diff --git a/collectors/azure/collector.js b/collectors/azure/collector.js index 6d9d0e3420..c7f4a1007b 100644 --- a/collectors/azure/collector.js +++ b/collectors/azure/collector.js @@ -113,10 +113,12 @@ let collect = function(AzureConfig, settings, callback) { return accumulator; }, {}); - settings.previousCollection = Object.keys(settings.previousCollection).reduce((accumulator, key) => { - accumulator[key.toLowerCase()] = settings.previousCollection[key]; - return accumulator; - }, {}); + if (settings.previousCollection) { + settings.previousCollection = Object.keys(settings.previousCollection).reduce((accumulator, key) => { + accumulator[key.toLowerCase()] = settings.previousCollection[key]; + return accumulator; + }, {}); + } if (collect[service.toLowerCase()] && Object.keys(collect[service.toLowerCase()]) && diff --git a/helpers/aws/api.js b/helpers/aws/api.js index dd268b25f0..c1faf467b1 100644 --- a/helpers/aws/api.js +++ b/helpers/aws/api.js @@ -135,15 +135,6 @@ var serviceMap = { BridgeResourceNameIdentifier: 'Name', BridgeExecutionService: 'MemoryDB', BridgeCollectionService: 'memorydb', DataIdentifier: 'data', }, - 'Kendra': - { - enabled: true, isSingleSource: true, InvAsset: 'instance', InvService: 'kendra', - InvResourceCategory: 'database', InvResourceType: 'kendra_instance', BridgeServiceName: 'kendra', - BridgePluginCategoryName: 'Kendra', BridgeProvider: 'aws', BridgeCall: 'listIndices', - BridgeArnIdentifier: '', BridgeIdTemplate: 'arn:aws:kendra:{region}:{cloudAccount}:index/{name}', - BridgeResourceType: 'index', BridgeResourceNameIdentifier: 'Name', BridgeExecutionService: 'Kendra', - BridgeCollectionService: 'kendra', DataIdentifier: 'data', - }, 'ES': { enabled: true, isSingleSource: true, InvAsset: 'domain', InvService: 'elasticsearch', @@ -368,18 +359,9 @@ var serviceMap = { InvResourceCategory: 'cloud_resources', InvResourceType: 'sns_topic', BridgeProvider: 'aws', BridgeServiceName: 'sns', BridgePluginCategoryName: 'SNS', BridgeCall: 'getTopicAttributes', BridgeArnIdentifier: 'TopicArn', BridgeIdTemplate: '', - BridgeResourceType: 'sns_topic', BridgeResourceNameIdentifier: '', BridgeExecutionService: 'SNS', + BridgeResourceType: 'sns', BridgeResourceNameIdentifier: '', BridgeExecutionService: 'SNS', BridgeCollectionService: 'sns', DataIdentifier: 'Attributes', }, - 'SageMaker': - { - enabled: true, isSingleSource: true, InvAsset: 'instance', InvService: 'sageMaker', - InvResourceCategory: 'cloud_resources', InvResourceType: 'Sagemaker Instance', - BridgeProvider: 'aws', BridgeServiceName: 'sagemaker', BridgePluginCategoryName: 'SageMaker', - BridgeArnIdentifier: 'NotebookInstanceArn', BridgeIdTemplate: '', BridgeResourceType: 'sagemaker', - BridgeResourceNameIdentifier: 'NotebookInstanceName', BridgeExecutionService: 'SageMaker', - BridgeCollectionService: 'sagemaker', BridgeCall: 'describeNotebookInstance', DataIdentifier: 'data', - }, 'Route53': { enabled: true, isSingleSource: true, InvAsset: 'hostedzone', InvService: 'route53', @@ -443,33 +425,6 @@ var serviceMap = { BridgeResourceType: 'managedblockchain', BridgeResourceNameIdentifier: 'Name', BridgeExecutionService: 'Managed Blockchain', BridgeCollectionService: 'managedblockchain', BridgeCall: 'listNetworks', DataIdentifier: 'data', }, - 'Lookout': - { - enabled: true, isSingleSource: true, InvAsset: 'project', InvService: 'lookoutVision', - InvResourceCategory: 'cloud_resources', InvResourceType: 'lookout', - BridgeProvider: 'aws', BridgeServiceName: 'lookoutvision', BridgePluginCategoryName: 'Lookout', - BridgeArnIdentifier: 'ProjectArn', BridgeIdTemplate: '', - BridgeResourceType: 'project', BridgeResourceNameIdentifier: 'ProjectName', BridgeExecutionService: 'Lookout', - BridgeCollectionService: 'lookoutvision', BridgeCall: 'listProjects', DataIdentifier: 'data', - }, - 'LookoutEquipment': - { - enabled: true, isSingleSource: true, InvAsset: 'dataset', InvService: 'lookoutEquipment', - InvResourceCategory: 'cloud_resources', InvResourceType: 'lookout equipment', - BridgeProvider: 'aws', BridgeServiceName: 'lookoutequipment', BridgePluginCategoryName: 'LookoutEquipment', - BridgeArnIdentifier: 'DatasetArn', BridgeIdTemplate: '', - BridgeResourceType: 'lookoutequipment', BridgeResourceNameIdentifier: 'DatasetName', BridgeExecutionService: 'LookoutEquipment', - BridgeCollectionService: 'lookoutequipment', BridgeCall: 'listDatasets', DataIdentifier: 'data', - }, - 'LookoutMetrics': - { - enabled: true, isSingleSource: true, InvAsset: 'metrics', InvService: 'lookoutMetrics', - InvResourceCategory: 'cloud_resources', InvResourceType: 'lookout metrics', - BridgeProvider: 'aws', BridgeServiceName: 'lookoutmetrics', BridgePluginCategoryName: 'LookoutMetrics', - BridgeArnIdentifier: 'AnomalyDetectorArn', BridgeIdTemplate: '', - BridgeResourceType: 'lookoutmetrics', BridgeResourceNameIdentifier: 'AnomalyDetectorName', BridgeExecutionService: 'LookoutMetrics', - BridgeCollectionService: 'lookoutmetrics', BridgeCall: 'listAnomalyDetectors', DataIdentifier: 'data', - }, 'Location': { enabled: true, isSingleSource: true, InvAsset: 'tracker', InvService: 'location', @@ -479,15 +434,6 @@ var serviceMap = { BridgeResourceType: 'geo', BridgeResourceNameIdentifier: 'TrackerName', BridgeExecutionService: 