From d8fa3066244d4f3ec492adae25058200ed181982 Mon Sep 17 00:00:00 2001 From: Or Ouziel Date: Thu, 28 Sep 2023 14:53:16 +0300 Subject: [PATCH] Add CIS GCP 2.1 (#288) --- README.md | 2 +- RULES.md | 6 +- .../cis_gcp/rules/cis_2_1/data.yaml | 118 ++++++++++++++++++ .../cis_gcp/rules/cis_2_1/rule.rego | 34 +++++ .../cis_gcp/rules/cis_2_1/test.rego | 84 +++++++++++++ bundle/compliance/cis_gcp/test_data.rego | 6 + .../compliance/policy/gcp/data_adapter.rego | 4 + 7 files changed, 250 insertions(+), 4 deletions(-) create mode 100644 bundle/compliance/cis_gcp/rules/cis_2_1/data.yaml create mode 100644 bundle/compliance/cis_gcp/rules/cis_2_1/rule.rego create mode 100644 bundle/compliance/cis_gcp/rules/cis_2_1/test.rego diff --git a/README.md b/README.md index 7d96dcd6..2736e8a5 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ [![CIS K8S](https://img.shields.io/badge/CIS-Kubernetes%20(74%25)-326CE5?logo=Kubernetes)](RULES.md#k8s-cis-benchmark) [![CIS EKS](https://img.shields.io/badge/CIS-Amazon%20EKS%20(60%25)-FF9900?logo=Amazon+EKS)](RULES.md#eks-cis-benchmark) [![CIS AWS](https://img.shields.io/badge/CIS-AWS%20(87%25)-232F3E?logo=Amazon+AWS)](RULES.md#aws-cis-benchmark) -[![CIS GCP](https://img.shields.io/badge/CIS-GCP%20(83%25)-4285F4?logo=Google+Cloud)](RULES.md#gcp-cis-benchmark) +[![CIS GCP](https://img.shields.io/badge/CIS-GCP%20(85%25)-4285F4?logo=Google+Cloud)](RULES.md#gcp-cis-benchmark) [![CIS AZURE](https://img.shields.io/badge/CIS-AZURE%20(1%25)-F00EE8?logo=Microsoft+Azure)](RULES.md#azure-cis-benchmark) ![Coverage Badge](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/oren-zohar/a7160df46e48dff45b24096de9302d38/raw/csp-security-policies_coverage.json) diff --git a/RULES.md b/RULES.md index f18fd64c..f5cd5b2c 100644 --- a/RULES.md +++ b/RULES.md @@ -275,9 +275,9 @@ ## GCP CIS Benchmark -### 70/84 implemented rules (83%) +### 71/84 implemented rules (85%) -#### Automated rules: 70/73 (96%) +#### Automated rules: 71/73 (97%) #### Manual rules: 0/11 (0%) @@ -301,7 +301,7 @@ | [1.7](bundle/compliance/cis_gcp/rules/cis_1_7) | Identity and Access Management | Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer | :white_check_mark: | Automated | | [1.8](bundle/compliance/cis_gcp/rules/cis_1_8) | Identity and Access Management | Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users | :white_check_mark: | Automated | | [1.9](bundle/compliance/cis_gcp/rules/cis_1_9) | Identity and Access Management | Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible | :white_check_mark: | Automated | -| 2.1 | Logging and Monitoring | Ensure That Cloud Audit Logging Is Configured Properly | :x: | Automated | +| [2.1](bundle/compliance/cis_gcp/rules/cis_2_1) | Logging and Monitoring | Ensure That Cloud Audit Logging Is Configured Properly | :white_check_mark: | Automated | | [2.10](bundle/compliance/cis_gcp/rules/cis_2_10) | Logging and Monitoring | Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes | :white_check_mark: | Automated | | [2.11](bundle/compliance/cis_gcp/rules/cis_2_11) | Logging and Monitoring | Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes | :white_check_mark: | Automated | | [2.12](bundle/compliance/cis_gcp/rules/cis_2_12) | Logging and Monitoring | Ensure That Cloud DNS Logging Is Enabled for All VPC Networks | :white_check_mark: | Automated | diff --git a/bundle/compliance/cis_gcp/rules/cis_2_1/data.yaml b/bundle/compliance/cis_gcp/rules/cis_2_1/data.yaml new file mode 100644 index 00000000..abcd6b2e --- /dev/null +++ b/bundle/compliance/cis_gcp/rules/cis_2_1/data.yaml @@ -0,0 +1,118 @@ +metadata: + id: a4b61e0e-b0ca-53c5-a744-4587c57e0f2d + name: Ensure That Cloud Audit Logging Is Configured Properly + profile_applicability: '* Level 1' + description: |- + It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data. + rationale: |- + Cloud Audit Logging maintains two audit logs for each project, folder, and organization: Admin Activity and Data Access. + + 1. Admin Activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin Activity audit logs are enabled for all services and cannot be configured. + + 2. Data Access audit logs record API calls that create, modify, or read user-provided data. These are disabled by default and should be enabled. + + There are three kinds of Data Access audit log information: + + - Admin read: Records operations that read metadata or configuration information. + Admin Activity audit logs record writes of metadata and configuration information that cannot be disabled. + - Data read: Records operations that read user-provided data. + - Data write: Records operations that write user-provided data. + + It is recommended to have an effective default audit config configured in such a way that: + + 3. logtype is set to DATA_READ (to log user activity tracking) and DATA_WRITES (to log changes/tampering to user data). + + 4. audit config is enabled for all the services supported by the Data Access audit logs feature. + + 5. Logs should be captured for all users, i.e., there are no exempted users in any of the audit config sections. This will ensure overriding the audit config will not contradict the requirement. + audit: |- + **From Google Cloud Console** + + 1. Go to `Audit Logs` by visiting [https://console.cloud.google.com/iam-admin/audit](https://console.cloud.google.com/iam-admin/audit). + 2. Ensure that Admin Read, Data Write, and Data Read are enabled for all Google Cloud services and that no exemptions are allowed. + + **From Google Cloud CLI** + + 3. List the Identity and Access Management (IAM) policies for the project, folder, or organization: + ``` + gcloud organizations get-iam-policy ORGANIZATION_ID + gcloud resource-manager folders get-iam-policy FOLDER_ID + gcloud projects get-iam-policy PROJECT_ID + ``` + 4. Policy should have a default auditConfigs section which has the logtype set to DATA_WRITES and DATA_READ for all services. Note that projects inherit settings from folders, which in turn inherit settings from the organization. When called, projects get-iam-policy, the result shows only the policies set in the project, not the policies inherited from the parent folder or organization. Nevertheless, if the parent folder has Cloud Audit Logging enabled, the project does as well. + + Sample output for default audit configs may look like this: + + ``` + auditConfigs: + - auditLogConfigs: + - logType: ADMIN_READ + - logType: DATA_WRITE + - logType: DATA_READ + service: allServices + ``` + + 5. Any of the auditConfigs sections should not have parameter "exemptedMembers:" set, which will ensure that Logging is enabled for all users and no user is exempted. + remediation: |- + **From Google Cloud Console** + 1. Go to `Audit Logs` by visiting [https://console.cloud.google.com/iam-admin/audit](https://console.cloud.google.com/iam-admin/audit). + 2. Follow the steps at [https://cloud.google.com/logging/docs/audit/configure-data-access](https://cloud.google.com/logging/docs/audit/configure-data-access) to enable audit logs for all Google Cloud services. Ensure that no exemptions are allowed. + + **From Google Cloud CLI** + + 3. To read the