Verify similarities of queries across different platforms

[roi-orca]

Hi,
I would like to understand if the following queries have the same security meaning or if they differ from each other.
If they are different, can we change the query name so it won't be confusing?
I grouped the cloud provider and the query name as the base for equality

1. AWS - S3 Bucket Access to Any Principal:

{
  "id": "7af43613-6bb9-4a0e-8c4d-1314b799425e",
  "queryName": "S3 Bucket Access to Any Principal",
  "severity": "HIGH",
  "category": "Access Control",
  "descriptionText": "S3 Buckets must not allow Actions From All Principals, as to prevent leaking private information to the entire internet or allow unauthorized data tampering / deletion. This means the 'Effect' must not be 'Allow' when there are All Principals",
  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_policy",
  "platform": "Terraform",
  "descriptionID": "4f884b47",
  "cloudProvider": "aws"
}
{
  "id": "3ab1f27d-52cc-4943-af1d-43c1939e739a",
  "queryName": "S3 Bucket Access to Any Principal",
  "severity": "HIGH",
  "category": "Access Control",
  "descriptionText": "Checks if the S3 bucket is accessible for all users",
  "descriptionUrl": "https://docs.ansible.com/ansible/latest/collections/amazon/aws/s3_bucket_module.html#ansible-collections-amazon-aws-s3-bucket-module",
  "platform": "Ansible",
  "descriptionID": "25111d64",
  "cloudProvider": "aws"
}
{
  "id": "7772bb8c-c0f3-42d4-8e4e-f1b8939ad085",
  "queryName": "S3 Bucket Access to Any Principal",
  "severity": "HIGH",
  "category": "Access Control",
  "descriptionText": "The S3 Bucket should not have the (accessPublicBlock empty or accessPublicBlock.ignorePublicAcls = false or accessPublicBlock.restrictPublicBuckets = false ) and ( policy.Statement contain [Effect='Allow' and (Principal='*' or Principal.AWS='*')])",
  "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html",
  "platform": "CloudFormation",
  "descriptionID": "9a57423d",
  "cloudProvider": "aws"
}

2. AWS - Kinesis SSE Not Configured

{
  "id": "5c6dd5e7-1fe0-4cae-8f81-4c122717cef3",
  "queryName": "Kinesis SSE Not Configured",
  "severity": "HIGH",
  "category": "Encryption",
  "descriptionText": "AWS Kinesis Server data at rest should have Server Side Encryption (SSE) enabled",
  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_firehose_delivery_stream#server_side_encryption",
  "platform": "Terraform",
  "descriptionID": "fce3b812",
  "cloudProvider": "aws"
}
{
  "id": "7f65be75-90ab-4036-8c2a-410aef7bb650",
  "queryName": "Kinesis SSE Not Configured",
  "severity": "HIGH",
  "category": "Encryption",
  "descriptionText": "AWS Kinesis Stream should have SSE (Server Side Encryption) defined",
  "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kinesis-stream.html",
  "platform": "CloudFormation",
  "descriptionID": "a8238dc8",
  "cloudProvider": "aws"
}

3. AWS - EC2 Instance Has Public IP

{
  "id": "5a2486aa-facf-477d-a5c1-b010789459ce",
  "queryName": "EC2 Instance Has Public IP",
  "severity": "HIGH",
  "category": "Networking and Firewall",
  "descriptionText": "EC2 Instance should not have a public IP address.",
  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#associate_public_ip_address",
  "platform": "Terraform",
  "descriptionID": "c6f1d1f4",
  "cloudProvider": "aws"
}
{
  "id": "b3de4e4c-14be-4159-b99d-9ad194365e4c",
  "queryName": "EC2 Instance Has Public IP",
  "severity": "HIGH",
  "category": "Networking and Firewall",
  "descriptionText": "EC2 Subnet should not have MapPublicIpOnLaunch set to true",
  "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-subnet.html#cfn-ec2-subnet-mappubliciponlaunch",
  "platform": "CloudFormation",
  "descriptionID": "22e3d598",
  "cloudProvider": "aws"
}