'Location', BridgeCollectionService: 'location', BridgeCall: 'describeTracker', DataIdentifier: 'data', }, - 'Lex': - { - enabled: true, isSingleSource: true, InvAsset: 'bot', InvService: 'lex', - InvResourceCategory: 'cloud_resources', InvResourceType: 'Lex BotAlias', - BridgeProvider: 'aws', BridgeServiceName: 'lexmodelsv2', BridgePluginCategoryName: 'Lex', - BridgeArnIdentifier: '', BridgeIdTemplate: 'arn:aws:lex:{region}:{cloudAccount}:bot-alias/{id}', - BridgeResourceType: 'bot-alias', BridgeResourceNameIdentifier: 'botAliasName', BridgeExecutionService: 'Lex', - BridgeCollectionService: 'lexmodelsv2', BridgeCall: 'describeBotAlias', DataIdentifier: 'data', - }, 'Kinesis Video Streams': { enabled: true, isSingleSource: true, InvAsset: 'stream', InvService: 'kinesisVideo', @@ -532,7 +478,97 @@ var serviceMap = { BridgeArnIdentifier: 'LoadBalancerArn', BridgeIdTemplate: '', BridgeResourceType: 'loadbalancer', BridgeResourceNameIdentifier: 'LoadBalancerName', BridgeExecutionService: 'ELBv2', BridgeCollectionService: 'elbv2', BridgeCall: 'describeLoadBalancers', DataIdentifier: 'data', - } + }, + 'AI & ML': [ + { + enabled: true, isSingleSource: true, InvAsset: 'models', InvService: 'bedrock', + InvResourceCategory: 'ai&ml', InvResourceType: 'Bedrock Model',BridgeProvider: 'aws', + BridgeServiceName: 'bedrock', BridgePluginCategoryName: 'AI & ML', + BridgeArnIdentifier: 'modelArn', BridgeIdTemplate: '', BridgeResourceType: 'custom-model', + BridgeResourceNameIdentifier: 'modelName', BridgeExecutionService: 'AI & ML', + BridgeCollectionService: 'bedrock', BridgeCall: 'getCustomModel', DataIdentifier: 'data', + }, + { + enabled: true, isSingleSource: true, InvAsset: 'comprehend', InvService: 'comprehend', + InvResourceCategory: 'ai&ml', InvResourceType: 'Comprehend', + BridgeProvider: 'aws', BridgeServiceName: 'comprehend', BridgePluginCategoryName: 'AI & ML', + BridgeArnIdentifier: 'JobId', BridgeIdTemplate: '', BridgeResourceType: 'comprehend', + BridgeResourceNameIdentifier: 'jobName', BridgeExecutionService: 'AI & ML', + BridgeCollectionService: 'comprehend', BridgeCall: 'listEntitiesDetectionJobs', DataIdentifier: 'data', + }, + { + enabled: true, isSingleSource: true, InvAsset: 'forecastDataset', InvService: 'forecast', + InvResourceCategory: 'ai&ml', InvResourceType: 'Forecast Dataset', + BridgeProvider: 'aws', BridgeServiceName: 'forecastservice', BridgePluginCategoryName: 'AI & ML', + BridgeArnIdentifier: 'DatasetArn', BridgeIdTemplate: '', BridgeResourceType: 'dataset', + BridgeResourceNameIdentifier: 'DatasetName', BridgeExecutionService: 'AI & ML', + BridgeCollectionService: 'forecastservice', BridgeCall: 'listDatasets', DataIdentifier: 'data', + }, + { + enabled: true, isSingleSource: true, InvAsset: 'translateJobs', InvService: 'translate', + InvResourceCategory: 'ai&ml', InvResourceType: 'Translate Job', BridgeServiceName: 'translate', + BridgePluginCategoryName: 'AI & ML', BridgeProvider: 'aws', BridgeCall: 'listTextTranslationJobs', + BridgeArnIdentifier: '', BridgeIdTemplate: 'arn:aws:translate:{region}:{cloudAccount}:job/{name}', + BridgeResourceType: 'job', BridgeResourceNameIdentifier: 'JobName', + BridgeExecutionService: 'AI & ML', BridgeCollectionService: 'translate', DataIdentifier: 'data', + }, + { + enabled: true, isSingleSource: true, InvAsset: 'datastores', InvService: 'healthlake', + InvResourceCategory: 'ai&ml', InvResourceType: 'Healthlake Datastore', + BridgeProvider: 'aws', BridgeServiceName: 'healthlake', BridgePluginCategoryName: 'AI & ML', + BridgeArnIdentifier: 'DatastoreArn', BridgeIdTemplate: '', BridgeResourceType: 'datastore', + BridgeResourceNameIdentifier: 'DatastoreId', BridgeExecutionService: 'AI & ML', + BridgeCollectionService: 'healthlake', BridgeCall: 'listFHIRDatastores', DataIdentifier: 'data', + }, + { + enabled: true, isSingleSource: true, InvAsset: 'instance', InvService: 'kendra', + InvResourceCategory: 'ai&ml', InvResourceType: 'Kendra Instance', BridgeServiceName: 'kendra', + BridgePluginCategoryName: 'AI & ML', BridgeProvider: 'aws', BridgeCall: 'listIndices', + BridgeArnIdentifier: '', BridgeIdTemplate: 'arn:aws:kendra:{region}:{cloudAccount}:index/{name}', + BridgeResourceType: 'index', BridgeResourceNameIdentifier: 'Name', BridgeExecutionService: 'AI & ML', + BridgeCollectionService: 'kendra', DataIdentifier: 'data', + }, + { + enabled: true, isSingleSource: true, InvAsset: 'bot', InvService: 'lex', + InvResourceCategory: 'ai&ml', InvResourceType: 'Lex BotAlias', + BridgeProvider: 'aws', BridgeServiceName: 'lexmodelsv2', BridgePluginCategoryName: 'AI & ML', + BridgeArnIdentifier: '', BridgeIdTemplate: 'arn:aws:lex:{region}:{cloudAccount}:bot-alias/{id}', + BridgeResourceType: 'bot-alias', BridgeResourceNameIdentifier: 'botAliasName', BridgeExecutionService: 'AI & ML', + BridgeCollectionService: 'lexmodelsv2', BridgeCall: 'describeBotAlias', DataIdentifier: 'data', + }, + { + enabled: true, isSingleSource: true, InvAsset: 'project', InvService: 'lookoutVision', + InvResourceCategory: 'ai&ml', InvResourceType: 'Lookout Vision', + BridgeProvider: 'aws', BridgeServiceName: 'lookoutvision', BridgePluginCategoryName: 'AI & ML', + BridgeArnIdentifier: 'ProjectArn', BridgeIdTemplate: '', + BridgeResourceType: 