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "SHOULD_UPDATE_TO"
+    properties: TrivyFixToPackageRelProperties = TrivyFixToPackageRelProperties()
+
+
+@dataclass(frozen=True)
+class TrivyFixToFindingRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class TrivyFixToFinding(CartographyRelSchema):
+    target_node_label: str = "TrivyImageFinding"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("FindingId")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "APPLIES_TO"
+    properties: TrivyFixToFindingRelProperties = TrivyFixToFindingRelProperties()
+
+
+@dataclass(frozen=True)
+class TrivyFixSchema(CartographyNodeSchema):
+    label: str = "TrivyFix"
+    scoped_cleanup: bool = False
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["Fix"])
+    properties: TrivyFixNodeProperties = TrivyFixNodeProperties()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            TrivyFixToPackage(),
+            TrivyFixToFinding(),
+        ],
+    )

cartography/models/trivy/package.py

@@ -0,0 +1,71 @@
+from dataclasses import dataclass
+
+from cartography.models.core.common import PropertyRef
+from cartography.models.core.nodes import CartographyNodeProperties
+from cartography.models.core.nodes import CartographyNodeSchema
+from cartography.models.core.nodes import ExtraNodeLabels
+from cartography.models.core.relationships import CartographyRelProperties
+from cartography.models.core.relationships import CartographyRelSchema
+from cartography.models.core.relationships import LinkDirection
+from cartography.models.core.relationships import make_target_node_matcher
+from cartography.models.core.relationships import OtherRelationships
+from cartography.models.core.relationships import TargetNodeMatcher
+
+
+@dataclass(frozen=True)
+class TrivyPackageNodeProperties(CartographyNodeProperties):
+    id: PropertyRef = PropertyRef("id")
+    installed_version: PropertyRef = PropertyRef("InstalledVersion")
+    name: PropertyRef = PropertyRef("PkgName")
+    version: PropertyRef = PropertyRef("InstalledVersion")
+    class_name: PropertyRef = PropertyRef("Class")
+    type: PropertyRef = PropertyRef("Type")
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class TrivyPackageToImageRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class TrivyPackageToImage(CartographyRelSchema):
+    target_node_label: str = "ECRImage"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("ImageDigest")},
+    )
+    direction: LinkDirection = LinkDirection.OUTWARD
+    rel_label: str = "DEPLOYED"
+    properties: TrivyPackageToImageRelProperties = TrivyPackageToImageRelProperties()
+
+
+@dataclass(frozen=True)
+class TrivyPackageToFindingRelProperties(CartographyRelProperties):
+    lastupdated: PropertyRef = PropertyRef("lastupdated", set_in_kwargs=True)
+
+
+@dataclass(frozen=True)
+class TrivyPackageToFinding(CartographyRelSchema):
+    target_node_label: str = "TrivyImageFinding"
+    target_node_matcher: TargetNodeMatcher = make_target_node_matcher(
+        {"id": PropertyRef("FindingId")},
+    )
+    direction: LinkDirection = LinkDirection.INWARD
+    rel_label: str = "AFFECTS"
+    properties: TrivyPackageToFindingRelProperties = (
+        TrivyPackageToFindingRelProperties()
+    )
+
+
+@dataclass(frozen=True)
+class TrivyPackageSchema(CartographyNodeSchema):
+    label: str = "Package"
+    scoped_cleanup: bool = False
+    extra_node_labels: ExtraNodeLabels = ExtraNodeLabels(["TrivyPackage"])
+    properties: TrivyPackageNodeProperties = TrivyPackageNodeProperties()
+    other_relationships: OtherRelationships = OtherRelationships(
+        [
+            TrivyPackageToImage(),
+            TrivyPackageToFinding(),
+        ],
+    )

cartography/rules/README.md

@@ -0,0 +1 @@
+See [the rules docs](https://cartography-cncf.github.io/cartography/usage/rules.html) for how Cartography develops and approaches security rules.