4. AWS - IAM Policies Attached To User

{
  "id": "b4378389-a9aa-44ee-91e7-ef183f11079e",
  "queryName": "IAM Policies Attached To User",
  "severity": "LOW",
  "category": "Best Practices",
  "descriptionText": "IAM policies should be attached only to groups or roles",
  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment",
  "platform": "Terraform",
  "descriptionID": "32ec58ec",
  "cloudProvider": "aws"
}
{
  "id": "edc95c10-7366-4f30-9b4b-f995c84eceb5",
  "queryName": "IAM Policies Attached To User",
  "severity": "LOW",
  "category": "Best Practices",
  "descriptionText": "IAM User should embed managed policies instead of inline policies",
  "descriptionUrl": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html",
  "platform": "CloudFormation",
  "descriptionID": "c1857bae",
  "cloudProvider": "aws"
}

5. AWS - Unrestricted Security Group Ingress

{
  "id": "4728cd65-a20c-49da-8b31-9c08b423e4db",
  "queryName": "Unrestricted Security Group Ingress",
  "severity": "HIGH",
  "category": "Networking and Firewall",
  "descriptionText": "Security groups allow ingress from 0.0.0.0:0",
  "descriptionUrl": "https://www.terraform.io/docs/providers/aws/r/security_group.html",
  "platform": "Terraform",
  "descriptionID": "ce3ee5e0",
  "cloudProvider": "aws"
}
{
  "id": "4a1e6b34-1008-4e61-a5f2-1f7c276f8d14",
  "queryName": "Unrestricted Security Group Ingress",
  "severity": "HIGH",
  "category": "Networking and Firewall",
  "descriptionText": "AWS Security Group Ingress CIDR should not be open to the world",
  "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html",
  "platform": "CloudFormation",
  "descriptionID": "08256d31",
  "cloudProvider": "aws"
}

6. AWS - Route53 Record Undefined

{
  "id": "25db74bf-fa3b-44da-934e-8c3e005c0453",
  "queryName": "Route53 Record Undefined",
  "severity": "HIGH",
  "category": "Networking and Firewall",
  "descriptionText": "Check if Record is set",
  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record",
  "platform": "Terraform",
  "descriptionID": "91562f39",
  "cloudProvider": "aws"
}
{
  "id": "24d932e1-91f0-46ea-836f-fdbd81694151",
  "queryName": "Route53 Record Undefined",
  "severity": "HIGH",
  "category": "Networking and Firewall",
  "descriptionText": "Route53 HostedZone must have the Record Set defined.",
  "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-route53-hostedzone.html",
  "platform": "CloudFormation",
  "descriptionID": "268f1d77",
  "cloudProvider": "aws"
}

7. AWS - S3 Static Website Host Enabled

{
  "id": "42bb6b7f-6d54-4428-b707-666f669d94fb",
  "queryName": "S3 Static Website Host Enabled",
  "severity": "HIGH",
  "category": "Insecure Configurations",
  "descriptionText": "Checks if any static websties are hosted on buckets. Even static websites can be a liability when poorly configured.",
  "descriptionUrl": "https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#website",
  "platform": "Terraform",
  "descriptionID": "4db5c45a",
  "cloudProvider": "aws"
}
{
  "id": "90501b1b-cded-4cc1-9e8b-206b85cda317",
  "queryName": "S3 Static Website Host Enabled",
  "severity": "HIGH",
  "category": "Insecure Configurations",
  "descriptionText": "It's dangerous disabling a block public access settings in bucket or writing a bucket policy that grants public read access",
  "descriptionUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-publicaccessblockconfiguration.html",
  "platform": "CloudFormation",
  "descriptionID": "b50aab99",
  "cloudProvider": "aws"
}

Thanks!

[nunoocx]

Hi @roi-orca ,
we will dig deeper, but from initial analysis looks like queries in each group are the same but for different technologies (Terraform, Cloudformation and Ansible).