'project', BridgeResourceNameIdentifier: 'ProjectName', BridgeExecutionService: 'AI & ML', + BridgeCollectionService: 'lookoutvision', BridgeCall: 'listProjects', DataIdentifier: 'data', + }, + { + enabled: true, isSingleSource: true, InvAsset: 'dataset', InvService: 'lookoutEquipment', + InvResourceCategory: 'ai&ml', InvResourceType: 'Lookout Equipment', + BridgeProvider: 'aws', BridgeServiceName: 'lookoutequipment', BridgePluginCategoryName: 'AI & ML', + BridgeArnIdentifier: 'DatasetArn', BridgeIdTemplate: '', + BridgeResourceType: 'dataset', BridgeResourceNameIdentifier: 'DatasetName', BridgeExecutionService: 'AI & ML', + BridgeCollectionService: 'lookoutequipment', BridgeCall: 'listDatasets', DataIdentifier: 'data', + }, + { + enabled: true, isSingleSource: true, InvAsset: 'metrics', InvService: 'lookoutMetrics', + InvResourceCategory: 'ai&ml', InvResourceType: 'Lookout Metrics', + BridgeProvider: 'aws', BridgeServiceName: 'lookoutmetrics', BridgePluginCategoryName: 'AI & ML', + BridgeArnIdentifier: 'AnomalyDetectorArn', BridgeIdTemplate: '', + BridgeResourceType: 'lookoutmetrics', BridgeResourceNameIdentifier: 'AnomalyDetectorName', BridgeExecutionService: 'AI & ML', + BridgeCollectionService: 'lookoutmetrics', BridgeCall: 'listAnomalyDetectors', DataIdentifier: 'data', + }, + { + enabled: true, isSingleSource: true, InvAsset: 'instance', InvService: 'sageMaker', + InvResourceCategory: 'ai&ml', InvResourceType: 'Sagemaker Instance', + BridgeProvider: 'aws', BridgeServiceName: 'sagemaker', BridgePluginCategoryName: 'AI & ML', + BridgeArnIdentifier: 'NotebookInstanceArn', BridgeIdTemplate: '', BridgeResourceType: 'notebook-instance', + BridgeResourceNameIdentifier: 'NotebookInstanceName', BridgeExecutionService: 'AI & ML', + BridgeCollectionService: 'sagemaker', BridgeCall: 'describeNotebookInstance', DataIdentifier: 'data', + }, + ], }; var calls = { @@ -638,7 +674,7 @@ var calls = { paginate: 'NextToken', }, getModelInvocationLoggingConfiguration: { - property: 'loggingConfig', + property: 'loggingConfig', paginate: 'NextToken' } }, @@ -683,7 +719,10 @@ var calls = { }, CloudTrail: { describeTrails: { - property: 'trailList' + property: 'trailList', + params: { + includeShadowTrails: false + } } }, CloudWatch: { @@ -924,7 +963,6 @@ var calls = { Values: [ 'pending', 'running', - 'shutting-down', 'stopping', 'stopped' ] @@ -1707,6 +1745,15 @@ var postcalls = [ DocDB: { sendIntegration: serviceMap['DocumentDB'] }, + Comprehend: { + sendIntegration: serviceMap['AI & ML'][1] + }, + Translate: { + sendIntegration: serviceMap['AI & ML'][3] + }, + HealthLake: { + sendIntegration: serviceMap['AI & ML'][4] + }, Neptune: { sendIntegration:serviceMap['Neptune'] }, @@ -1881,7 +1928,8 @@ var postcalls = [ reliesOnCall: 'listModelCustomizationJobs', filterKey: 'jobIdentifier', filterValue: 'jobArn', - } + }, + sendIntegration: serviceMap['AI & ML'][0] }, CloudFormation: { describeStackEvents: { @@ -1978,17 +2026,17 @@ var postcalls = [ getRdsMetricStatistics: { reliesOnService: 'rds', reliesOnCall: 'describeDBInstances', - override: true, + override: true, }, getRdsWriteIOPSMetricStatistics: { reliesOnService: 'rds', reliesOnCall: 'describeDBInstances', - override: true, + override: true, }, getRdsReadIOPSMetricStatistics: { reliesOnService: 'rds', reliesOnCall: 'describeDBInstances', - override: true, + override: true, } }, ConfigService: { @@ -2414,7 +2462,8 @@ var postcalls = [ reliesOnCall: 'listDatasets', filterKey: 'DatasetArn', filterValue: 'DatasetArn' - } + }, + sendIntegration: serviceMap['AI & ML'][2] }, Glacier: { getVaultAccessPolicy: { @@ -2504,7 +2553,7 @@ var postcalls = [ filterKey: 'Id', filterValue: 'Id' }, - sendIntegration: serviceMap['Kendra'] + sendIntegration: serviceMap['AI & ML'][5] }, Kinesis: { describeStream: { @@ -2583,7 +2632,7 @@ var postcalls = [ filterKey: 'DatasetName', filterValue: 'DatasetName' }, - sendIntegration: serviceMap['LookoutEquipment'] + sendIntegration: serviceMap['AI & ML'][8] }, Location: { describeTracker: { @@ -2649,7 +2698,7 @@ var postcalls = [ filterKey: 'AnomalyDetectorArn', filterValue: 'AnomalyDetectorArn' }, - sendIntegration: serviceMap['LookoutMetrics'] + sendIntegration: serviceMap['AI & ML'][9] }, MWAA: { getEnvironment: { @@ -2724,7 +2773,7 @@ var postcalls = [ filterKey: 'NotebookInstanceName', filterValue: 'NotebookInstanceName' }, - sendIntegration: serviceMap['SageMaker'] + sendIntegration: serviceMap['AI & ML'][10] }, SecretsManager: { describeSecret: { @@ -2897,7 +2946,7 @@ var postcalls = [ reliesOnCall: 'listProjects', override: true }, - sendIntegration: serviceMap['Lookout'] + sendIntegration: serviceMap['AI & ML'][7] }, GuardDuty: { getFindings: { @@ -2917,7 +2966,7 @@ var postcalls = [ reliesOnCall: 'listBots', override: true, }, - sendIntegration: serviceMap['Lex'] + sendIntegration: serviceMap['AI & ML'][6] }, ManagedBlockchain: { getMember: { @@ -2980,4 +3029,4 @@ module.exports = { calls: calls, postcalls: postcalls, integrationSendLast: integrationSendLast -}; \ No newline at end of file +}; diff --git a/helpers/aws/api_multipart.js b/helpers/aws/api_multipart.js index b72b111afd..8249da0f0e 100644 --- a/helpers/aws/api_multipart.js +++ b/helpers/aws/api_multipart.js @@ -48,7 +48,7 @@ var calls = [ property: 'collectionSummaries' }, listNetworkSecurityPolicies: { - override: true, + override: true, }, listEncryptionSecurityPolicies:{ override: true, @@ -128,7 +128,7 @@ var calls = [ paginate: 'NextToken', }, getModelInvocationLoggingConfiguration: { - property: 'loggingConfig', + property: 'loggingConfig', paginate: 'NextToken' } }, @@ -169,7 +169,10 @@ var calls = [ }, CloudTrail: { describeTrails: { - property: 'trailList' + property: 'trailList', + params: { + includeShadowTrails: false + } } }, CloudWatch: { @@ -397,7 +400,6 @@ var calls = [ Values: [ 'pending', 'running', - 'shutting-down', 'stopping', 'stopped' ] @@ -1328,17 +1330,17 @@ var postcalls = [ getRdsMetricStatistics: { reliesOnService: 'rds', reliesOnCall: 'describeDBInstances', - override: true, + override: true, }, getRdsWriteIOPSMetricStatistics: { reliesOnService: 'rds', reliesOnCall: 'describeDBInstances', - override: true, + override: true, }, getRdsReadIOPSMetricStatistics: { reliesOnService: 'rds', reliesOnCall: 'describeDBInstances', - override: true, + override: true, } }, ConfigService: { @@ -2357,12 +2359,12 @@ var postcalls = [ getNetworkSecurityPolicy: { reliesOnService: 'opensearchserverless', reliesOnCall: 'listNetworkSecurityPolicies', - override: true, + override: true, }, getEncryptionSecurityPolicy: { reliesOnService: 'opensearchserverless', reliesOnCall: 'listEncryptionSecurityPolicies', - override: true, + override: true, } } }, @@ -2373,4 +2375,4 @@ module.exports = { callsMultipart: calls, postcallsMultipart: postcalls, integrationSendLast: integrationSendLast -}; \ No newline at end of file +}; diff --git a/helpers/azure/locations.js b/helpers/azure/locations.js index be3bbaef4c..e6ec5ed63b 100644 --- a/helpers/azure/locations.js +++ b/helpers/azure/locations.js @@ -53,6 +53,8 @@ var locations = [ 'canadaeast', // (Canada) Canada East 'qatarcentral', // (Middle East) Qatar 'polandcentral', // (Europe) Poland Central + 'italynorth', // (Europe) Italy North + 'israelcentral', // (Middle East) Israel Central ]; module.exports = { diff --git a/helpers/shared.js b/helpers/shared.js index 988c40dbda..6c2a4ca572 100644 --- a/helpers/shared.js +++ b/helpers/shared.js @@ -23,7 +23,8 @@ var processIntegration = function(serviceName, settings, collection, calls, post if (settings.govcloud) { localEvent.awsOrGov = 'aws-us-gov'; } - + + localEvent.scanTriggeredFromEventsFlow = settings.scanTriggeredFromEventsFlow; localEvent.collection = {}; localEvent.previousCollection = {}; diff --git a/plugins/aws/bedrock/customModelEncryptionEnabled.js b/plugins/aws/bedrock/customModelEncryptionEnabled.js index 7cf13deb30..e4a0d83c9b 100644 --- a/plugins/aws/bedrock/customModelEncryptionEnabled.js +++ b/plugins/aws/bedrock/customModelEncryptionEnabled.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Custom Model Encryption Enabled', - category: 'ML & AI', + category: 'AI & ML', domain: 'Machine Learning', description: 'Ensure that an Amazon Bedrock custom models are encrypted with desired encryption level.', more_info: 'When you encrypt AWS Bedrock custom model using your own AWS Customer Managed Keys (CMKs) for enhanced protection, you have full control over who can use the encryption keys to access your custom model.', diff --git a/plugins/aws/bedrock/customModelInVpc.js b/plugins/aws/bedrock/customModelInVpc.js index 819de4ec71..02e4e379ca 100644 --- a/plugins/aws/bedrock/customModelInVpc.js +++ b/plugins/aws/bedrock/customModelInVpc.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Custom Model In VPC', - category: 'ML & AI', + category: 'AI & ML', domain: 'Machine Learning', description: 'Ensure that an Amazon Bedrock custom model is configured with a VPC.', more_info: 'When the custom model is configured within a VPC, it establishes a secure environment that prevents unauthorized internet access to your training data, enhancing the overall security and confidentiality of your model.', diff --git a/plugins/aws/bedrock/modelInvocationLoggingEnabled.js b/plugins/aws/bedrock/modelInvocationLoggingEnabled.js index 65801c0d66..9bafabb5a2 100644 --- a/plugins/aws/bedrock/modelInvocationLoggingEnabled.js +++ b/plugins/aws/bedrock/modelInvocationLoggingEnabled.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Bedrock Model Invocation Logging Enabled', - category: 'ML & AI', + category: 'AI & ML', domain: 'Machine Learning', description: 'Ensure that Amazon Bedrock model invocation logging is enabled.', more_info: 'With invocation logging enabled, you can collect the full request data, response data, and metadata associated with all calls performed in account. This detailed logging provides valuable insights into model usage patterns, helps in troubleshooting, and enhances security by allowing for thorough analysis of model interactions. It also facilitates compliance with auditing requirements, offering a comprehensive record of model invocations.', diff --git a/plugins/aws/bedrock/privateCustomModel.js b/plugins/aws/bedrock/privateCustomModel.js index 327f85e6d0..ef21e4023f 100644 --- a/plugins/aws/bedrock/privateCustomModel.js +++ b/plugins/aws/bedrock/privateCustomModel.