cartography/rules/cli.py

@@ -0,0 +1,261 @@
+"""
+Cartography RunRules CLI
+
+Execute security frameworks and present facts about your environment.
+"""
+
+import builtins
+import logging
+import os
+from enum import Enum
+from typing import Generator
+
+import typer
+from typing_extensions import Annotated
+
+from cartography.rules.data.rules import RULES
+from cartography.rules.runners import run_rules
+
+app = typer.Typer(
+    help="Execute Cartography security frameworks",
+    no_args_is_help=True,
+)
+
+
+class OutputFormat(str, Enum):
+    """Output format options."""
+
+    text = "text"
+    json = "json"
+
+
+# ----------------------------
+# Autocompletion functions
+# ----------------------------
+
+
+def complete_rules(incomplete: str) -> Generator[str, None, None]:
+    """Autocomplete rules names."""
+    for name in RULES.keys():
+        if name.startswith(incomplete):
+            yield name
+
+
+def complete_rules_with_all(incomplete: str) -> Generator[str, None, None]:
+    """Autocomplete rules names plus 'all'."""
+    for name in builtins.list(RULES.keys()) + ["all"]:
+        if name.startswith(incomplete):
+            yield name
+
+
+def complete_facts(
+    ctx: typer.Context, incomplete: str
+) -> Generator[tuple[str, str], None, None]:
+    """Autocomplete facts IDs with descriptions based on selected rule."""
+    rule = ctx.params.get("rule")
+    if not rule or rule not in RULES:
+        return
+
+    for fact in RULES[rule].facts:
+        if fact.id.lower().startswith(incomplete.lower()):
+            yield (fact.id, fact.name)
+
+
+# ----------------------------
+# CLI Commands
+# ----------------------------
+
+
+@app.command(name="list")  # type: ignore[misc]
+def list_cmd(
+    rule: Annotated[
+        str | None,
+        typer.Argument(
+            help="Rule name (e.g., mfa-missing)",
+            autocompletion=complete_rules,
+        ),
+    ] = None,
+) -> None:
+    """
+    List available rules and facts.
+
+    \b
+    Examples:
+        cartography-rules list
+        cartography-rules list mfa-missing
+        cartography-rules list mfa-missing missing-mfa-cloudflare
+    """
+    # List all frameworks
+    if not rule:
+        typer.secho("\nAvailable Rules\n", bold=True)
+        for rule_name, rule_obj in RULES.items():
+            typer.secho(f"{rule_name}", fg=typer.colors.CYAN)
+            typer.echo(f"  Name:         {rule_obj.name}")
+            typer.echo(f"  Version:      {rule_obj.version}")
+            typer.echo(f"  Facts:        {len(rule_obj.facts)}")
+            if rule_obj.references:
+                typer.echo("  References:")
+                for ref in rule_obj.references:
+                    typer.echo(f"    - [{ref.text}]({ref.url})")
+            typer.echo()
+        return
+
+    # Validate rule
+    if rule not in RULES:
+        typer.secho(f"Error: Unknown rule '{rule}'", fg=typer.colors.RED, err=True)
+        typer.echo(f"Available: {', '.join(RULES.keys())}", err=True)
+        raise typer.Exit(1)
+
+    rule_obj = RULES[rule]
+
+    typer.secho(f"\n{rule_obj.name}", bold=True)
+    typer.echo(f"ID:  {rule_obj.id}")
+    typer.secho(f"\nFacts ({len(rule_obj.facts)})\n", bold=True)
+
+    for fact in rule_obj.facts:
+        typer.secho(f"{fact.id}", fg=typer.colors.CYAN)
+        typer.echo(f"  Name:        {fact.name}")
+        typer.echo(f"  Description: {fact.description}")
+        typer.echo(f"  Maturity:    {fact.maturity.value}")
+        typer.echo(f"  Provider:    {fact.module.value}")
+        typer.echo()
+
+
+@app.command(name="run")  # type: ignore[misc]
+def run_cmd(
+    rule: Annotated[
+        str | None,
+        typer.Argument(
+            help="Specific rule ID to run",
+            autocompletion=complete_rules_with_all,
+        ),
+    ] = None,
+    fact: Annotated[
+        str | None,
+        typer.Argument(
+            help="Specific fact ID to run",
+            autocompletion=complete_facts,
+        ),
+    ] = None,
+    uri: Annotated[
+        str,
+        typer.Option(help="Neo4j URI", envvar="NEO4J_URI"),
+    ] = "bolt://localhost:7687",
+    user: Annotated[
+        str,
+        typer.Option(help="Neo4j username", envvar="NEO4J_USER"),
+    ] = "neo4j",
+    database: Annotated[
+        str,
+        typer.Option(help="Neo4j database name", envvar="NEO4J_DATABASE"),
+    ] = "neo4j",
+    neo4j_password_env_var: Annotated[
+        str | None,
+        typer.Option(help="Environment variable containing Neo4j password"),
+    ] = None,
+    neo4j_password_prompt: Annotated[
+        bool,
+        typer.Option(help="Prompt for Neo4j password interactively"),
+    ] = False,
+    output: Annotated[
+        OutputFormat,
+        typer.Option(help="Output format"),
+    ] = OutputFormat.text,
+    experimental: bool = typer.Option(
+        True,
+        "--experimental/--no-experimental",
+        help="Enable or disable experimental facts.",
+    ),
+) -> None:
+    """
+    Execute a security framework.
+
+    \b
+    Examples:
+        cartography-rules run all
+        cartography-rules run mfa-missing
+        cartography-rules run mfa-missing missing-mfa-cloudflare
+    """
+    # Validate rule
+    valid_rules = builtins.list(RULES.keys()) + ["all"]
+    if rule not in valid_rules:
+        typer.secho(f"Error: Unknown rule '{rule}'", fg=typer.colors.RED, err=True)
+        typer.echo(f"Available: {', '.join(valid_rules)}", err=True)
+        raise typer.Exit(1)
+
+    # Validate fact requires rule
+    if fact and not rule:
+        typer.secho(
+            "Error: Cannot specify fact without rule",
+            fg=typer.colors.RED,
+            err=True,
+        )
+        raise typer.Exit(1)
+
+    # Validate filtering with 'all'
+    if rule == "all" and fact:
+        typer.secho(
+            "Error: Cannot filter by fact when running all rules",
+            fg=typer.colors.RED,
+            err=True,
+        )
+        raise typer.Exit(1)
+
+    # Validate fact exists
+    if fact and rule != "all":
+        rule_obj = RULES[rule]
+        fact_obj = rule_obj.get_fact_by_id(fact)
+        if not fact_obj:
+            typer.secho(
+                f"Error: Fact '{fact}' not found in rule '{rule}'",
+                fg=typer.colors.RED,
+                err=True,
+            )
+            typer.echo("\nAvailable facts:", err=True)
+            for fa in rule_obj.facts:
+                typer.echo(f"  {fa.id}", err=True)
+            raise typer.Exit(1)
+
+    # Get password
+    password = None
+    if neo4j_password_prompt:
+        password = typer.prompt("Neo4j password", hide_input=True)
+    elif neo4j_password_env_var:
+        password = os.environ.get(neo4j_password_env_var)
+    else:
+        password = os.getenv("NEO4J_PASSWORD")
+        if not password:
+            password = typer.prompt("Neo4j password", hide_input=True)
+
+    # Determine rules to run
+    if rule == "all":
+        rules_to_run = builtins.list(RULES.keys())
+    else:
+        rules_to_run = [rule]
+
+    # Execute
+    try:
+        exit_code = run_rules(
+            rules_to_run,
+            uri,
+            user,
+            password,
+            database,
+            output.value,
+            fact_filter=fact,
+            exclude_experimental=not experimental,
+        )
+        raise typer.Exit(exit_code)
+    except KeyboardInterrupt:
+        raise typer.Exit(130)
+
+
+def main():
+    """Entrypoint for cartography-rules CLI."""
+    logging.basicConfig(level=logging.INFO)
+    logging.getLogger("neo4j").setLevel(logging.ERROR)
+    app()
+
+
+if __name__ == "__main__":
+    main()