project's IAM policy and store it in a file run a command: + + ``` + gcloud projects get-iam-policy PROJECT_ID > /tmp/project_policy.yaml + ``` + + Alternatively, the policy can be set at the organization or folder level. + If setting the policy at the organization level, it is not necessary to also set it for each folder or project. + + ``` + gcloud organizations get-iam-policy ORGANIZATION_ID > /tmp/org_policy.yaml + gcloud resource-manager folders get-iam-policy FOLDER_ID > /tmp/folder_policy.yaml + ``` + + 4. Edit policy in /tmp/policy.yaml, adding or changing only the audit logs configuration to: + **Note: Admin Activity Logs are enabled by default, and cannot be disabled. + So they are not listed in these configuration changes.** + ``` + auditConfigs: + - auditLogConfigs: + - logType: DATA_WRITE + - logType: DATA_READ + service: allServices + ``` + + **Note:** `exemptedMembers:` is not set as audit logging should be enabled for all the users + + 5. To write new IAM policy run command: + + ``` + gcloud organizations set-iam-policy ORGANIZATION_ID /tmp/org_policy.yaml + gcloud resource-manager folders set-iam-policy FOLDER_ID /tmp/folder_policy.yaml + gcloud projects set-iam-policy PROJECT_ID /tmp/project_policy.yaml + ``` + + If the preceding command reports a conflict with another change, then repeat these steps, starting with the first step. + impact: |- + There is no charge for Admin Activity audit logs. + Enabling the Data Access audit logs might result in your project being charged for the additional logs usage. + default_value: '' + references: |- + 1. https://cloud.google.com/logging/docs/audit/ + 2. https://cloud.google.com/logging/docs/audit/configure-data-access + section: Logging and Monitoring + version: '1.0' + tags: + - CIS + - GCP + - CIS 2.1 + - Logging and Monitoring + benchmark: + name: CIS Google Cloud Platform Foundation + version: v2.0.0 + id: cis_gcp + rule_number: '2.1' + posture_type: cspm diff --git a/bundle/compliance/cis_gcp/rules/cis_2_1/rule.rego b/bundle/compliance/cis_gcp/rules/cis_2_1/rule.rego new file mode 100644 index 00000000..caeafc29 --- /dev/null +++ b/bundle/compliance/cis_gcp/rules/cis_2_1/rule.rego @@ -0,0 +1,34 @@ +package compliance.cis_gcp.rules.cis_2_1 + +import data.compliance.lib.common +import data.compliance.policy.gcp.data_adapter +import future.keywords.if +import future.keywords.in + +finding = result if { + data_adapter.is_policies_resource + + result := common.generate_result_without_expected( + common.calculate_result(cloud_logging_is_configured), + input.resource, + ) +} + +cloud_logging_is_configured if { + policy := input.resource[_].iam_policy + has_read_write_logs(policy) + not has_exempted_members(policy) +} else = false + +has_read_write_logs(policy) if { + log_types := {t | t = policy.audit_configs[i].audit_log_configs[j].log_type} + 1 in log_types # "ADMIN_READ" + 2 in log_types # "DATA_WRITE" + 3 in log_types # "DATA_READ" + policy.audit_configs[_].service == "allServices" +} else = false + +has_exempted_members(policy) if { + configs := policy.audit_configs[_].audit_log_configs[_] + count(configs.exempted_members) > 0 +} else = false diff --git a/bundle/compliance/cis_gcp/rules/cis_2_1/test.rego b/bundle/compliance/cis_gcp/rules/cis_2_1/test.rego new file mode 100644 index 00000000..9428cdd1 --- /dev/null +++ b/bundle/compliance/cis_gcp/rules/cis_2_1/test.rego @@ -0,0 +1,84 @@ +package compliance.cis_gcp.rules.cis_2_1 + +import data.cis_gcp.test_data +import data.compliance.policy.gcp.data_adapter +import data.lib.test + +test_violation { + # fail when no read/write logs are set for project/folder/org level + eval_fail with input as test_data.generate_policies_asset([{}]) + + # fail when DATA_WRITE is missing from project + eval_fail with input as test_data.generate_policies_asset([{"iam_policy": {"audit_configs": [{ + "audit_log_configs": [{"log_type": 2}, {"log_type": 1}], + "service": "allServices", + }]}}]) + + # fail when DATA_READ is missing from project + eval_fail with input as test_data.generate_policies_asset([{"iam_policy": {"audit_configs": [{ + "audit_log_configs": [{"log_type": 3}, {"log_type": 1}], + "service": "allServices", + }]}}]) + + # fail when ADMIN_READ is missing from project + eval_fail with input as test_data.generate_policies_asset([{"iam_policy": {"audit_configs": [{ + "audit_log_configs": [{"log_type": 3}, {"log_type": 2}], + "service": "allServices", + }]}}]) + + # fail when extempted members is not empty + eval_fail with input as test_data.generate_policies_asset([{"iam_policy": {"audit_configs": [{ + "audit_log_configs": [ + { + "log_type": 3, + "exempted_members": ["user:a"], + }, + {"log_type": 2}, {"log_type": 1}, + ], + "service": "allServices", + }]}}]) + + # fail when "service": "allServices" is missing from project + eval_fail with input as test_data.generate_policies_asset([{"iam_policy": {"audit_configs": [{"audit_log_configs": [{"log_type": 3}, {"log_type": 2}, {"log_type": 1}]}]}}]) + + # fail when DATA_READ and DATA_WRITE aren't set on the same policy + eval_fail with input as test_data.generate_policies_asset([ + {"iam_policy": {"audit_configs": [{ + "audit_log_configs": [{"log_type": 3}, {"log_type": 1}], + "service": "allServices", + }]}}, + {"iam_policy": {"audit_configs": [{ + "audit_log_configs": [{"log_type": 2}, {"log_type": 1}], + "service": "allServices", + }]}}, + ]) +} + +test_pass { + # passes when project has DATA_READ/DATA_WRITE/ADMIN_READ + # for all services, and with no exempted members + eval_pass with input as test_data.generate_policies_asset([{"iam_policy": {"audit_configs": [{ + "audit_log_configs": [ + {"log_type": 1}, + {"log_type": 2}, + {"log_type": 3}, + ], + "service": "allServices", + }]}}]) +} + +test_not_evaluated { + not_eval with input as test_data.not_eval_resource +} + +eval_fail { + test.assert_fail(finding) with data.benchmark_data_adapter as data_adapter +} + +eval_pass { + test.assert_pass(finding) with data.benchmark_data_adapter as data_adapter +} + +not_eval { + not finding with data.benchmark_data_adapter as data_adapter +} diff --git a/bundle/compliance/cis_gcp/test_data.rego b/bundle/compliance/cis_gcp/test_data.rego index d3d5e699..ae815618 100644 --- a/bundle/compliance/cis_gcp/test_data.rego +++ b/bundle/compliance/cis_gcp/test_data.rego @@ -25,6 +25,12 @@ generate_monitoring_asset(log_metrics, alerts) = { "subType": "gcp-monitoring", } +generate_policies_asset(policies) = { + "resource": policies, + "type": "project-managment", + "subType": "gcp-policies", +} + generate_serviceusage_asset(services) = { "resource": {"services": services}, "type": "monitoring", diff --git a/bundle/compliance/policy/gcp/data_adapter.rego b/bundle/compliance/policy/gcp/data_adapter.rego index d2b04467..d206c3f9 100644 --- a/bundle/compliance/policy/gcp/data_adapter.rego +++ b/bundle/compliance/policy/gcp/data_adapter.rego @@ -8,6 +8,10 @@ iam_policy = input.resource.iam_policy has_policy = common.contains_key(input.resource, "iam_policy") +is_policies_resource { + input.subType == "gcp-policies" +} + is_gke_instance(instance) { startswith(instance.name, "gke-") }