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Private Custom Model', - category: 'ML & AI', + category: 'AI & ML', domain: 'Machine Learning', description: 'Ensure that an Amazon Bedrock custom model is configured within a private VPC.', more_info: 'When the custom model is configured within a private VPC or with a private VPC endpoint, it enhances security by restricting access to authorized networks only, preventing exposure to the public internet.', diff --git a/plugins/aws/cloudtrail/cloudtrailEncryption.js b/plugins/aws/cloudtrail/cloudtrailEncryption.js index eb6b874484..d87094b9db 100644 --- a/plugins/aws/cloudtrail/cloudtrailEncryption.js +++ b/plugins/aws/cloudtrail/cloudtrailEncryption.js @@ -55,7 +55,7 @@ module.exports = { helpers.addResult(results, 2, 'CloudTrail is not enabled', region); } else if (describeTrails.data[0]) { for (var t in describeTrails.data) { - if (describeTrails.data[t].S3BucketName == helpers.CLOUDSPLOIT_EVENTS_BUCKET) continue; + if (describeTrails.data[t].S3BucketName == helpers.CLOUDSPLOIT_EVENTS_BUCKET || (describeTrails.data[t].HomeRegion && describeTrails.data[t].HomeRegion.toLowerCase() !== region)) continue; if (!describeTrails.data[t].KmsKeyId) { helpers.addResult(results, 2, 'CloudTrail encryption is not enabled', region, describeTrails.data[t].TrailARN); @@ -122,4 +122,4 @@ module.exports = { return callback(null, action); }); } -}; \ No newline at end of file +}; diff --git a/plugins/aws/cloudtrail/cloudtrailToCloudwatch.js b/plugins/aws/cloudtrail/cloudtrailToCloudwatch.js index c6ac399902..8e38bd2eeb 100644 --- a/plugins/aws/cloudtrail/cloudtrailToCloudwatch.js +++ b/plugins/aws/cloudtrail/cloudtrailToCloudwatch.js @@ -36,7 +36,7 @@ module.exports = { helpers.addResult(results, 2, 'CloudTrail is not enabled', region); } else if (describeTrails.data[0]) { for (var t in describeTrails.data) { - if (describeTrails.data[t].S3BucketName == helpers.CLOUDSPLOIT_EVENTS_BUCKET) continue; + if (describeTrails.data[t].S3BucketName == helpers.CLOUDSPLOIT_EVENTS_BUCKET || (describeTrails.data[t].HomeRegion && describeTrails.data[t].HomeRegion.toLowerCase() !== region)) continue; if (!describeTrails.data[t].CloudWatchLogsLogGroupArn) { helpers.addResult(results, 2, 'CloudTrail CloudWatch integration is not enabled', region, describeTrails.data[t].TrailARN); @@ -53,4 +53,4 @@ module.exports = { callback(null, results, source); }); } -}; \ No newline at end of file +}; diff --git a/plugins/aws/comprehend/outputResultEncryption.js b/plugins/aws/comprehend/outputResultEncryption.js index a0a6ebb87d..42ce2db02f 100644 --- a/plugins/aws/comprehend/outputResultEncryption.js +++ b/plugins/aws/comprehend/outputResultEncryption.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Amazon Comprehend Output Result Encryption', - category: 'ML & AI', + category: 'AI & ML', domain: 'Compute', description: 'Ensures the Comprehend service is using encryption for all result output.', more_info: 'Comprehend supports using KMS keys to result output, which should be enabled.', diff --git a/plugins/aws/comprehend/volumeEncryption.js b/plugins/aws/comprehend/volumeEncryption.js index 44dab1de3b..bfb94d6e5c 100644 --- a/plugins/aws/comprehend/volumeEncryption.js +++ b/plugins/aws/comprehend/volumeEncryption.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Amazon Comprehend Volume Encryption', - category: 'ML & AI', + category: 'AI & ML', domain: 'Compute', description: 'Ensures the Comprehend service is using encryption for all volumes storing data at rest.', more_info: 'Comprehend supports using KMS keys to encrypt data at rest, which should be enabled.', diff --git a/plugins/aws/devopsguru/devOpsGuruNotificationEnabled.js b/plugins/aws/devopsguru/devOpsGuruNotificationEnabled.js index e7b9dd2ea3..8081cc198c 100644 --- a/plugins/aws/devopsguru/devOpsGuruNotificationEnabled.js +++ b/plugins/aws/devopsguru/devOpsGuruNotificationEnabled.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'DevOps Guru Notifications Enabled', - category: 'ML & AI', + category: 'AI & ML', domain: 'Availability', description: 'Ensures SNS topic is set up for Amazon DevOps Guru.', more_info: 'Amazon DevOps Guru uses an SNS topic to notify you about important DevOps Guru events.', diff --git a/plugins/aws/forecast/datasetExportEncrypted.js b/plugins/aws/forecast/datasetExportEncrypted.js index 1bacfe2843..b1f9d70785 100644 --- a/plugins/aws/forecast/datasetExportEncrypted.js +++ b/plugins/aws/forecast/datasetExportEncrypted.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Forecast Dataset Export Encrypted', - category: 'ML & AI', + category: 'AI & ML', domain: 'Content Delivery', description: 'Ensure that AWS Forecast exports have encryption enabled before they are being saved on S3.', more_info: 'In AWS Forecast, you can save forecast reports on S3 in CSV format. Make sure to encrypt these export before writing them to the bucket in order to follow your organizations\'s security and compliance requirements.', diff --git a/plugins/aws/forecast/forecastDatasetEncrypted.js b/plugins/aws/forecast/forecastDatasetEncrypted.js index 1a7d15f7dc..86fd2e7b59 100644 --- a/plugins/aws/forecast/forecastDatasetEncrypted.js +++ b/plugins/aws/forecast/forecastDatasetEncrypted.