cartography/rules/data/rules/__init__.py

@@ -0,0 +1,46 @@
+from cartography.rules.data.rules.cloud_security_product_deactivated import (
+    cloud_security_product_deactivated,
+)
+from cartography.rules.data.rules.compute_instance_exposed import (
+    compute_instance_exposed,
+)
+from cartography.rules.data.rules.database_instance_exposed import (
+    database_instance_exposed,
+)
+from cartography.rules.data.rules.delegation_boundary_modifiable import (
+    delegation_boundary_modifiable,
+)
+from cartography.rules.data.rules.identity_administration_privileges import (
+    identity_administration_privileges,
+)
+from cartography.rules.data.rules.inactive_user_active_accounts import (
+    inactive_user_active_accounts,
+)
+from cartography.rules.data.rules.malicious_npm_dependencies_shai_hulud import (
+    malicious_npm_dependencies_shai_hulud,
+)
+from cartography.rules.data.rules.mfa_missing import missing_mfa_rule
+from cartography.rules.data.rules.object_storage_public import object_storage_public
+from cartography.rules.data.rules.policy_administration_privileges import (
+    policy_administration_privileges,
+)
+from cartography.rules.data.rules.unmanaged_accounts import unmanaged_accounts
+from cartography.rules.data.rules.workload_identity_admin_capabilities import (
+    workload_identity_admin_capabilities,
+)
+
+# Rule registry - all available rules
+RULES = {
+    compute_instance_exposed.id: compute_instance_exposed,
+    database_instance_exposed.id: database_instance_exposed,
+    delegation_boundary_modifiable.id: delegation_boundary_modifiable,
+    identity_administration_privileges.id: identity_administration_privileges,
+    inactive_user_active_accounts.id: inactive_user_active_accounts,
+    missing_mfa_rule.id: missing_mfa_rule,
+    object_storage_public.id: object_storage_public,
+    policy_administration_privileges.id: policy_administration_privileges,
+    unmanaged_accounts.id: unmanaged_accounts,
+    workload_identity_admin_capabilities.id: workload_identity_admin_capabilities,
+    cloud_security_product_deactivated.id: cloud_security_product_deactivated,
+    malicious_npm_dependencies_shai_hulud.id: malicious_npm_dependencies_shai_hulud,
+}

