prowler-cloud 5.13.1__py3-none-any.whl → 5.14.1__py3-none-any.whl

prowler/compliance/gcp/ens_rd2022_gcp.json

@@ -1,6 +1,6 @@
 {
   "Framework": "ENS",
-  "Name": "ENS RD 311/2022",
+  "Name": "ENS RD 311/2022 - Categoría Alta",
   "Version": "RD2022",
   "Provider": "GCP",
   "Description": "The accreditation scheme of the ENS (National Security Scheme) has been developed by the Ministry of Finance and Public Administrations and the CCN (National Cryptological Center). This includes the basic principles and minimum requirements necessary for the adequate protection of information.",

prowler/compliance/gcp/fedramp_20x_ksi_low_gcp.json

@@ -0,0 +1,293 @@
+{
+  "Framework": "FedRAMP-20x-KSI-Low",
+  "Name": "FedRAMP 20x Key Security Indicators (KSIs) - Low Impact Level v25.05C",
+  "Version": "25.05C",
+  "Provider": "GCP",
+  "Description": "FedRAMP 20x Key Security Indicators (KSIs) Low Impact Level represent core security indicators for cloud service providers, focusing on automation, continuous monitoring, and cloud-native security principles per FedRAMP 20x Phase One pilot requirements for Low impact systems.",
+  "Requirements": [
+    {
+      "Id": "ksi-cmt",
+      "Name": "KSI-CMT: Change Management",
+      "Description": "A secure cloud service provider will ensure that all system changes are properly documented and configuration baselines are updated accordingly",
+      "Attributes": [
+        {
+          "ItemId": "ksi-cmt",
+          "Section": "Change Management",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "iam_audit_logs_enabled",
+        "iam_cloud_asset_inventory_enabled",
+        "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled",
+        "compute_instance_serial_ports_in_use",
+        "compute_project_os_login_enabled"
+      ]
+    },
+    {
+      "Id": "ksi-cna",
+      "Name": "KSI-CNA: Cloud Native Architecture",
+      "Description": "A secure cloud service offering will use cloud native architecture and design principles to enforce and enhance the Confidentiality, Integrity and Availability of the system",
+      "Attributes": [
+        {
+          "ItemId": "ksi-cna",
+          "Section": "Cloud Native Architecture",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "cloudsql_instance_private_ip_assignment",
+        "cloudsql_instance_public_access",
+        "cloudsql_instance_public_ip",
+        "cloudstorage_bucket_uniform_bucket_level_access",
+        "compute_firewall_rdp_access_from_the_internet_allowed",
+        "compute_firewall_ssh_access_from_the_internet_allowed",
+        "compute_instance_block_project_wide_ssh_keys_disabled",
+        "compute_instance_confidential_computing_enabled",
+        "compute_instance_ip_forwarding_is_enabled",
+        "compute_instance_public_ip",
+        "compute_instance_shielded_vm_enabled",
+        "compute_loadbalancer_logging_enabled",
+        "compute_network_default_in_use",
+        "compute_network_dns_logging_enabled",
+        "compute_network_not_legacy",
+        "compute_subnet_flow_logs_enabled",
+        "gke_cluster_no_default_service_account"
+      ]
+    },
+    {
+      "Id": "ksi-iam",
+      "Name": "KSI-IAM: Identity and Access Management",
+      "Description": "A secure cloud service offering will protect user data, control access, and apply zero trust principles",
+      "Attributes": [
+        {
+          "ItemId": "ksi-iam",
+          "Section": "Identity and Access Management",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "apikeys_api_restrictions_configured",
+        "apikeys_key_exists",
+        "apikeys_key_rotated_in_90_days",
+        "compute_instance_default_service_account_in_use",
+        "compute_instance_default_service_account_in_use_with_full_api_access",
+        "iam_no_service_roles_at_project_level",
+        "iam_role_kms_enforce_separation_of_duties",
+        "iam_role_sa_enforce_separation_of_duties",
+        "iam_sa_no_administrative_privileges",
+        "iam_sa_no_user_managed_keys",
+        "iam_sa_user_managed_key_rotate_90_days",
+        "iam_sa_user_managed_key_unused",
+        "iam_service_account_unused"
+      ]
+    },
+    {
+      "Id": "ksi-inr",
+      "Name": "KSI-INR: Incident Response",
+      "Description": "A secure cloud service offering will respond to incidents according to FedRAMP requirements and cloud service provider policies",
+      "Attributes": [
+        {
+          "ItemId": "ksi-inr",
+          "Section": "Incident Response",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "iam_organization_essential_contacts_configured",
+        "iam_account_access_approval_enabled",
+        "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled"
+      ]
+    },
+    {
+      "Id": "ksi-mla",
+      "Name": "KSI-MLA: Monitoring, Logging, and Auditing",
+      "Description": "A secure cloud service offering will monitor, log, and audit all important events, activity, and changes",
+      "Attributes": [
+        {
+          "ItemId": "ksi-mla",
+          "Section": "Monitoring, Logging, and Auditing",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "cloudsql_instance_postgres_enable_pgaudit_flag",
+        "cloudsql_instance_postgres_log_connections_flag",
+        "cloudsql_instance_postgres_log_disconnections_flag",
+        "cloudsql_instance_postgres_log_error_verbosity_flag",
+        "cloudsql_instance_postgres_log_min_duration_statement_flag",
+        "cloudsql_instance_postgres_log_min_error_statement_flag",
+        "cloudsql_instance_postgres_log_min_messages_flag",
+        "cloudsql_instance_postgres_log_statement_flag",
+        "cloudsql_instance_sqlserver_trace_flag",
+        "cloudstorage_bucket_log_retention_policy_lock",