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Forecast Dataset Encrypted', - category: 'ML & AI', + category: 'AI & ML', domain: 'Content Delivery', description: 'Ensure that AWS Forecast datasets are using desired KMS key for data encryption.', more_info: 'Datasets contain the data used to train a predictor. You create one or more Amazon Forecast datasets and import your training data into them. ' + diff --git a/plugins/aws/frauddetector/fraudDetectorDataEncrypted.js b/plugins/aws/frauddetector/fraudDetectorDataEncrypted.js index c43756f942..45ba1c59b2 100644 --- a/plugins/aws/frauddetector/fraudDetectorDataEncrypted.js +++ b/plugins/aws/frauddetector/fraudDetectorDataEncrypted.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Fraud Detector Data Encrypted', - category: 'ML & AI', + category: 'AI & ML', domain: 'Application Integration', description: 'Ensure that Amazon Fraud Detector has encryption enabled for data at rest with desired KMS encryption level.', more_info: 'Amazon Fraud Detector encrypts your data at rest with AWS-managed KMS key. Use customer-manager KMS keys (CMKs) instead in order to follow your organizations\'s security and compliance requirements.', diff --git a/plugins/aws/healthlake/dataStoreEncrypted.js b/plugins/aws/healthlake/dataStoreEncrypted.js index 569d453fb6..b9b16c0ddc 100644 --- a/plugins/aws/healthlake/dataStoreEncrypted.js +++ b/plugins/aws/healthlake/dataStoreEncrypted.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'HealthLake Data Store Encrypted', - category: 'ML & AI', + category: 'AI & ML', domain: 'Content Delivery', description: 'Ensure that AWS HealthLake Data Store is using desired encryption level.', more_info: 'Amazon HealthLake is a Fast Healthcare Interoperability Resources (FHIR)-enabled patient Data Store that uses AWS-managed KMS keys for encryption. ' + diff --git a/plugins/aws/kendra/kendraIndexEncrypted.js b/plugins/aws/kendra/kendraIndexEncrypted.js index 0a1225dc1e..5696ffa19a 100644 --- a/plugins/aws/kendra/kendraIndexEncrypted.js +++ b/plugins/aws/kendra/kendraIndexEncrypted.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Kendra Index Encrypted', - category: 'ML & AI', + category: 'AI & ML', domain: 'Databases', description: 'Ensure that the Kendra index is encrypted using desired encryption level.', more_info: 'Amazon Kendra encrypts your data at rest with AWS-manager keys by default. Use customer-managed keys instead in order to gain more granular control over encryption/decryption process.', diff --git a/plugins/aws/lex/lexAudioLogsEncrypted.js b/plugins/aws/lex/lexAudioLogsEncrypted.js index b32c0593d9..9e5bac1ad3 100644 --- a/plugins/aws/lex/lexAudioLogsEncrypted.js +++ b/plugins/aws/lex/lexAudioLogsEncrypted.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Audio Logs Encrypted', - category: 'ML & AI', + category: 'AI & ML', domain: 'Content Delivery', description: 'Ensure that Amazon Lex audio logs are encrypted using desired KMS encryption level', more_info: 'For audio logs you use default encryption on your S3 bucket or specify an AWS KMS key to encrypt your audio objects. Even if your S3 bucket uses default encryption you can still specify a different AWS KMS key to encrypt your audio objects for enhanced security.', diff --git a/plugins/aws/lookout/anomalyDetectorEncrypted.js b/plugins/aws/lookout/anomalyDetectorEncrypted.js index ab3f0e7c5c..042143b039 100644 --- a/plugins/aws/lookout/anomalyDetectorEncrypted.js +++ b/plugins/aws/lookout/anomalyDetectorEncrypted.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'LookoutMetrics Anomaly Detector Encrypted', - category: 'ML & AI', + category: 'AI & ML', domain: 'Content Delivery', description: 'Ensure that Amazon LookoutMetrics Anomaly Detector is encrypted using desired KMS encryption level', more_info: 'Amazon Lookout for Metrics encrypts your data at rest with your choice of an encryption key. If you do not specify an encryption key, your data is encrypted with AWS owned key by default. ' + diff --git a/plugins/aws/lookout/equipmentdatasetEncrypted.js b/plugins/aws/lookout/equipmentdatasetEncrypted.js index 15f5bd1b31..d489310dd4 100644 --- a/plugins/aws/lookout/equipmentdatasetEncrypted.js +++ b/plugins/aws/lookout/equipmentdatasetEncrypted.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'LookoutEquipment Dataset Encrypted', - category: 'ML & AI', + category: 'AI & ML', domain: 'Content Delivery', description: 'Ensure that Amazon Lookout for Equipment datasets are encrypted using desired KMS encryption level', more_info: 'Amazon Lookout for Equipment encrypts your data at rest with AWS owned KMS key by default. ' + diff --git a/plugins/aws/lookout/modelDataEncrypted.js b/plugins/aws/lookout/modelDataEncrypted.js index 8867642ad1..fca0ce677f 100644 --- a/plugins/aws/lookout/modelDataEncrypted.js +++ b/plugins/aws/lookout/modelDataEncrypted.js @@ -3,8 +3,8 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Model Data Encrypted', - category: 'Lookout', - domain: 'ML & AI', + category: 'AI & ML', + domain: 'Management and Governance', description: 'Ensure that Lookout for Vision model data is encrypted using desired KMS encryption level', more_info: 'By default, trained models and manifest files are encrypted in Amazon S3 using server-side encryption with KMS keys stored in AWS Key Management Service (SSE-KMS). ' + 'You can also use