cartography/rules/data/rules/cloud_security_product_deactivated.py

@@ -0,0 +1,49 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS
+aws_guard_duty_detector_disabled = Fact(
+    id="aws_guard_duty_detector_disabled",
+    name="GuardDuty Detector Disabled",
+    description="Finds regions where GuardDuty Detector is disabled.",
+    cypher_query="""
+    MATCH (a:AWSAccount)-[:RESOURCE]-(r:EC2Instance|EKSCluster|AWSLambda|ECSCluster|RDSInstance|RDSCluster)
+    WHERE NOT EXISTS {
+        MATCH (a)-[:RESOURCE]->(d:GuardDutyDetector{status: "ENABLED"})
+        WHERE d.region = r.region
+    }
+    RETURN DISTINCT r.region AS region, a.name AS account_name, a.id AS account_id
+    ORDER BY r.region, a.name
+    """,
+    cypher_visual_query="""
+    MATCH (a:AWSAccount)-[:RESOURCE]-(r:EC2Instance|EKSCluster|AWSLambda|ECSCluster|RDSInstance|RDSCluster)
+    WHERE NOT EXISTS {
+        MATCH (a)-[:RESOURCE]->(d:GuardDutyDetector{status: "ENABLED"})
+        WHERE d.region = r.region
+    }
+    RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class CloudSecurityProductDeactivated(Finding):
+    region: str | None = None
+    account_name: str | None = None
+    account_id: str | None = None
+
+
+cloud_security_product_deactivated = Rule(
+    id="cloud_security_product_deactivated",
+    name="Cloud Security Product Deactivated",
+    description="Detects accounts (or regions) where cloud security products are deactivated.",
+    output_model=CloudSecurityProductDeactivated,
+    tags=("cloud_security",),
+    facts=(aws_guard_duty_detector_disabled,),
+    version="0.1.0",
+)

cartography/rules/data/rules/compute_instance_exposed.py

@@ -0,0 +1,51 @@
+from cartography.rules.spec.model import Fact
+from cartography.rules.spec.model import Finding
+from cartography.rules.spec.model import Maturity
+from cartography.rules.spec.model import Module
+from cartography.rules.spec.model import Rule
+
+# AWS Facts
+_aws_ec2_instance_internet_exposed = Fact(
+    id="aws_ec2_instance_internet_exposed",
+    name="Internet-Exposed EC2 Instances on Common Management Ports",
+    description=(
+        "EC2 instances exposed to the internet on ports 22, 3389, 3306, 5432, 6379, 9200, 27017"
+    ),
+    cypher_query="""
+    MATCH (a:AWSAccount)-[:RESOURCE]->(ec2:EC2Instance)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)<-[:MEMBER_OF_EC2_SECURITY_GROUP]-(rule:IpPermissionInbound)
+    MATCH (rule)<-[:MEMBER_OF_IP_RULE]-(ip:IpRange{range:'0.0.0.0/0'})
+    WHERE rule.fromport IN [22, 3389, 3306, 5432, 6379, 9200, 27017]
+    RETURN a.id as account_id, a.name AS account, ec2.instanceid AS instance_id, rule.fromport AS port, sg.groupid AS security_group order by account, instance_id, port, security_group
+    """,
+    cypher_visual_query="""
+    MATCH p=(a:AWSAccount)-[:RESOURCE]->(ec2:EC2Instance)-[:MEMBER_OF_EC2_SECURITY_GROUP]->(sg:EC2SecurityGroup)<-[:MEMBER_OF_EC2_SECURITY_GROUP]-(rule:IpPermissionInbound)
+    MATCH p2=(rule)<-[:MEMBER_OF_IP_RULE]-(ip:IpRange{range:'0.0.0.0/0'})
+    WHERE rule.fromport IN [22, 3389, 3306, 5432, 6379, 9200, 27017]
+    RETURN *
+    """,
+    module=Module.AWS,
+    maturity=Maturity.EXPERIMENTAL,
+)
+
+
+# Rule
+class ComputeInstanceExposed(Finding):
+    instance: str | None = None
+    instance_id: str | None = None
+    account: str | None = None
+    account_id: str | None = None
+    port: int | None = None
+    security_group: str | None = None
+
+
+compute_instance_exposed = Rule(
+    id="compute_instance_exposed",
+    name="Internet-Exposed Compute Instances on Common Management Ports",
+    description=(
+        "Compute instances exposed to the internet on ports 22, 3389, 3306, 5432, 6379, 9200, 27017"
+    ),
+    output_model=ComputeInstanceExposed,
+    facts=(_aws_ec2_instance_internet_exposed,),
+    tags=("infrastructure", "compute", "attack_surface"),
+    version="0.1.0",
+)