+        "compute_loadbalancer_logging_enabled",
+        "compute_network_dns_logging_enabled",
+        "compute_subnet_flow_logs_enabled",
+        "iam_audit_logs_enabled",
+        "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
+        "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled",
+        "logging_sink_created"
+      ]
+    },
+    {
+      "Id": "ksi-piy",
+      "Name": "KSI-PIY: Policy and Inventory",
+      "Description": "A secure cloud service offering will have intentional, organized, universal guidance for how every information resource, including personnel, is secured",
+      "Attributes": [
+        {
+          "ItemId": "ksi-piy",
+          "Section": "Policy and Inventory",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "iam_cloud_asset_inventory_enabled",
+        "iam_organization_essential_contacts_configured",
+        "iam_audit_logs_enabled",
+        "compute_project_os_login_enabled",
+        "compute_instance_serial_ports_in_use",
+        "compute_instance_block_project_wide_ssh_keys_disabled",
+        "logging_sink_created"
+      ]
+    },
+    {
+      "Id": "ksi-rpl",
+      "Name": "KSI-RPL: Recovery Planning",
+      "Description": "A secure cloud service offering will define, maintain, and test incident response plan(s) and recovery capabilities to ensure minimal service disruption and data loss",
+      "Attributes": [
+        {
+          "ItemId": "ksi-rpl",
+          "Section": "Recovery Planning",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "cloudsql_instance_automated_backups",
+        "cloudstorage_bucket_log_retention_policy_lock",
+        "cloudstorage_bucket_versioning_enabled",
+        "cloudstorage_bucket_lifecycle_management_enabled"
+      ]
+    },
+    {
+      "Id": "ksi-svc",
+      "Name": "KSI-SVC: Service Configuration",
+      "Description": "A secure cloud service offering will follow FedRAMP encryption policies, continuously verify information resource integrity, and restrict access to third-party information resources",
+      "Attributes": [
+        {
+          "ItemId": "ksi-svc",
+          "Section": "Service Configuration",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "bigquery_dataset_cmk_encryption",
+        "bigquery_table_cmk_encryption",
+        "cloudsql_instance_mysql_local_infile_flag",
+        "cloudsql_instance_mysql_skip_show_database_flag",
+        "cloudsql_instance_postgres_enable_pgaudit_flag",
+        "cloudsql_instance_postgres_log_connections_flag",
+        "cloudsql_instance_postgres_log_disconnections_flag",
+        "cloudsql_instance_postgres_log_error_verbosity_flag",
+        "cloudsql_instance_postgres_log_min_duration_statement_flag",
+        "cloudsql_instance_postgres_log_min_error_statement_flag",
+        "cloudsql_instance_postgres_log_min_messages_flag",
+        "cloudsql_instance_postgres_log_statement_flag",
+        "cloudsql_instance_sqlserver_contained_database_authentication_flag",
+        "cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag",
+        "cloudsql_instance_sqlserver_external_scripts_enabled_flag",
+        "cloudsql_instance_sqlserver_remote_access_flag",
+        "cloudsql_instance_sqlserver_trace_flag",
+        "cloudsql_instance_sqlserver_user_connections_flag",
+        "cloudsql_instance_sqlserver_user_options_flag",
+        "cloudsql_instance_ssl_connections",
+        "compute_instance_encryption_with_csek_enabled",
+        "compute_instance_shielded_vm_enabled",
+        "dataproc_encrypted_with_cmks_disabled",
+        "dns_dnssec_disabled",
+        "dns_rsasha1_in_use_to_key_sign_in_dnssec",
+        "dns_rsasha1_in_use_to_zone_sign_in_dnssec",
+        "kms_key_not_publicly_accessible",
+        "kms_key_rotation_enabled"
+      ]
+    },
+    {
+      "Id": "ksi-tpr",
+      "Name": "KSI-TPR: Third-Party Information Resources",
+      "Description": "A secure cloud service offering will understand, monitor, and manage supply chain risks from third-party information resources",
+      "Attributes": [
+        {
+          "ItemId": "ksi-tpr",
+          "Section": "Third-Party Information Resources",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "artifacts_container_analysis_enabled",
+        "gcr_container_scanning_enabled",
+        "compute_public_address_shodan",
+        "cloudsql_instance_automated_backups",
+        "iam_sa_user_managed_key_rotate_90_days",
+        "iam_service_account_unused"
+      ]
+    },
+    {
+      "Id": "ksi-iam-07",
+      "Name": "KSI-IAM-07: Account Lifecycle Management",
+      "Description": "Securely manage the lifecycle and privileges of all accounts, roles, and groups",
+      "Attributes": [
+        {
+          "ItemId": "ksi-iam-07",
+          "Section": "Identity and Access Management",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "apikeys_key_rotated_in_90_days",
+        "iam_sa_user_managed_key_rotate_90_days",
+        "iam_sa_user_managed_key_unused",
+        "iam_service_account_unused",
+        "compute_instance_default_service_account_in_use"
+      ]
+    },
+    {
+      "Id": "ksi-mla-07",
+      "Name": "KSI-MLA-07: Monitoring and Logging Inventory",
+      "Description": "Maintain a list of information resources and event types that will be monitored, logged, and audited",
+      "Attributes": [
+        {
+          "ItemId": "ksi-mla-07",
+          "Section": "Monitoring, Logging, and Auditing",
+          "Service": "gcp"
+        }
+      ],
+      "Checks": [
+        "iam_audit_logs_enabled",
+        "iam_cloud_asset_inventory_enabled",
+        "logging_sink_created",
+        "compute_subnet_flow_logs_enabled",
+        "compute_network_dns_logging_enabled"
+      ]
+    }
+  ]
+}