customer-managed keys instead in order to gain more granular control over encryption/decryption process.', @@ -58,7 +58,7 @@ module.exports = { 'Unable to list KMS keys: ' + helpers.addError(listKeys), region); return rcb(); } - + for (let project of listProjects.data){ if (!project.ProjectName) continue; @@ -102,7 +102,7 @@ module.exports = { let keyId = kmsKey.split('/')[1] ? kmsKey.split('/')[1] : kmsKey; let describeKey = helpers.addSource(cache, source, - ['kms', 'describeKey', region, keyId]); + ['kms', 'describeKey', region, keyId]); if (!describeKey || describeKey.err || !describeKey.data || !describeKey.data.KeyMetadata) { helpers.addResult(results, 3, @@ -138,4 +138,4 @@ module.exports = { callback(null, results, source); }); } -}; \ No newline at end of file +}; diff --git a/plugins/aws/s3/bucketVersioning.js b/plugins/aws/s3/bucketVersioning.js index 7a229ee8cd..85c69ca782 100644 --- a/plugins/aws/s3/bucketVersioning.js +++ b/plugins/aws/s3/bucketVersioning.js @@ -170,4 +170,4 @@ module.exports = { console.log(config, cache, settings, resource); callback(); } -}; \ No newline at end of file +}; diff --git a/plugins/aws/s3/versionedBucketsLC.js b/plugins/aws/s3/versionedBucketsLC.js index a988a3eb12..f3810bcb31 100644 --- a/plugins/aws/s3/versionedBucketsLC.js +++ b/plugins/aws/s3/versionedBucketsLC.js @@ -10,7 +10,7 @@ module.exports = { recommended_action: 'Configure lifecycle rules for buckets which have versioning enabled', link: 'https://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-set-lifecycle-configuration-intro.html', apis: ['S3:listBuckets', 'S3:getBucketVersioning', 'S3:getBucketLocation', 'S3:getBucketLifecycleConfiguration'], - realtime_triggers: ['s3:CreateBucket', 's3:PutBucketVersioninng', 's3:putBucketLifecycleConfiguration','s3:DeleteBucket'], + realtime_triggers: ['s3:CreateBucket', 's3:PutBucketVersioning', 's3:putBucketLifecycleConfiguration','s3:DeleteBucket'], run: function(cache, settings, callback) { var results = []; diff --git a/plugins/aws/sagemaker/notebookDataEncrypted.js b/plugins/aws/sagemaker/notebookDataEncrypted.js index 6f35dee386..99a40562ea 100644 --- a/plugins/aws/sagemaker/notebookDataEncrypted.js +++ b/plugins/aws/sagemaker/notebookDataEncrypted.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Notebook Data Encrypted', - category: 'ML & AI', + category: 'AI & ML', domain: 'Compute', description: 'Ensure Notebook data is encrypted', more_info: 'An optional encryption key can be supplied during Notebook Instance creation.', diff --git a/plugins/aws/sagemaker/notebookDirectInternetAccess.js b/plugins/aws/sagemaker/notebookDirectInternetAccess.js index cd29b1df6c..99c7c5b72d 100644 --- a/plugins/aws/sagemaker/notebookDirectInternetAccess.js +++ b/plugins/aws/sagemaker/notebookDirectInternetAccess.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Notebook Direct Internet Access', - category: 'ML & AI', + category: 'AI & ML', domain: 'Compute', description: 'Ensure Notebook Instance is not publicly available.', more_info: 'SageMaker notebooks should not be exposed to the Internet. Public availability can be configured via the DirectInternetAccess attribute.', diff --git a/plugins/aws/sagemaker/notebookInstanceInVpc.js b/plugins/aws/sagemaker/notebookInstanceInVpc.js index cc948af66e..331a65ab35 100644 --- a/plugins/aws/sagemaker/notebookInstanceInVpc.js +++ b/plugins/aws/sagemaker/notebookInstanceInVpc.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Notebook instance in VPC', - category: 'ML & AI', + category: 'AI & ML', domain: 'Compute', description: 'Ensure that Amazon SageMaker Notebook instances are launched within a VPC.', more_info: 'Launching instances can bring multiple advantages such as better networking infrastructure, much more flexible control over access security. Also it makes it possible to access VPC-only resources such as EFS file systems.', diff --git a/plugins/aws/translate/translateJobOutputEncrypted.js b/plugins/aws/translate/translateJobOutputEncrypted.js index 3f0530a282..8d6485f020 100644 --- a/plugins/aws/translate/translateJobOutputEncrypted.js +++ b/plugins/aws/translate/translateJobOutputEncrypted.js @@ -3,7 +3,7 @@ var helpers = require('../../../helpers/aws'); module.exports = { title: 'Translate Job Output Encrypted', - category: 'ML & AI', + category: 'AI & ML', domain: 'Compute', description: 'Ensure that your Amazon Translate jobs have CMK encryption enabled for output data residing on S3.', more_info: 'Amazon Translate encrypts your output data with AWS-manager keys by default. ' + diff --git a/plugins/azure/appConfigurations/appConfigManagedIdentity.js b/plugins/azure/appConfigurations/appConfigManagedIdentity.js index c5b721d5e1..c63e59eee3 100644 --- a/plugins/azure/appConfigurations/appConfigManagedIdentity.js +++ b/plugins/azure/appConfigurations/appConfigManagedIdentity.js @@ -18,7 +18,7 @@ module.exports = { var locations = helpers.locations(settings.govcloud); async.each(locations.appConfigurations, function(location, rcb){ - var appConfigurations = helpers.addSource(cache, source, + var appConfigurations = helpers.addSource(cache, source, ['appConfigurations', 'list', location]); if (!appConfigurations) return rcb(); @@ -48,4 +48,4 @@ module.exports = { callback(null, results, source); }); } -}; \ No newline at end of file +}; diff --git a/plugins/azure/appConfigurations/appConfigurationDiagnosticLogs.js b/plugins/azure/appConfigurations/appConfigurationDiagnosticLogs.js index 21b4081dc6..a222baed7a 100644 --- a/plugins/azure/appConfigurations/appConfigurationDiagnosticLogs.js +++ b/plugins/azure/appConfigurations/appConfigurationDiagnosticLogs.js @@ -17,7 +17,7 @@ module.exports = { var locations = helpers.locations(settings.govcloud); async.each(locations.appConfigurations, function(location, rcb) { - var appConfigurations = helpers.addSource(cache, source, + var appConfigurations = helpers.addSource(cache, source, ['appConfigurations', 'list', location]); if (!appConfigurations) return rcb(); @@ -35,9 +35,9 @@ module.exports = { for (let appConfiguration of appConfigurations.data) { if (!appConfiguration.id) continue; - var diagnosticSettings = helpers.addSource(cache, source, + var diagnosticSettings = helpers.addSource(cache, source, ['diagnosticSettings', 'listByAppConfigurations', location, appConfiguration.id]); - + if (!diagnosticSettings || diagnosticSettings.err || !diagnosticSettings.data) { helpers.addResult(results, 3, `Unable to query for App Configuration diagnostic settings: ${helpers.addError(diagnosticSettings)}`, location, appConfiguration.id); @@ -51,7 +51,7 @@ module.exports = { } else { helpers.addResult(results, 2, 'App Configuration does not have diagnostic logs enabled', location, appConfiguration.id); } - + } rcb(); @@ -60,4 +60,4 @@ module.exports = { callback(null, results, source); }); } -}; \ No newline at end of file +}; diff --git a/plugins/azure/appConfigurations/appConfigurationPublicAccess.js b/plugins/azure/appConfigurations/appConfigurationPublicAccess.js index 665509ef9f..f138c05846 100644 --- a/plugins/azure/appConfigurations/appConfigurationPublicAccess.js +++ b/plugins/azure/appConfigurations/appConfigurationPublicAccess.js @@ -48,4 +48,4 @@ module.exports = { callback(null, results, source); }); } -}; \ No newline at end of file +}; diff --git a/plugins/azure/applicationGateway/applicationGatewayHasTags.js b/plugins/azure/applicationGateway/applicationGatewayHasTags.js index f7d28659b8..0c483bffce 100644 --- a/plugins/azure/applicationGateway/applicationGatewayHasTags.js +++ b/plugins/azure/applicationGateway/applicationGatewayHasTags.js @@ -18,7 +18,7 @@ module.exports = { const locations = helpers.locations(settings.govcloud); async.each(locations.applicationGateway, (location, rcb) => { - var appGateways = helpers.addSource(cache, source, + var appGateways = helpers.addSource(cache, source, ['applicationGateway', 'listAll', location]); if (!appGateways) return rcb(); @@ -31,8 +31,8 @@ module.exports = { if (!appGateways.data.length) { helpers.addResult(results, 0, 'No existing application gateways found', location); return rcb(); - } - + } + for (let appGateway of appGateways.data) { if (!appGateway.id) continue; @@ -40,7 +40,7 @@ module.exports = { helpers.addResult(results, 0, 'Application Gateway has tags associated', location, appGateway.id); } else { helpers.addResult(results, 2, 'Application Gateway does not have tags associated', location, appGateway.id); - } + } } diff --git a/plugins/azure/monitor/logProfileArchiveData.spec.js b/plugins/azure/monitor/logProfileArchiveData.spec.js index 36f89ddc0d..9a583b944d 100644 --- a/plugins/azure/monitor/logProfileArchiveData.spec.js +++ b/plugins/azure/monitor/logProfileArchiveData.spec.js @@ -64,7 +64,9 @@ const logProfile = [ "brazilsoutheast", "global", 'qatarcentral', - 'polandcentral', + 'polandcentral', + 'italynorth', + 'israelcentral' ], "categories": [ "Write", diff --git a/plugins/azure/networksecuritygroups/defaultSecurityGroup.js b/plugins/azure/networksecuritygroups/defaultSecurityGroup.js index b9d3279697..af817045f7 100644 --- a/plugins/azure/networksecuritygroups/defaultSecurityGroup.js +++ b/plugins/azure/networksecuritygroups/defaultSecurityGroup.js @@ -32,7 +32,7 @@ module.exports = { if (!networkSecurityGroups) return rcb(); if (networkSecurityGroups.err || !networkSecurityGroups.data) { - helpers.addResult(results, 3, + helpers.addResult(results, 3, 'Unable to query for Network Security Groups: ' + helpers.addError(networkSecurityGroups), location); return rcb(); } @@ -98,4 +98,4 @@ module.exports = { callback(null, results, source); }); } -}; \ No newline at end of file +}; diff --git a/plugins/azure/virtualmachines/vmBootDiagnosticsEnabled.js b/plugins/azure/virtualmachines/vmBootDiagnosticsEnabled.js index a637f83eee..8fe99120ed 100644 --- a/plugins/azure/virtualmachines/vmBootDiagnosticsEnabled.js +++ b/plugins/azure/virtualmachines/vmBootDiagnosticsEnabled.js @@ -11,7 +11,7 @@ module.exports = { recommended_action: 'Enable boot diagnostics for all virtual machines.', link: 'https://learn.microsoft.com/en-us/azure/virtual-machines/boot-diagnostics', apis: ['virtualMachines:listAll'], - realtime_triggers: ['microsoftcompute:virtualmachines:write', 'microsoftcompute:virtualmachines:delete', 'microsoftcompute:retrievebootdiagnosticsdata:action'], + realtime_triggers: ['microsoftcompute:virtualmachines:write', 'microsoftcompute:virtualmachines:delete'], run: function(cache, settings, callback) { var results = [];